Hacker News Reader

Comment by marcus_holmes | Hacker News Reader

It misses the point of why PC's were adopted, which was spreadsheets. No-one put a PC on your desk because you needed a PC. They put a PC on your desk because you suddenly needed to be able to use a spreadsheet to do your job [0].

And the reason we all got internet connections in the mid-90's wasn't Web0. It was email. Web0 was a toy thing that only us geeks played around with, that came free with your email account. All the "serious" stuff that we use the web for now was in the walled gardens (CompuServe or AOL).

Web3 needs a "killer app" like email or spreadsheets. Still not seeing one.

[0] Source: I had this happen to me. Working a desk job as an admin clerk in a transport company, and suddenly our monthly budget/financials had to be sent to head office in Lotus 123 instead of paper. So I got a PC (286, 4Mb of memory woot!) and learned Lotus 123. Fun times :)

View on HN

Disclaimer: I work in the web3 (crypto) space and have for a long time already.

I think the killer app for web3 is going to be a decentralized, open identity/auth solution. The idea that we use our email accounts, attached to huge corporations which siphon every detail about us for their advertising engines is absolutely absurd. I just want to be able to log in to applications and carry some of the simple data like my identity and what assets I have available with me, without having to pay for it by losing my privacy and autonomy.

Nothing in the web2 tech stack currently allows this.

Imagine being able to log in, securely, to HN, Twitter, your bank, et al., and with you comes basic data about how to contact you, how you pay, what assets you're holding, etc. You get to choose what you share, and you get to authenticate each transaction discretely. It's powerful and it puts that power in your hands, not in those of large corporate entities.

That's what I'm interested in, and that's what I work on. We should all want some form of that.

edit: glad the response to this was by people interested and curious. my usual feeling on HN is that people are hyper-negative about web3 tech. It's ok to be curious about new, cutting edge technology. That's what we're all here for, I think. Maybe the decentralized trend won't pan out. Maybe it is all a giant scam. Doesn't mean it isn't interesting and it doesn't mean that the people working in that space aren't legitimately trying to innovate.

I love when web3 people say this, because it's revealing. There is really no application you can come up with that is less amenable to decentralized blockchain technology than identity. The hardest problem in identity isn't public key authentication (which we've had for 2 decades, and nobody wants) but account recovery. The absolute last thing any ordinary user wants is an identity that is cryptographically unrecoverable, or that functions like a bearer bond if compromised.

Account recovery isn't a basket of features like multi-sig wallets and threshold schemes. It's the assumption, so far baked in that most users don't even realize they're making it, that if something goes wrong with an account there is a human-mediated process for restoring access. A centralized authority is intrinsic to the concept! It has to be there from the beginning! You can't ask users to opt into it, because they're users and they don't know how any of this stuff works.

It's for this reason that Apple and Google control so much of Internet identity, and are going to continue doing so. Advocates of decentralized identity are poisoned by the experiences and preferences of a tiny but vocal sliver of users that (1) are deeply into this stuff and (2) do enough weird shit to occasionally get on Google or Apple's bad side and have bad/annoying experiences with account recovery. The problem is that these voices are not representative of the market, like, at all. Google does a better job of global Internet identity than any organization operating at any kind of scale. If you can't recognize why this might be true, and will be an enormous obstacle to adoption, you're not engaging seriously with identity.

The power that decentralized identity offers, normal people don't want. The things it takes away: necessities. It's a toy, not a killer app.

A while ago I worked on the 2FA access feature of a large online service.

The fun crypto-related and login-path stuff took maybe two weeks.

The remaining months were all about account recovery. It's really hard to do well, and unless you hire support staff it just won't work.

The problem with identity is summarized in the "why your anti-spam idea won't work checklist"[1] We still don't have a solution to identity that prevents generating large numbers of fake identities, doesn't cost each user money, and doesn't require a central authority.

Blockchain systems are a demo of this. A blockchain just needs some number of players who are independent and not colluding. That ought to be simple, right? The best ideas the blockchain crowd has come up with to do this work by making playing very expensive. (That's what both proof of work and proof of stake do.) Even that didn't really work, as mining has become very centralized. A solution to identity has not emerged from that crowd.

[1] https://trog.qgl.org/20081217/the-why-your-anti-spam-idea-wo...

You mention Google as a positive example, but they don't really have "a human-mediated process for restoring access". If you can't restore access with their recovery form, it seems the only option is to seek a court order, unless you have contacts at Google.

And I don't think it's just a matter of Google being cheap. If they had thousands of CSRs with the technical ability to reset passwords, I imagine we'd have a lot more cases of stolen accounts, using social engineering or bribery (as we see with SIM swaps).

The hard-landing process Google has is both human-mediated (which does not mean "you're hand-held through the process by a human being") and also iterated over time. Nobody had to figure out precisely what the account recovery process for Google was going to be a priori, because Google is a trusted third party and can adapt its recovery procedures as it needs to.

I completely agree with you, but I a small thought about public key authentication.

Today more and more people without a background in IT which got in the "Web3"/Crypto ecosystem get in touch with public key authentication mostly used with wallets like Metamask. It get's understandable and usable for the average user.

I don't see what that would get me that I wouldn't already have with Sign In With Apple, other than not being tied to Apple, which is one of the most important features of SIWA: if something goes wrong, there will be an ultra-annoying hard-landing customer service procedure that will, ultimately, restore access to my account.

I can turn this right back around on you.

> The power that decentralized identity offers, normal people don't want. The things it takes away: necessities. It's a toy, not a killer app.

Who are you to decide what “normal” people want, what a “necessity” is, what a “toy” is? And, moreover, are you sure account recovery is as important as you think it is? Maybe people would prefer to have accounts that have very little identity, that get thrown away without much care — you know, like how people use throwaways on here — than some One Absolute Source Of Recoverable Truth?

Humans have thrown things away forever. If anything, it is absolutely abnormal to want eternal persistence.

Also, the whole thing that public key identity has existed and “nobody wants” is utterly laughable when you look at the actual usage metrics on web3 wallets. If that entire industry does nothing else, the fact that it’s made 19 year old art students feel cool for knowing how to handle their public and private keys is enough innovation for one cycle.

Not sure why the crowd on HN is so irrationally religious about this issue. It’s not bike-shedding, but it’s definitely something similar.

> Who are you to decide what “normal” people want, what a “necessity” is, what a “toy” is? And, moreover, are you sure account recovery is as important as you think it is? Maybe people would prefer to have accounts that have very little identity, that get thrown away without much care — you know, like how people use throwaways on here — than some One Absolute Source Of Recoverable Truth?

The person being replied to literally suggested it as a single source of truth. For everything from HN to your bank account. So you’re tilting at the wrong windmill!

I think one thing the crypto fad has proven is that even experienced people can’t keep hold of their keys properly. You’re always one mistake from an irrecoverable situation.

Why would I want creds that once compromised not only were irrecoverable but also affected my entire life?

If you want easy, temporary identity then the current situation is pretty great.

> The person being replied to literally suggested it as a single source of truth. For everything from HN to your bank account. So you’re tilting at the wrong windmill!

The parent I replied to is competent enough to know that there is an easy way to have that “recoverable account” he is obsessed with: custodial wallets. You know, like the custodial accounts that are the defining feature of Web 2.0.

People who don’t understand the innovation of being able to choose between custodial and non-custodial, and how that’s a big deal that many appreciate beyond the opsec requirements, sort of expose their own weaknesses.

I can see that login via private key is cool for some people, and being able to login via a private key some other party maintains for you would work for "normal" users. But I could also implement that without bringing in a block chain, right? Wouldn't we expect that Google and the current authN providers just implement that if it ever became popular?

> But I could also implement that without bringing in a block chain, right?

Not only that, but they have! Signature-based authentication existed 20 years ago. Register with a public key. Sign a message with your private key to authenticate. Modulo some small details to prevent things like replay, you are done. The only thing that the blockchain brings is that now lots of people have asymmetric key pairs where their public keys are published somewhere widely accessible.

So the answer is web2!

I’m confused, you didn’t respond to the person’s argument. Way to go missing the forest for the trees. “Normal” is the >90% that hasn’t even heard of key signing and no amount of screaming at them will convince them to care.

No, you’re the one who is missing the point. An ever-growing number of highly engaged young people are using wallets and engaging in key signing without even thinking about it. And what those people do today, becomes the norm tomorrow.

I had meetings with newspaper executives in 2007 where I told them “everyone will get their news on Facebook soon.” They couldn’t understand what I meant, because they didn’t think “normal” people would ever use such things. A lot of comments on HN regarding web3 remind me of those conversations. This will all be so embarrassing in 10 years.

Facebook tells the opposite of the story you're trying to sell, of people flocking to a highly centralized space to get a single feed of news.

There are lots of things that highly-engaged young people have done that don't catch on in the long run. Given the problems that Web 3 has, I see it as a lot more likely that Web 3 will go the route of fidget spinners than the route of Google.

I think you could go even further and add that a lot of power users who you'd think would want decentralized identity don't want it either, for the same reasons you mention.

> open identity/auth solution

An open solution built around public key cryptography? This has been technically possible to do for two decades, in the form of PKI client certificates, but never got anywhere because the key management is the problem.

Decentralisation trades "lose your account because you got banned" for "lose your account because any device with your key on it got compromised or lost", and for many people that works out worse. It's certainly less convenient.

Identity provision is also a two-sided market. You need adoption from users and the companies they want to log into at the same time. That's why there's only a few providers that most companies bother to integrate with.

The two-sided market is the big deal here. Imagine that you are a bank or online market place. What are you going to do when one of your top customers shows up and says that they lost their account keys? Are you going to explain that losing your account is actually a great feature that your company offers.

In the case of my bank, I'd expect to walk into my local branch with my driver's license, passport, birth certificate, and any other official ID I have, and convince them that I am the same tzs who owns the account and have them set me up with new account keys.

What I wish is that there was some way to tie my other accounts, directly or indirectly, to my bank. My bank account is the most recoverable account I have, because they can handle me showing up in person with ID.

Other accounts just know me by my knowing the account password and/or being able to receive emails at the email address associated with the account. If either of those is compromised I can lose the account with no way to recover.

If there were some way I could have my bank verify my identity to my email provider, and tell my email provider that if account recovery is ever needed on my email account to re-verify with my bank that it is really me requesting the account recovery it would be much safer.

(If you are using an email address at a domain you own, then replace email provider with domain registrar).

Then no matter how badly I'm compromised (as long as it is not by someone with sufficient resources and interest to be able to get past an in-person identity check at my bank), I've always got a path to recovery.

Worst case, first recover the bank account in person. Then recover the email account using the bank account. Then recover compromised accounts that are using the email account for verification.

So what you are suggesting is that the bank has full root privileges to change credentials associated with an account. What is the point of having a decentralized database if the bank can change ownership of accounts as they see fit?

In-person account recovery is tough. A friend of mine runs a branch of a major bank. She regularly meets with customers who need to recover their account identity. A sizable fraction of the people who show up trying to do that are attempting something scammy.

If there were some way I could have my bank verify my identity to my email provider

Major banks can do their end of that. They will notarize documents and provide signature guarantees for established customers. Now, having obtained a notarized statement guaranteed by a major bank that you own your identity, how do you submit that to Gmail?

Banks don't really want to be in the authentication business anyway. It's an unprofitable sideline, and takes up a lot of staff time.

The bank still has a dependence on trusted authorities when it assumes your ID documents are legit. Rather than asking banks to confirm your identity for other accounts, I think we should ask governments to extend their practice of providing physical ID documents to providing online identification services. States have worked with Apple on "digital drivers licenses" that live on your phone, but the idea is still that you show them to someone in meatspace. Why shouldn't they provide an online service?

Of course, all this depends on the assumption that your ID should be who you are IRL, rather than the model where we can all make up several independent pseudonyms for different purposes.

Many European countries have government-provided online identification services.

Estonia's implementation is usually regarded as one of the best: https://github.com/open-eid

> The bank still has a dependence on trusted authorities when it assumes your ID documents are legit. Rather than asking banks to confirm your identity for other accounts, I think we should ask governments to extend their practice of providing physical ID documents to providing online identification services.

Sure, that would work too. Or even do both. The point is to have some place I can go in person to have my identity verified for a third party such as an email provider or domain registrar. Then set up the email or registrar accounts so that account recovery requires such a verification.

I wouldn't have to tie everything back to the in person verification. Just things that I want to be sure I can recover if I lose them via accident or hacking.

This is sort of what happens when you use OpenID with Google. The "break glass to recover account" flow at Google does literally involve photographs of government issued ids and other human process like that.

To be fair, this is the level of customer service that you get from Google in the first place. Banks are forced to do better.

>Google

I don't think that helps the Web3 argument. Google has made a choice, whereas crypto it is a technical limitation (or, to some, a feature). It also isn't a very good talking point to say "it's no worse than Google"

Crypto needs to develop a better balance between bad 2FA with loop holes on the traditional side and absolute loss on the crypto side before a lot of people would feel comfortable with it. Maybe that should be one of its target killer apps.

It’s not a technical limitation any more than it is for Google. You can easily create software where a chosen third party (or some 2/3 parties scheme) can recover your account.

That's good to know. It is a hindrance to Web3 adoption that such mechanisms aren't in place: It would certainly prevent me from relying on a service.

But what would a 3rd party or 2/3 party consensus use that would differ from current mechanisms?

There would also need to be some care taken to make sure that such 3rd parties don't become centralized choke points themselves: They would be somewhat essential, so any service(s) that did this could rise to dominance either as a monopoly or a cartel.

These mechanisms definitely aren't something built into the chain any more than they are built into HTTP or x86, but these chains are semi turing-complete so the software can be written (existing multi-sig ETH wallets are an example).

Let's say I control some funds and want you to have access to recover the funds if I lose my master key. I transfer these funds to a smart contract that allows my Ethereum key full control to move things around, and allows your Ethereum key access to give control to a new key if I lose mine (probably with a x-day delay, so I have time to revoke your access if you go rogue!).

For a 2/3 system, it's basically the same except 2 out of 3 of the other people need to "vote" on chain, and only then can my key be reset.

There wouldn't need to be a centralized party who resets the keys. Social solutions where you give trusted friend(s) limited reset access, probably with a time lock like I mentioned, are extremely promising IMO.

Thanks for the further explanation-- I fully understand that such things aren't baked into the current infrastructure-- which also creates problems (for example a cell service provider resetting a password over SMS through their own supposedly 2FA system). L

The smart contract you describe is sort of what I meant by service providers emerging for this sort of thing: The average user will not feel comfortable rolling their own such contract. It either needs to be dead easy, or there will emerge services that do this for you and oversee their execution. I could be wrong about that... Much of what Web3 will look like is speculation. But if those sorts of services emerge and become market dominators, they would have a lot of control-- contracts that allow termination (deplatforming). As contracts become more complex to avoid edge cases we see being exploited right now, it may become even harder to understand all implications, loopholes, exploits, etc.

The above may be a solvable problem: Develop tools to parse smart contracts. A specialized class of automated testing tools for smart contracts.

In the scheme I described there would be no central authority with special power over the "recoverable account" smart contract. Each user would deploy their own fully independent instance and choose who can help them recover the account. Contracts are immutable so the person writing / distributing the code wouldn't have any extra powers the way Google and Facebook do.

Obviously this hinges on the contract not being backdoored by its creator to begin with, but collections of free, open source, audited smart contracts for stuff like this already exists. A user would likely use some app / tool to deploy their instance, once deployed it's really simple to verify the deployed code matches the verified open source version.

Banks, at least in my country, can choose to accept incoming or outgoing financial transactions. Worse, governments have the rights to seize your assets, close your bank accounts, etc. Not sure any of that is better. I'd rather have Google shut my account down with no recourse.

It's all shitty and it's all infuriating.

Right so this is where smart contracts come into play. There are crypto wallets that are based on smart contracts which encode logic that allow people to "recover" their wallets if they lose their key by having some N of a selected group of trusted friends sign off on switching it to a new key.

That is why this was impractical before: we didn't have a neutral/decentralized layer to remediate practical issues like this.

Smart contracts are something that can never work, because it is predicated on our ability to write correct code. Empirically, we know that is not going to happen, which means you need some sort of disaster recovery mechanism, which will end up being some centralised entity that has a sufficient level of permissions to override the contracts, thereby losing the primary selling point. Or you try to solve this with even more technological complexity, but that will only increase the fragility of the entire system and will paradoxically end up having the opposite effect of what is intended.

> Smart contracts are something that can never work, because it is predicated on our ability to write correct code.

Laws are of similarly bad quality (in my opinion of even much worse quality than software), we just have at least centuries more experience how to deal with crappy laws than with crappy software.

This is a bananas statement, there is literally billions of $ transacted safely and successfully on smart contracts every day.

Gnosis Safes (a multi-sig smart contract wallet) secure $96b in assets today and hasn't had a single security incident.

Does that really justify an entire blockchain infrastructure? This is possibly a hot take, but I can’t help but feel like key recovery as you describe could be implemented on its own, e.g. like horcrux[0]

0: https://github.com/corvus-ch/horcrux

Yes, because otherwise you are still trusting a centralized third party, which has incentives to lock you in to an ecosystem =/

Huh? What part of something like a horcrux relies on a centralized third party?

Oh well for this specific scheme, an MPC, it offers less flexibility. What if I want to remove one of my friends from my trusted guardians? What if I want to swap one out?

You can also design other schemes, like a time-lock one that says if none of the guardians are reachable (say they all lost their keys too, bad luck), you can recover it with some other secret key as long as none of the guardians reject it in 90 days, or something like that.

There are groups trying MPCs for this, but I think smart contract wallets will be far superior in user experience in the long run. You can even put in like bank-level protections, completely decentralized. For example, you could impose a daily spending limit, so even if you were compromised, you didn't lose everything and had time to lock the wallet. You could also restrict transactions to a set of whitelisted contracts, a list possibly maintained by a DAO. The possibilities are endless, it's turing complete code!

Sybil attack as a service: SaaS 3.0

Web3 people need to talk about this more instead of all the FOMO scam bullshit they currently hype and which is tainting every reasonable human being against their ideas.

Because right now, given how long the community has had to work on the problem and we still haven't seen anything like what you're describing, I'm still inclined to believe that Web3 is all a bunch of bullshit.

> Because right now, given how long the community has had to work on the problem and we still haven't seen anything like what you're describing, I'm still inclined to believe that Web3 is all a bunch of bullshit.

That's because based on everything that's been demonstrated by 'web3' is essentially useless. And this post you're responding to is a well.

They claim the benefit of web3 is you'll be able to have 'privacy' by controlling you identity and transaction history and choosing what to share by using blockchain.

Prevent a large company from having all your info. By putting it in a blockchain? So now instead of one, every large company has your info! You aren't gaining privacy by putting your private info in a public distributed db!

And just like almost everything I see posted about web3 a few mins of thought by any serious engineer shows this again is all hype that can't be backed up by the tech. And just like web3 in general, in this HN thread you see people caught up in the hype and missing the obvious core flaw with the very premise.

This is the problem with web3, the main product it successfully produces is hype.

I do. I run a podcast (https://anchor.fm/ultraio/episodes/EP8-Ultras-case-for-NFTs-...) and this is my primary concern: educating people about the real benefits of the technology. There's a lot of baseless hype and a lot of scammy bullshit. There is also a lot of real-world benefits that simply have not been leveraged to their fullest potential.

Love to hear some of the alluded to "real world benefits" - I have heard none so far, just claims of things an experienced engineer can invalidate with a few minutes of work.

"A few minutes of work" is entirely disingenuous and misrepresents the problem at hand.

"Blockchains" are not just distributed databases. They are also distributed, open APIs, and consensus mechanisms for updating and managing the functionality that controls those APIs and the data that they produce.

I think about it this way: if you have one company that creates a database that many people use to build businesses around, then that company now holds a lot of power over the people who chose to build there. I believe that those people should have a say in the direction of the APIs that input/retrieve data, and ultimately should have some say in how long that database persists. The idea that we allow single entities to permanently control datasets seems absurd to me.

Now, from an engineering management perspective, think about how you manage multiple teams who have different agendas, different priorities, and different needs for those APIs and the child data. How do you govern that? How do you ensure that all nodes that replicate this data set and the APIs are up to date and not doing funny business?

This is all stuff that the decentralized community (web3) is trying to figure out together. It's DEEPLY interesting and ABSOLUTELY not "a few minutes work".

Could you elaborate more on how a blockchain will allow clients to influence the direction of the API and also keep other clients up to date on new API changes? That seems a lot more complex than the way you're putting it.

It varies a lot from network to network. You're right: it is very, very complex.

Politics and governance are topics that are, I think, a bit broad for a post in a reply on HN.

Suffice it to say that groups of dedicated people, either as loose alliances or as tightly controlled development teams, come together and make proposals for change, implement those proposals, and then push them to a network. If the network as a whole thinks it is in their interests to use it, it gets voted on and enabled. Sometimes this works, sometimes it doesn't. Mostly it is entirely transparent to users. Rarely it causes a fork in a network (basically a civil war) where infrastructure providers decided to part ways and go on to support two child networks instead of one.

It's messy, as all democracies are. I think it is a beautiful process, and it has taught me a lot of valuable lessons about how groups really work, what politics really is, and how to convince people who do not want to be convinced because you believe in something fiercely.

Open networks take a lot of the best parts of FOSS and bring them to life in a way that I never thought I'd experience so intensely.

>The idea that we use our email accounts, attached to huge corporations which siphon every detail about us for their advertising engines is absolutely absurd. I just want to be able to log in to applications and carry some of the simple data like my identity and what assets I have available with me, without having to pay for it by losing my privacy and autonomy.

Okay but instead of it being known to just say one company, anything on the block chain is known to everyone. I fail to see how that's any better or even remotely "powerful".

> Okay but instead of it being known to just say one company, anything on the block chain is known to everyone.

Bitcoin != blockchain. Technology exists [1] to store data on the blockchain in a private manner without sacrificing its decentralized nature.

[1]: https://www.getmonero.org/resources/moneropedia/ringCT.html

But if you encrypt it so nobody else can read it then the big bad companies of evil will still need to collect your data individually - which brings us back to the initial point, but now with a blockchain for some reason

Companies are going to collect our data as long as they are able to use that data as an income stream.

I don’t have a Facebook account but I know they have data on me.

Yeah, and even if they can't sell collected data because we all agreed to just put them on a blockchain aggregates and whatnot will still be valuable assets. This isn't an issue that can be solved by technology. It will need regulation/laws and I don't see that happening.

But it’s different! Because blockchain!! /s

How does it feel knowing that you've signed up to 100 applications, which you use for everything from work to pleasure, and that that authenticating account can be taken from you at the whim of a company? Feels bad to me, man.

That doesn't address their concern, really. Threat models are personalized to everyone, and for a _lot_ of people, they choose Google/Apple/Microsoft and are fine with that company knowing their 3p logins - but wouldn't be fine with anyone being able to plug in their crypto address and see all the services they've connected with.

Although, i'm sure a blockchain identity service could be properly architected to keep connections secret - i'm eager to see if that ever comes to fruition.

To me, it seems the solution here is not to centralize into one identity for everything but the opposite: to distribute each account into its own identity. Software can then manage each disparate identity to ease the burden for the account owner.

That is a valid concern. But in practice most of the sites which allow federated authentication support multiple providers, typically Google, Facebook, and Apple. I expect one of those will eventually ban me for wrongthink, but probably not all of them simultaneously.

Couldn't someone just steal your token and you lose access to 100 applications?

No. It's not a token. It's an on-chain account verified by multiple permissions that are controlled by key pairs. It's based on EOSIO technology and is pretty robust.

How do you recover your account when you lose your keys?

Check out Vitaliks post on social recovery wallets https://vitalik.ca/general/2021/01/11/recovery.html

You can’t.

On the other hand, a company providing the service can ban users for spreading harmful information. Imagine a situation where, say, the president of the US was spreading misinformation regarding a pandemic for example. To me it sounds good that there is some control to it.

I think this touches on the heart of such issues. Many people see a big difference between censorship and an obligation to follow certain rules. Others seem to view any rules as a defacto form of censorship. I don't think these positions can be fully reconciled with each other.

There is no such thing as harmful information. Only actions can cause harm.

Do you think we should trust unaccountable corporate managers more than elected leaders to determine what is misinformation?

>only actions can cause harm

Disseminating information is an action. Also misinformation does not always contain information: Many times it's just a more polite way of calling something a lie, or simply wrong. Even when there is information, cherry picking which information to share can give the opposite impression of what more robust information would show.

The question of who to trust is a good one. The issue I have with the viewpoint that platforms shouldn't be allowed to make these decisions for their own platforms is that it takes away property rights by having the government mandate what can or cannot be done with privately owned property. Should people have the right to decide what people can do on their privately owned property? Businesses are allowed to make all kinds of rules about this, from dress codes to what they consider disruptive conduct. Limiting that ability seems problematic to me.

I don't have anything that I would consider a solution to finding the right answers or balance here, but I don't think we can ignore these issues.

> There is no such thing as harmful information. Only actions can cause harm.

Perhaps in some idealistic model of society this is true. However, in reality people cannot process and evaluate the factual basis of all information that is pushed on them. Otherwise we would not be seeing so wide-spread misinformation campaigning, fake news and conspiracy theories. Harmful information tends to transform into harmful actions (harmful here being subjective - there's often someone benefiting as well).

I don't have a clear-cut answer who should be determining what is misinformation. Also, I don't believe one bit that a free-for-all model is a good one, quite the opposite. Currently it seems that when someone clearly crosses the line, public opinion or perception forces the company to reconsider allowing the violator to remain on their platform. It might not be the most elegant model, but possibly the best we have.

OpenID let you have custom auth that you controlled. Basically no one supported it, and basically no one used it.

What would make the "web3" version different?

The honest answer here is because valuable assets are attached to that account. Money makes a big difference in what a company is incentivized to integrate and what they are not.

OpenId is awesome, and is awesome FOR USERS. It's just not awesome for companies. They have zero incentive to integrate it.

That seems very hopeful to me. You can attach certificates of ownership that mean nothing inherently and no one has any incentive to respect. I see no evidence of anyone finding a good use for NFTs right now, and all the suggestions I've heard have been hand-wavey and/or obviously deeply flawed.

A bunch of speculators aren't going to drive actual adoption.

To be clear: I used OpenID and I loved what it offered me, but I don't buy that "web3" fixes the problems that caused its death, or offers anything more than it did.

I'm not sure it was awesome for users. I remember finding it confusing.

Unfortunately you acquire users by building what they actually want, not what they should want.

This is not incompatible with what the parent comment is talking about.

People want easy / seamless access to the services they use. If Web3 can find a way to provide that or improve upon the current hellscape of email based logins mixed with federated social logins mixed with the pain of maintaining 100 different accounts, it might just find a place.

But the people working on this need to focus on the user’s end goals and UX needs, and not just declare the problem solved once a solution is technically working.

> People want easy / seamless access to the services they use.

Free. People want it for free. Not free as in speech, but free as in beer.

History has shown that the vast majority of people will trade their entire personal data set if they can get fake internet points for free.

Sure, people want things for free, but that is orthogonal to the simplicity angle. Something can be free, but won’t see use if it sucks badly.

People spend $$$ on Apple products because of the “just works” reputation. I’m not saying people want to pay for services, but I think it’s important to distinguish UX vs. cost when examining what motivates people.

ABSOLUTELY.

Accounts and transactions are free on our network. We think eventually all networks will have to go this route. Paying per-transaction is mind-bogglingly anti-user.

This is true and wise.

> The idea that we use our email accounts, attached to huge corporations which siphon every detail about us for their advertising engines is absolutely absurd.

Is it, though? It’s just a trade off people make to get a free service. If I want my email to be free of advertising scanning by large corporate entities I can just pay for Protonmail or something.

This is what I feel like I see with web3 time and time again: it’s a complicated technological solution looking for a problem when (for the vast majority of people) that problem is already solvable without the complexity.

Honestly, I think the tech and infrastructure is simpler than what is currently deployed at google.

I strongly agree. Email is already a federated system that lets you own your own data. It turns out everyone would rather have convenience and that’s completely understandable.

Wouldn't that be just as bad (if not worse) than the current situation? Those huge corporations could just read everything from the blockchain. At least in the current situation companies need to provide some sort of service to get to your data.

I'm curious because I'd bet you're right that such a thing would be adopted really quickly if it were user-friendly but my biggest question is whether everybody would be limited to a single identity or if you'd allow multiples. If you allow multiples, would 'identities' be free? If so, I'd be concerned that the same thing would happen to your company and product that happened to Web 1.0: In THEORY we'll all have control over our own data, but in actuality, running software takes time, expertise, and money, so aren't we all (meaning the general public/average person) going to have a choose an intermediary anyway? And you think it should be your company. (Which maybe it should, idk).

I'd also be a bit concerned about:

- Ability to spin up alts and anonymous pseuds is a key component to Internet use, for me. One great thing about email is how easy it is to get an email address; I don't need a credit card, address, ID, etc. I don't need to use a real name. And so on. This is one of the things that makes the Web so powerful a force for the marginalized. For instance, I had an email address when I was 6. That's illegal now, but 13 year olds can have them. Or say you're a lady in Afghanistan.

- This information persisting over time and being unalterable might result in some very uncomfortable social situations if people keep the same credentials for decades.

None of this is a reason not to do such a thing, and I think it's a good idea and one I'd actually use in a heartbeat, I'm just not under any illusions I'd be doing much other than switching my 'alliance' away from an email service provider.

Leaving aside the discussions around PKI and necessary centralization in public/private key authentication I've seen this web3 debate a couple of times now.

It starts with "web3 is the second (third?) coming of the internet and will revolutionize everything".

If you ask for proof or use cases the very first comment is: "You can log into Twitter using a public/private key pair"

These are two very different statements. So even if you assume there is advantage in public/private key auth it is still nowhere close to an internet revolution.

Imagine the PostgreSQL team had praised the JSON data type as the revolution of the internet and disruption of all industries as we know it. It's a useful feature and it is used by a lot of companies but it has zero impact on everyday people. And Bloomberg and the Wall Street Journal are certainly not writing about it.

Legitimate companies are unlikely to rely on decentralized identity unless required to by law. Apple/Google federated login? Absolutely, they have the power to dictate it (Sign In With Apple). Login.gov and ID.me? Absolutely, they’re trusted government and private sector identity proofing providers. But trusting the identity of your users to a distributed ledger or computation fabric? I just don’t see it happening, and it’ll likely go the way for Mozilla’s federated identity provider.

You are seeking a technical fix for a regulatory issue (data sovereignty and portability & digital privacy).

(I work in digital identity and interface with decision makers)

Honest question: can that happen without users having to purchase ETH (or whatever the underlying token is)? My very limited understanding is that web3 is inherently tied to cryptocurrency and the miners have to be paid somehow.

The open network that we built has free accounts, free transactions, no resource staking requirements, etc. Gas on Ethereum is absolutely a problem and absolutely does not scale.

We do not have mining (proof of stake), and have been certified carbon neutral (https://medium.com/ultra-io/ultras-blockchain-is-carbonneutr...)

> With this in mind, we chose to assign seven designated Block Producers for Ultra’s blockchain.

This does not sound truly distributed. Like you might as well not use Blockchain if it's not distributed.

Decentralization is really a spectrum. We have a set of block producers that we've vetted and have worked closely with to set up the infrastructure for our network. They are external companies (Ubisoft is one of them). The code that runs on the network gets vetted by them and only goes into production after they sign a multisig and allow it.

It's not thousands of anonymous nodes, but it is also not a single entity that controls everything.

We intend to build out a more decentralized pattern with more complex governance as things mature. It's a software project and as you all well know, you can't launch your ideal at the start. You launch what you can and you improve as you go. Decentralization is that way, too.

Git uses a kind of blockchain and is often centralized rather than distributed.

Pedantic but fine. I'll revise to "why use a trustless distributed ledger if you are going to only allow 7 validators. Might as well just use MySQL with an API.".

Thats the fun part, you don't have to purchase any cryptocurrency. All you need is a crypto wallet and you have a public/private key pair.

Crypto only empowers this by encouraging people to maintain their keys with a serious financial incentive.

That doesn't solve anything. People will still lose their keys. What is the key recovery strategy?

Check out Vitaliks post on the topic :

https://vitalik.ca/general/2021/01/11/recovery.html

This is a cool insight.

In newer systems, users don't have to buy any tokens because VCs pay the transaction fees and they pay you to use the system.

But this can't last forever no?

Of course.

Reminded me of this Jaron Lanier quote from "Sway" podcast:

"I believe Facebook is undervalued for what it does. Because Facebook is essentially running identity for the internet, which is a very valuable function. So under a data dignity regime, I think Facebook would double or triple in value very quickly."

I do think that digital identity is going to be an existential(pun intended) question. Ideally it would be managed by a competent government agency. That's likely in many countries. I doubt that it'll be the case in the USA.

> The idea that we use our email accounts, attached to huge corporations which siphon every detail about us for their advertising engines is absolutely absurd.

That's what the companies want, though. Facebook and Twitter don't trust me because I have an email address, they trust me because I have a _Google_ email address.

Having a Gmail account means that Google trusts you. Google only trusts you if you provide a reputable phone number.

If you host your own email, you can't do anything because nobody trusts you.

Changing the protocol from email to crypto won't fix that. I either have to be reputable ("Yes I'm wealthy, Google trusts me, I have a phone number which means I have a bank account, which means I'm a legal citizen with a government ID, and this is my legal name") or I can't get in. Standing up my own throw-away identity will be as useless tomorrow as a Mailinator address is today.

For you and me, email auth is a dark pattern. For the companies, it's a feature. It keeps out freeloaders, spammers, and criminals.

> If you host your own email, you can't do anything because nobody trusts you.

Where can you not signup with your own hosted email? I can't think of any service. Twitter, bank, saas apps, just care that you have an email.

>> I think the killer app for web3 is going to be a decentralized, open identity/auth solution.

How would account recovery / password reset work in a web3-based system?

With Google, Apple, etc. there is a party that one can go to for account recovery.

How would it work for web3 if it is decentralized?

This is a really big problem that we spent a long time solving. The fact that if you lose your private key you lose your account and its associated identity and assets is a big deal.

We have a recovery mechanism that allows you to set and manage secondary authenticators which are used as witnesses in the case of loss of access to your primary account. Another working group that I'm involved in is trying to solve this problem in a tangentially similar way using multi-signatures. It's an interesting approach.

So what’s stopping my friends from stealing all of my money behind my back?

You're worried that a bunch of your most trusted friends, who you can even choose a subset of such that they don't know each other and have no connection other than you, will conspire to betray you in a provable way? Isn't that strictly less risk than giving a spare house key to a trusted friend or neighbor, which people do all the time?

There are multisig social recovery wallets where one party or a group of parties is trusted to help you get regain access to the account with a new signing key. Gnosis lets you do this with arbitrary friends of your choosing. Or if you're like most crypto folks and have no friends, something like Argent can handle this for you with email/phone number authentication after a delay (a few days).

So what’s stopping my friends from stealing all of my money behind my back?

Social recovery with friends usually needs something like 3 of 5 or more to effectuate a recovery. So your friends would have to effectively collude with each other without any of them tipping you off about the plan.

Can’t à shared signed key algo be used ? Ala Shamir Shared secret algorithm?

If 2 out of the 5 keys ( or whatever value ) are present you can log in.

> The idea that we use our email accounts, attached to huge corporations which siphon every detail about us for their advertising engines is absolutely absurd. I just want to be able to log in to applications and carry some of the simple data like my identity and what assets I have available with me, without having to pay for it by losing my privacy and autonomy. > > Nothing in the web2 tech stack currently allows this.

Anyone who wants to can get their own email address which doesn't require giving data to advertisers. You can run your own domain or use an email service which isn't run as a loss-leader for advertisers, and you can use services like the one Apple built into iOS if you want to prevent the sites you visit from having a common identifier. The cryptocurrency services will need a variation of that same solution since using one wallet for everything is bad for privacy but the average person has limited interest or ability to reliably juggle many wallets.

What's more interesting is to consider is why many people chose a single email provider when it started as a service which is at least as decentralized as any cryptocurrency. That includes the extremely important account recovery problems tptacek mentioned, spam, but also simply things like the different values most people have for security and operations. Cryptocurrencies are theoretically decentralized but in practice most of the people involved seem to use a handful of exchanges and ostensibly decentralized services often depend on one or two companies, and that tends to come down to the same answer: most people don't want to run servers or be one mistake away from losing everything, and would prefer that work be someone else's job.

The other problem we have is how much people are willing to pay. Fastmail, iCloud, etc. are not expensive but a LOT of people have reliably voted with their feet and there seems to be only a small number of people who mind ads enough to pay for alternatives. I don't see web3 as SSO going anywhere until there's a lot more value to be shown from buying in — that upfront non-trivial payment requirement for something which just allows you to access other services you presumably would also have to pay for seems like a tough sell as a mainstream movement.

I like this as well, but have zero faith in the wider public caring enough for that become the killer app. Most people do not care at all about Google/FB/Amazon owning their identity. It's sad, but true.

Sad, but true indeed. My hope is that there is a large enough minority that does care that will push for it's gradual integration and acceptance.

> Nothing in the web2 tech stack currently allows this.

Seriously? It takes five seconds online to find projects like https://solidproject.org (backed by people like Tim Berners-Lee) that don’t need blockchain and present strong arguments to address the kind of issues you raise.

But it’s an open specification for the web. How lame and very NOT crypto $$$diamond_hands$$$.

The most impressive thing about blockchain is its capacity to create zealots for the One True Way, all others be damned.

Also building on web3. I agree about authorization (permissions) but not about identity/authentication.

We do not need people to have to disclose their identities in order to use a service. We already have an authentication mechanism on every blockchain - the notion of an address/account. What we need is a decentralized way to associate permissions with those accounts.

This is something that must happen more by social consensus - projects adopting a standard. The technology already exists.

> Imagine being able to log in, securely, to HN, Twitter, your bank, et al., and with you comes basic data about how to contact you, how you pay, what assets you're holding, etc. You get to choose what you share, and you get to authenticate each transaction discretely. It's powerful and it puts that power in your hands, not in those of large corporate entities.

That sounds interesting! How could I learn more about that?

> that's what I work on

What's your company?

Yeah... How do I get to choose what I share? How would it work for HN or Twitter? Do they have to support this? Where should they start to be able to support this? Again, how am I going to choose what I share? Who exactly has to implement it? I really need some details.

If we actually have to rely on Twitter implementing something like this, then I do not have high hopes, as they most likely would not want to implement something like this. :)

Basically, we have an oauth-like mechanism that sites can integrate. The user gets to control, from their side, what data they whitelist and share. Whatever they don't, they don't get to have access to.

You're right, though: this is a steep hill to climb.

Ultra.io is the company.

I'm a bit confused by why this is in the "crypto" space. I thought the whole point of the "crypto" space was to prevent double spend. If you don't need to do that then a distributed/federated database seems sufficient. Are you planning to allow users to give/sell their accounts to others? If not then why are you using a "crypto" platform?

Because you get into the issue of who gets the right to modify what part of the database, and encrypted blockchain is supposedly a solution ?

Signature-based authentication has existed for decades. All that has changed now is that your public key is now a "wallet." If blockchain based authentication becomes the norm, it will be entirely because there is now an unrelated reason for people to create, publish, and store an asymmetric key pair.

This has been proposed as decentralized identifiers before actually: https://www.w3.org/TR/did-core/

Email is already decentralized. I pay for Fastmail with my own domain because I don't want Microsoft or Google to own my primary online identity.

> I work in the web3 (crypto) space

> Maybe it is all a giant scam

Normally you'd expect people who work on something supposedly worth billions to be able to say with a degree of confidence that it's not a giant scam.

Combine it with a decentralized/uncensorable web3 version of Twitter/Facebook and it also has the potential to become a killer app.

I don't think I agree that this is a killer app.

Virtually no one wants the consequences of a fully unmoderated (aka uncensored) social network.

Either there is are strong filter/segmentation capabilities (like "the algorithm" on current plattforms and different plattforms for different audiences) or anybody but the most radical / loud users leave sooner rather than later.

Most users also have any of their content removed.

So I don't see many advantages over the present state.

Disclaimer: I don’t own any crypto, even though I can tell it’s the future because I don’t know which ones will win.

Web3s “killer app” is government services.

Crypto in general is a pseudonym for open source rewrites of developed countries’ legacy government infrastructure for developing countries.

Eventually it’ll be so good it’ll replace the legacy variants that exist today.

Why can't we just pass legislation requiring government software to be open source and government databases to be open access? This is already the case in several jurisdictions.

I currently work for a local government, and pretty much everything in our databases (apart from SSNs and certain HIPAA-protected data in the health department's database) can be freely accessed via an FOIA request. Some legislation requiring that these DBs (or a live copy) be directly accessible by the public would be relatively easy and inexpensive to implement.

What advantages would there be by doing this via crypto/blockchain/whatever?

As it’s been explained to me the biggest benefit is for countries that don’t yet have this infrastructure built.

For countries that do have this built, it’s been explained to me as a cost savings compared with hiring a government contractor to maintain or improve the service. Especially in the context of InfoSec. Not only do these legacy services need to keep being updated because of potential zero-days but also even the expensive contractors (even mega-cap corporations) fuck up InfoSec “relatively” regularly and the cheaper government contractors are only going to be worse on average.

Having the worlds best minds build and test the InfoSec of different crypto solutions seems like it will just be the cheapest option in the long run.

> Web3s “killer app” is government services.

I don't understand. Can you give an example?

A government is already a central entity. If you have some service controlled by a central entity, why not build it in the standard database-on-a-server approach which is much easier?

For example, when buying a house you need to transfer the title into your name. The title is stored as a public ledger that can currently be requested by anyone. There is also other public metadata about houses that are public like the purchased price.

This is a very good example of a government service that will be disrupted by blockchain. The US, Canada, UK versions are relatively good today. However, maybe El Salvador[0] needs a better way to manage its titles and hiring a software consultanting firm to build that would be “too expensive” (not including the variability in the final product - i.e. it could cost a lot and still suck) for it to be worthwhile.

Even for the service in the US there are still middlemen needed and it’s relatively clear that security is not a strong suit of corporate America let alone the revolving door of government contractors. In the long run it’s just cheaper to use the open source blockchain code built with first class security in mind. The standardized and public interface of a blockchain also lets other companies extend the services without the extra red tape, e.g. it would be nice to get notifications of my neighborhood housing getting sold, etc. But this is really a bonus and up in the air, the killer app is really for developing countries.

[0] not to pick on El Salvador I don’t know the quality of their services. I’m only using them because of the BitCoin stuff.

Because whoever controls that database can change the data in it.

This was the crypto pitch for several years except it was for supply chain. "You can't hack the database!!" that didn't work out either because it doesn't stop someone from putting incorrect data into a database regardless of how easy it is to hack the database.

Same thing here. There is nothing to stop the government employee from putting incorrect data in the database.

This is why people see Crypto/Web3 as a solution looking for a problem. The complaint people have about the DMV isn't that their database gets hacked. The complaint is that the government workers do not care about doing a good or quick job.

So maybe rather than investing in the hope of some technologically-provided immutability, you just use the historical method(s) of (a) applying significant criminal charges to changing the data (b) structures and processes to audit data transformation.

Blockchain seems like a very costly way to add transparency and auditing. Especially if the chain will be controlled by one or only a few stakeholders.

I hope that you are right. Using open networks for transparent governance is the right way to go for democracies.

The Web3 killer app is here and everyone pretends it is not here. That killer app is Gambling, Speculation, and Hope of No-Work Instant Wealth. Until this killer app is tamed, it will overwhelm the web3 movement until it dies the death of a failed gambler.

After working on a decentralized side project the only projection I can promise you is that nothing you imagine is correct until you are heavily using decentralization.

Decentralization enables basic necessities that would you never before attempt, which means you are likely already engaging with killer ideas and dismissing them outright. That which is current boring and/or common can suddenly become sexy and powerful in ways that are unexpected or unplanned.

It also means that which you imagine as being the next hot thing most likely isn’t. The more time you spend working with decentralization the more true this becomes.

Think of decentralization as a steroid. It makes you (your technology) more of what you already are, an amplifier, not something new. New things will ride on the success of a successful application.

The challenge there is if an application is actually fully decentralized how will you determine success.

What I remember is different. People bought a PC to play games. And they connected to internet to download porn.

That might be the reason that you, a private individual, bought a PC. But there had to be enough PC's out there already to make it worthwhile making games for that market. That bulk market was created by spreadsheets.

And same for pron - there had to be enough people connecting to the internet to make it worthwhile making the pron available. That bulk market was created by email.

I'd agree that pron was a major early adopter for the web - the experience of piecing together pictures of naked ladies from hundreds of usenet posts was decidedly lacking.

> And the reason we all got internet connections in the mid-90's wasn't Web0. It was email. Web0 was a toy thing that only us geeks played around with, that came free with your email account.

Your comment about spreadsheets matches my experience but this does not unless “mid 90s” really means “1995 at the very latest”. I was seeing a ton of interest in web projects by then from normal companies who wanted to replace catalog ordering, put product and support information online, etc. – and normal people were starting to use it for all kinds of non-web things by then.

I strongly agree with your main point: I’ve never heard someone ask about cryptocurrency or NFTs except in that they heard someone on CNBC saying the prices were booming & were wondering whether it was a good bet.

It’s true that a killer app is probably necessary, but isn’t that what Web3 developers are currently trying to develop? It’s kinda weird to say “there’s no point in developing Web3 because there’s no killer app for Web3.”

I didn't say there was no point developing it. I said that the author missed the point of why PC's (and the internet) were adopted.

There's been hundreds of technologies developed because they were interesting to the developer, and then failed to find a market (or found a niche market and stayed there). Web3 currently looks to be one of those.

But who knows? If a killer app emerges, a reason for the average person to use it, then it'll succeed. Trying to predict this in advance is notoriously difficult.

Right, it's only been 10 years after all!

I agree: There is no killer-app from the perspective of a first-world citizen.

For low-wage workers in developing countries the killer app is play2earn gaming.

Admittedly I’m not very well read on the whole play2earn. However, I think the article posted on hn the other day about it makes a pretty compelling argument that it’s a Ponzi scheme.

Article: https://paulbutler.org/2021/play-to-earn-and-bullshit-jobs/

Strongly agree :)

Play2earn gaming is just a disguised ponzi scheme 99% of the time.

It's a closed loop system so the only way for people to earn money is to get it from other gamers. And gamers aren't going to throw money at these games when they could play a better "centralized" alternative.

And the reason why non-pay2earn alternatives will always be better is because non-pay2earn games are much cheaper because they only need to pay the game devs while pay2earn games need to pay both the game devs and the freeloading "earners".

I always like to imagine how we will look back onto subjects 5 years from now, which helps to come up with more precise terminology and potential perspectives:

"Generation 1 of play2earn gaming popularized in 2021/2022 was based on an ongoing influx of capital and generated profits only in the form of its redistribution. This changed when ... "

>> For low-wage workers in developing countries the killer app is play2earn gaming.

Farming resources in MMORPGs was happening before cryptocurrency became popular:

https://en.wikipedia.org/wiki/Gold_farming

The killer app is illegal markets, malware / ransomware payments, and money laundering.

> play2earn gaming

Where does the real economic benefit come from in this? "Paying people to play games" cannot possibly scale beyond the existing gold-farming niche. It's also something that historically games have tended to ban.

You asked for the econ perspective, so prepare for some darkness: When judging the economic productivity of the lowest class of wage workers the usual expectation is negative. Violent crime and substance abuse leads to a huge cost in terms of medical care and law enforcement.

If you have a way to keep them busy and earn esteem without hurting anybody, that's a huge economic benefit.

The killer app sounds like a dystopian hell to me, wow work that is the epitome of pointlessness.

Why does play2earn require (or is made much easier by) crypto? I'm missing a step in the logic

I'm not an expert on it, but I think this refers to the various "things" that can be bought/owned on various metaverse type environments. People from first world countries are able to buy these things since it's easier than "earning" them. People from developing countries can then do the earning part for them, and sell what they've got on various NFT marketplaces, for desperately needed money.

Why crypto is needed is because that is the tech that makes it possible for Player A to actually own Thing X, when Player A sends money to Player B who actually spent 8 hours playing or doing in order to earn Thing X.

There are a few of these examples starting to gain steam like Axie Infinity[1] for instance. Although I suspect FB & Roblox are going to really go all in on this soon, if they haven't already. And their user bases are enormous.

[1] https://axieinfinity.com/ (click on their marketplace link to see for yourself, the prices are crazy)

Oh, Axie Infinity. They're a Ponzi scheme in the crash phase. Their players grind to earn Smooth Love Potion tokens. Here's the chart for SLP.[1] Down over 90% and still crashing. There's also an Axie Infinity token.[2] It's only down 34%. There's some kind of 65-month (!) vesting period with that token.

Don't hold Axie Infinity up as a success.

No, Roblox is not getting into NFTs. They're planning on having no-copy transferable items within their own ecosystem. Second Life has had those for years. They're a minor portion of the object market, especially since SL got rid of gachas ("loot boxes") for regulatory reasons.

The main use of NFTs that makes any kind of sense is monetizing popularity. It's a new form of celebrity merch. This is great if you're a celebrity, but not otherwise.

[1] https://coinmarketcap.com/currencies/smooth-love-potion/

[2] https://coinmarketcap.com/currencies/axie-infinity/

>Don't hold Axie Infinity up as a success.

It's pumped millions of dollars into poor areas in developing countries. I think they would consider that a success. Remember, they're not investing in these NFT's, they're utilizing them to extract wealth from collectors/investors in the west. So for them, yes it's been a resounding success.

>No, Roblox is not getting into NFTs.

Not only will they get into NFT's, when they do they will have the largest marketplace. I don't own RBLX, or any NFT's, but the writing is on the wall. The Metaverse(s) are just getting going.

It's pumped millions of dollars into poor areas in developing countries.

That money comes from the poor suckers who are grinding away, buying Axies and hoping to make money. This is zero-sum, remember.

>That money comes from the poor suckers who are grinding away, buying Axies and hoping to make money. This is zero-sum, remember.

If you're poor, you're not buying those shitty tokens. The poor are the ones selling the goods for the tokens, which are purchased by people with enough disposable income to spend on digital "things".

If you have $100 to spend on an outfit for your avatar in some game, I have no problem if some family in the Philippines gets o eat for a month as a result.

You can build a marketplace without crypto, though. The question is why crypto is an important enabling feature. E.g. would Axie Infinity be as successful if it simply let you buy/sell assets directly? (Putting aside any of the surrounding discussion of pyramid schemes; I'm not really interested in Axie in particular, more how the concept is supposed to work)

I am also unsure as to how crypto benefits ownership of assets (eg "Axies"). I looked into NFTs recently, and (to my very simplified understanding) there seems to be:

Asset <-> Token <-> Blockchain

where the <-> are links of some kind. I understand that the T-B link on the right is secure and uses all the fancy crypto stuff (smart contracts, whatever) . However, the A-T link is less clear to me.

Concretely, if you 'own' a Pokeman/Axie then that is the T-B link, but what links the Axie to the token? A URL/URI? So where is that stored - in a database somewhere?

It all seems very suspect, but maybe I'm missing something.

I think the bridge into the financial system is the value. In theory, any game could create a way for you to "own" a rare item, and maybe even trade it within the game. But then how do you transfer ownership with a guaranteed exchange that can be cashed for fiat? The exchange would require us to trust each other, and I would paypal you the money? I think the NFT serves not only as the proof of ownership, but the chain of ownership and the escrow as well.

1) It enables users to own their assets regardless of the state of a centralized server. 2) Standardized format to trade on any third-party marketplace. A player could sell to an investor who has no intention of playing.

Thanks.

2 mostly makes sense to me--ownership can be managed independently of the game, and without a bespoke integration with that particular game. I do wonder a little how important being able to turn game assets into general-purpose instruments is (meaning, to the success of the game), but I can see how it expands the market and in particular how it makes it harder for the game company to manipulate that market, which makes the assets more reliable.

I'm not sure I understand 1 though. Don't the assets only have value in the context of the game's mechanics, which _are_ centralized? Like if the game decides your bag of holding no longer holds anything, or even to simply ignore its existence, does it matter that you have a token asserting your ownership of the bag? In theory, the token could have value as a token outside the context of the game, like a meme stock or, uh, the current price of Tesla, but that's true of anything tradable.

Regarding 1: Sure the game itself is centralized, for example Axie Infinity might even ban players who "cheat" according to their definition of cheating. So if you are a bad apple or get banned without justification, then block chain won't help you.

If however (some years down the line) the original game creator abandons the game, any group of people could jump in and revive the game (by re-creating or updating it or doing something completely novel) based on the state that is still available on the block chain.

That's a nice property, but it seems like only a marginal benefit to Axie? Something like, players are more likely to invest money and energy into the game if there's some chance their assets' value will outlive Axie, thus slightly reducing the risks to their investment. Seems like that would be a small effect, or am I missing something? I guess what I'm trying to understand here is how crypto is a big game changer.

Thanks for the discussion in any case.

The bargaining power is much higher on the user site. "I did not like the new feature. Take it back or we throw together some money to build a competitor. We already have all player data, it is on chain."

I've no doubt when they get VR sex with robots incredibly realistic, it will be a huge business.

Maybe spreadsheets and email for business use but that's not why I and people I know got them - more to play around on.

The killer app for crypto / web whatever in reality is speculation. From recent US research "43% of men ages 18 to 29 say they have invested in, traded or used a cryptocurrency." Maybe it's not the sort of adoption you approve of but it's still adoption.

Speculation is training wheels for scalable direct democracy, and that'll be the killer app of crypto / web whatever.

No government would allow that.

Crypto will be illigal due to terrorism/CSAM/gambling/etc long before it starts threating ruling establishment.

That's true, but I don't think it being illegal will have any bearing on whether it later becomes a threat to the ruling establishment.

Reply on news.ycombinator.com