Hacker News Reader

Comment by olah_1 | Hacker News Reader

frankly, i think this is where decentralized networks can help us.

1. networks where global reach to total strangers is not even possible, or at least is not the default. the vast majority of people only really want to reach their “friends of friends” anyway. this eliminates a lot of would-be hackers from even knowing you exist.

2. accounts that are unhackable because users log in with private keys instead of user/pass that sit on a server. of course losing your private key is a problem, but i would suggest a system of social-account recovery anyway where you can regain access by 3 out of 5 friends approving, for example.

View on HN

I do think a "trusted friends" circle would be a better way to deal with these kinds of problems, because I know my friends would be available to help me and easier to reach than customer support.

> 2. accounts that are unhackable because users log in with private keys instead of user/pass

There's nothing magical about private keys that prevents them from being lost or stolen.

The average person doesn't want to manage private key files. The average person wants to be able to recover their account if they forget or lose their password. Moving to private keys isn't a realistic solution for logins for the average person.

I’m sure the average person didn’t want to use keys to lock their house or car—we adapt.

The average person prefers passwords to key files?

The average user isn't even aware of the potential option of the key file.

I think the popularity of password managers shows that users preferences are opposite to what you say. The user wants the machine to store the secrets rather than memorize and type them.

Recovery mechanisms is a separate issue from whether you use passwords or key files.

> The average person wants to be able to recover their account if they forget or lose their password

That’s why i mentioned Social Account Recovery. There are solutions to improve general UX of key management.

>the vast majority of people

i think the concept of followers shows that your premise isn't exactly true and people with more followers than just family, friends, and friends of friends is also another clue.

“friends” in the term “friends of friends” refers to followers

Wouldn't that be worse since private keys are king and there is no way to intervene?

Exactly. If private keys were that much better for the average, shouldn't some common services use them now?

Private keys are used to upload code to github.

It's not about what's "better" but about what users are willing to tolerate. The average user has a very high tolerance for login bullshit, repeated captchas, etc. -- if the site has a monopoly on the social network you need to access.

And yet, even Github has passwords. Even Github uses passwords as primary. Along with millions of other sites. This isn't about what a few large companies do. It's about what works for most people.

Private keys, as appealing as they are in theory, don't really work from a user perspective. The closest thing that seems to be popular is 2FA keys like YubiKeys.

A simple social recovery method of 3 contacts approving could lead to mass takeovers if the attacker gets a hold onto multiple accounts. Often, a group of say 3 attacker controlled accounts doesn't just have one friend in common but multiple. As long as the graph is 3 connected and the attacker starts out with a group of accounts that can take over one more account, the attacker can take over the entire graph.

There are ways around this. Just having each account only able to do the verification thing occasionally and resetting that timer when it's done on your account make this a very slow process that manual intervention should be able to thwart.

Not a good idea. Account recovery should not depend on social relationships, the nature of which could change any time.

The point is that it’s optional and changeable.

domain registration and a blog solves most of this. You have to BYO discoverability though.

thats your big idea? i mean you can create a social network that does anything, and your big market killer is "safer login experience?" ... like who the fuck cares.

It doesn't matter at all to reality, so it's probably the next Unicorn in SV.

did you read the original post up top? are you aware that we are specifically talking about account safety and login?

as prompted from the OP, it’s just a few things that a decentralized network can offer around account safety that is better than the current centralized ones today.

what are you looking for from me? i’ll try to perform better for you next time lol.

Reply on news.ycombinator.com