Hacker News Reader

Comment by ramijames | Hacker News Reader

Disclaimer: I work in the web3 (crypto) space and have for a long time already.

I think the killer app for web3 is going to be a decentralized, open identity/auth solution. The idea that we use our email accounts, attached to huge corporations which siphon every detail about us for their advertising engines is absolutely absurd. I just want to be able to log in to applications and carry some of the simple data like my identity and what assets I have available with me, without having to pay for it by losing my privacy and autonomy.

Nothing in the web2 tech stack currently allows this.

Imagine being able to log in, securely, to HN, Twitter, your bank, et al., and with you comes basic data about how to contact you, how you pay, what assets you're holding, etc. You get to choose what you share, and you get to authenticate each transaction discretely. It's powerful and it puts that power in your hands, not in those of large corporate entities.

That's what I'm interested in, and that's what I work on. We should all want some form of that.

edit: glad the response to this was by people interested and curious. my usual feeling on HN is that people are hyper-negative about web3 tech. It's ok to be curious about new, cutting edge technology. That's what we're all here for, I think. Maybe the decentralized trend won't pan out. Maybe it is all a giant scam. Doesn't mean it isn't interesting and it doesn't mean that the people working in that space aren't legitimately trying to innovate.

View on HN

I love when web3 people say this, because it's revealing. There is really no application you can come up with that is less amenable to decentralized blockchain technology than identity. The hardest problem in identity isn't public key authentication (which we've had for 2 decades, and nobody wants) but account recovery. The absolute last thing any ordinary user wants is an identity that is cryptographically unrecoverable, or that functions like a bearer bond if compromised.

Account recovery isn't a basket of features like multi-sig wallets and threshold schemes. It's the assumption, so far baked in that most users don't even realize they're making it, that if something goes wrong with an account there is a human-mediated process for restoring access. A centralized authority is intrinsic to the concept! It has to be there from the beginning! You can't ask users to opt into it, because they're users and they don't know how any of this stuff works.

It's for this reason that Apple and Google control so much of Internet identity, and are going to continue doing so. Advocates of decentralized identity are poisoned by the experiences and preferences of a tiny but vocal sliver of users that (1) are deeply into this stuff and (2) do enough weird shit to occasionally get on Google or Apple's bad side and have bad/annoying experiences with account recovery. The problem is that these voices are not representative of the market, like, at all. Google does a better job of global Internet identity than any organization operating at any kind of scale. If you can't recognize why this might be true, and will be an enormous obstacle to adoption, you're not engaging seriously with identity.

The power that decentralized identity offers, normal people don't want. The things it takes away: necessities. It's a toy, not a killer app.

I completely agree with you, but I a small thought about public key authentication.

Today more and more people without a background in IT which got in the "Web3"/Crypto ecosystem get in touch with public key authentication mostly used with wallets like Metamask. It get's understandable and usable for the average user.

I don't see what that would get me that I wouldn't already have with Sign In With Apple, other than not being tied to Apple, which is one of the most important features of SIWA: if something goes wrong, there will be an ultra-annoying hard-landing customer service procedure that will, ultimately, restore access to my account.

A while ago I worked on the 2FA access feature of a large online service.

The fun crypto-related and login-path stuff took maybe two weeks.

The remaining months were all about account recovery. It's really hard to do well, and unless you hire support staff it just won't work.

I can turn this right back around on you.

> The power that decentralized identity offers, normal people don't want. The things it takes away: necessities. It's a toy, not a killer app.

Who are you to decide what “normal” people want, what a “necessity” is, what a “toy” is? And, moreover, are you sure account recovery is as important as you think it is? Maybe people would prefer to have accounts that have very little identity, that get thrown away without much care — you know, like how people use throwaways on here — than some One Absolute Source Of Recoverable Truth?

Humans have thrown things away forever. If anything, it is absolutely abnormal to want eternal persistence.

Also, the whole thing that public key identity has existed and “nobody wants” is utterly laughable when you look at the actual usage metrics on web3 wallets. If that entire industry does nothing else, the fact that it’s made 19 year old art students feel cool for knowing how to handle their public and private keys is enough innovation for one cycle.

Not sure why the crowd on HN is so irrationally religious about this issue. It’s not bike-shedding, but it’s definitely something similar.

> Who are you to decide what “normal” people want, what a “necessity” is, what a “toy” is? And, moreover, are you sure account recovery is as important as you think it is? Maybe people would prefer to have accounts that have very little identity, that get thrown away without much care — you know, like how people use throwaways on here — than some One Absolute Source Of Recoverable Truth?

The person being replied to literally suggested it as a single source of truth. For everything from HN to your bank account. So you’re tilting at the wrong windmill!

I think one thing the crypto fad has proven is that even experienced people can’t keep hold of their keys properly. You’re always one mistake from an irrecoverable situation.

Why would I want creds that once compromised not only were irrecoverable but also affected my entire life?

If you want easy, temporary identity then the current situation is pretty great.

> The person being replied to literally suggested it as a single source of truth. For everything from HN to your bank account. So you’re tilting at the wrong windmill!

The parent I replied to is competent enough to know that there is an easy way to have that “recoverable account” he is obsessed with: custodial wallets. You know, like the custodial accounts that are the defining feature of Web 2.0.

People who don’t understand the innovation of being able to choose between custodial and non-custodial, and how that’s a big deal that many appreciate beyond the opsec requirements, sort of expose their own weaknesses.

I can see that login via private key is cool for some people, and being able to login via a private key some other party maintains for you would work for "normal" users. But I could also implement that without bringing in a block chain, right? Wouldn't we expect that Google and the current authN providers just implement that if it ever became popular?

> But I could also implement that without bringing in a block chain, right?

Not only that, but they have! Signature-based authentication existed 20 years ago. Register with a public key. Sign a message with your private key to authenticate. Modulo some small details to prevent things like replay, you are done. The only thing that the blockchain brings is that now lots of people have asymmetric key pairs where their public keys are published somewhere widely accessible.

So the answer is web2!

I’m confused, you didn’t respond to the person’s argument. Way to go missing the forest for the trees. “Normal” is the >90% that hasn’t even heard of key signing and no amount of screaming at them will convince them to care.

No, you’re the one who is missing the point. An ever-growing number of highly engaged young people are using wallets and engaging in key signing without even thinking about it. And what those people do today, becomes the norm tomorrow.

I had meetings with newspaper executives in 2007 where I told them “everyone will get their news on Facebook soon.” They couldn’t understand what I meant, because they didn’t think “normal” people would ever use such things. A lot of comments on HN regarding web3 remind me of those conversations. This will all be so embarrassing in 10 years.

Facebook tells the opposite of the story you're trying to sell, of people flocking to a highly centralized space to get a single feed of news.

There are lots of things that highly-engaged young people have done that don't catch on in the long run. Given the problems that Web 3 has, I see it as a lot more likely that Web 3 will go the route of fidget spinners than the route of Google.

You mention Google as a positive example, but they don't really have "a human-mediated process for restoring access". If you can't restore access with their recovery form, it seems the only option is to seek a court order, unless you have contacts at Google.

And I don't think it's just a matter of Google being cheap. If they had thousands of CSRs with the technical ability to reset passwords, I imagine we'd have a lot more cases of stolen accounts, using social engineering or bribery (as we see with SIM swaps).

The hard-landing process Google has is both human-mediated (which does not mean "you're hand-held through the process by a human being") and also iterated over time. Nobody had to figure out precisely what the account recovery process for Google was going to be a priori, because Google is a trusted third party and can adapt its recovery procedures as it needs to.

The problem with identity is summarized in the "why your anti-spam idea won't work checklist"[1] We still don't have a solution to identity that prevents generating large numbers of fake identities, doesn't cost each user money, and doesn't require a central authority.

Blockchain systems are a demo of this. A blockchain just needs some number of players who are independent and not colluding. That ought to be simple, right? The best ideas the blockchain crowd has come up with to do this work by making playing very expensive. (That's what both proof of work and proof of stake do.) Even that didn't really work, as mining has become very centralized. A solution to identity has not emerged from that crowd.

[1] https://trog.qgl.org/20081217/the-why-your-anti-spam-idea-wo...

I think you could go even further and add that a lot of power users who you'd think would want decentralized identity don't want it either, for the same reasons you mention.

> open identity/auth solution

An open solution built around public key cryptography? This has been technically possible to do for two decades, in the form of PKI client certificates, but never got anywhere because the key management is the problem.

Decentralisation trades "lose your account because you got banned" for "lose your account because any device with your key on it got compromised or lost", and for many people that works out worse. It's certainly less convenient.

Identity provision is also a two-sided market. You need adoption from users and the companies they want to log into at the same time. That's why there's only a few providers that most companies bother to integrate with.

The two-sided market is the big deal here. Imagine that you are a bank or online market place. What are you going to do when one of your top customers shows up and says that they lost their account keys? Are you going to explain that losing your account is actually a great feature that your company offers.

To be fair, this is the level of customer service that you get from Google in the first place. Banks are forced to do better.

Banks, at least in my country, can choose to accept incoming or outgoing financial transactions. Worse, governments have the rights to seize your assets, close your bank accounts, etc. Not sure any of that is better. I'd rather have Google shut my account down with no recourse.

It's all shitty and it's all infuriating.

>Google

I don't think that helps the Web3 argument. Google has made a choice, whereas crypto it is a technical limitation (or, to some, a feature). It also isn't a very good talking point to say "it's no worse than Google"

Crypto needs to develop a better balance between bad 2FA with loop holes on the traditional side and absolute loss on the crypto side before a lot of people would feel comfortable with it. Maybe that should be one of its target killer apps.

It’s not a technical limitation any more than it is for Google. You can easily create software where a chosen third party (or some 2/3 parties scheme) can recover your account.

That's good to know. It is a hindrance to Web3 adoption that such mechanisms aren't in place: It would certainly prevent me from relying on a service.

But what would a 3rd party or 2/3 party consensus use that would differ from current mechanisms?

There would also need to be some care taken to make sure that such 3rd parties don't become centralized choke points themselves: They would be somewhat essential, so any service(s) that did this could rise to dominance either as a monopoly or a cartel.

These mechanisms definitely aren't something built into the chain any more than they are built into HTTP or x86, but these chains are semi turing-complete so the software can be written (existing multi-sig ETH wallets are an example).

Let's say I control some funds and want you to have access to recover the funds if I lose my master key. I transfer these funds to a smart contract that allows my Ethereum key full control to move things around, and allows your Ethereum key access to give control to a new key if I lose mine (probably with a x-day delay, so I have time to revoke your access if you go rogue!).

For a 2/3 system, it's basically the same except 2 out of 3 of the other people need to "vote" on chain, and only then can my key be reset.

There wouldn't need to be a centralized party who resets the keys. Social solutions where you give trusted friend(s) limited reset access, probably with a time lock like I mentioned, are extremely promising IMO.

Thanks for the further explanation-- I fully understand that such things aren't baked into the current infrastructure-- which also creates problems (for example a cell service provider resetting a password over SMS through their own supposedly 2FA system). L

The smart contract you describe is sort of what I meant by service providers emerging for this sort of thing: The average user will not feel comfortable rolling their own such contract. It either needs to be dead easy, or there will emerge services that do this for you and oversee their execution. I could be wrong about that... Much of what Web3 will look like is speculation. But if those sorts of services emerge and become market dominators, they would have a lot of control-- contracts that allow termination (deplatforming). As contracts become more complex to avoid edge cases we see being exploited right now, it may become even harder to understand all implications, loopholes, exploits, etc.

The above may be a solvable problem: Develop tools to parse smart contracts. A specialized class of automated testing tools for smart contracts.

In the scheme I described there would be no central authority with special power over the "recoverable account" smart contract. Each user would deploy their own fully independent instance and choose who can help them recover the account. Contracts are immutable so the person writing / distributing the code wouldn't have any extra powers the way Google and Facebook do.

Obviously this hinges on the contract not being backdoored by its creator to begin with, but collections of free, open source, audited smart contracts for stuff like this already exists. A user would likely use some app / tool to deploy their instance, once deployed it's really simple to verify the deployed code matches the verified open source version.

In the case of my bank, I'd expect to walk into my local branch with my driver's license, passport, birth certificate, and any other official ID I have, and convince them that I am the same tzs who owns the account and have them set me up with new account keys.

What I wish is that there was some way to tie my other accounts, directly or indirectly, to my bank. My bank account is the most recoverable account I have, because they can handle me showing up in person with ID.

Other accounts just know me by my knowing the account password and/or being able to receive emails at the email address associated with the account. If either of those is compromised I can lose the account with no way to recover.

If there were some way I could have my bank verify my identity to my email provider, and tell my email provider that if account recovery is ever needed on my email account to re-verify with my bank that it is really me requesting the account recovery it would be much safer.

(If you are using an email address at a domain you own, then replace email provider with domain registrar).

Then no matter how badly I'm compromised (as long as it is not by someone with sufficient resources and interest to be able to get past an in-person identity check at my bank), I've always got a path to recovery.

Worst case, first recover the bank account in person. Then recover the email account using the bank account. Then recover compromised accounts that are using the email account for verification.

The bank still has a dependence on trusted authorities when it assumes your ID documents are legit. Rather than asking banks to confirm your identity for other accounts, I think we should ask governments to extend their practice of providing physical ID documents to providing online identification services. States have worked with Apple on "digital drivers licenses" that live on your phone, but the idea is still that you show them to someone in meatspace. Why shouldn't they provide an online service?

Of course, all this depends on the assumption that your ID should be who you are IRL, rather than the model where we can all make up several independent pseudonyms for different purposes.

Many European countries have government-provided online identification services.

Estonia's implementation is usually regarded as one of the best: https://github.com/open-eid

> The bank still has a dependence on trusted authorities when it assumes your ID documents are legit. Rather than asking banks to confirm your identity for other accounts, I think we should ask governments to extend their practice of providing physical ID documents to providing online identification services.

Sure, that would work too. Or even do both. The point is to have some place I can go in person to have my identity verified for a third party such as an email provider or domain registrar. Then set up the email or registrar accounts so that account recovery requires such a verification.

I wouldn't have to tie everything back to the in person verification. Just things that I want to be sure I can recover if I lose them via accident or hacking.

So what you are suggesting is that the bank has full root privileges to change credentials associated with an account. What is the point of having a decentralized database if the bank can change ownership of accounts as they see fit?

In-person account recovery is tough. A friend of mine runs a branch of a major bank. She regularly meets with customers who need to recover their account identity. A sizable fraction of the people who show up trying to do that are attempting something scammy.

If there were some way I could have my bank verify my identity to my email provider

Major banks can do their end of that. They will notarize documents and provide signature guarantees for established customers. Now, having obtained a notarized statement guaranteed by a major bank that you own your identity, how do you submit that to Gmail?

Banks don't really want to be in the authentication business anyway. It's an unprofitable sideline, and takes up a lot of staff time.

This is sort of what happens when you use OpenID with Google. The "break glass to recover account" flow at Google does literally involve photographs of government issued ids and other human process like that.

Right so this is where smart contracts come into play. There are crypto wallets that are based on smart contracts which encode logic that allow people to "recover" their wallets if they lose their key by having some N of a selected group of trusted friends sign off on switching it to a new key.

That is why this was impractical before: we didn't have a neutral/decentralized layer to remediate practical issues like this.

Smart contracts are something that can never work, because it is predicated on our ability to write correct code. Empirically, we know that is not going to happen, which means you need some sort of disaster recovery mechanism, which will end up being some centralised entity that has a sufficient level of permissions to override the contracts, thereby losing the primary selling point. Or you try to solve this with even more technological complexity, but that will only increase the fragility of the entire system and will paradoxically end up having the opposite effect of what is intended.

This is a bananas statement, there is literally billions of $ transacted safely and successfully on smart contracts every day.

Gnosis Safes (a multi-sig smart contract wallet) secure $96b in assets today and hasn't had a single security incident.

> Smart contracts are something that can never work, because it is predicated on our ability to write correct code.

Laws are of similarly bad quality (in my opinion of even much worse quality than software), we just have at least centuries more experience how to deal with crappy laws than with crappy software.

Does that really justify an entire blockchain infrastructure? This is possibly a hot take, but I can’t help but feel like key recovery as you describe could be implemented on its own, e.g. like horcrux[0]

0: https://github.com/corvus-ch/horcrux

Yes, because otherwise you are still trusting a centralized third party, which has incentives to lock you in to an ecosystem =/

Huh? What part of something like a horcrux relies on a centralized third party?

Oh well for this specific scheme, an MPC, it offers less flexibility. What if I want to remove one of my friends from my trusted guardians? What if I want to swap one out?

You can also design other schemes, like a time-lock one that says if none of the guardians are reachable (say they all lost their keys too, bad luck), you can recover it with some other secret key as long as none of the guardians reject it in 90 days, or something like that.

There are groups trying MPCs for this, but I think smart contract wallets will be far superior in user experience in the long run. You can even put in like bank-level protections, completely decentralized. For example, you could impose a daily spending limit, so even if you were compromised, you didn't lose everything and had time to lock the wallet. You could also restrict transactions to a set of whitelisted contracts, a list possibly maintained by a DAO. The possibilities are endless, it's turing complete code!

Sybil attack as a service: SaaS 3.0

Web3 people need to talk about this more instead of all the FOMO scam bullshit they currently hype and which is tainting every reasonable human being against their ideas.

Because right now, given how long the community has had to work on the problem and we still haven't seen anything like what you're describing, I'm still inclined to believe that Web3 is all a bunch of bullshit.

I do. I run a podcast (https://anchor.fm/ultraio/episodes/EP8-Ultras-case-for-NFTs-...) and this is my primary concern: educating people about the real benefits of the technology. There's a lot of baseless hype and a lot of scammy bullshit. There is also a lot of real-world benefits that simply have not been leveraged to their fullest potential.

Love to hear some of the alluded to "real world benefits" - I have heard none so far, just claims of things an experienced engineer can invalidate with a few minutes of work.

"A few minutes of work" is entirely disingenuous and misrepresents the problem at hand.

"Blockchains" are not just distributed databases. They are also distributed, open APIs, and consensus mechanisms for updating and managing the functionality that controls those APIs and the data that they produce.

I think about it this way: if you have one company that creates a database that many people use to build businesses around, then that company now holds a lot of power over the people who chose to build there. I believe that those people should have a say in the direction of the APIs that input/retrieve data, and ultimately should have some say in how long that database persists. The idea that we allow single entities to permanently control datasets seems absurd to me.

Now, from an engineering management perspective, think about how you manage multiple teams who have different agendas, different priorities, and different needs for those APIs and the child data. How do you govern that? How do you ensure that all nodes that replicate this data set and the APIs are up to date and not doing funny business?

This is all stuff that the decentralized community (web3) is trying to figure out together. It's DEEPLY interesting and ABSOLUTELY not "a few minutes work".

Could you elaborate more on how a blockchain will allow clients to influence the direction of the API and also keep other clients up to date on new API changes? That seems a lot more complex than the way you're putting it.

It varies a lot from network to network. You're right: it is very, very complex.

Politics and governance are topics that are, I think, a bit broad for a post in a reply on HN.

Suffice it to say that groups of dedicated people, either as loose alliances or as tightly controlled development teams, come together and make proposals for change, implement those proposals, and then push them to a network. If the network as a whole thinks it is in their interests to use it, it gets voted on and enabled. Sometimes this works, sometimes it doesn't. Mostly it is entirely transparent to users. Rarely it causes a fork in a network (basically a civil war) where infrastructure providers decided to part ways and go on to support two child networks instead of one.

It's messy, as all democracies are. I think it is a beautiful process, and it has taught me a lot of valuable lessons about how groups really work, what politics really is, and how to convince people who do not want to be convinced because you believe in something fiercely.

Open networks take a lot of the best parts of FOSS and bring them to life in a way that I never thought I'd experience so intensely.

> Because right now, given how long the community has had to work on the problem and we still haven't seen anything like what you're describing, I'm still inclined to believe that Web3 is all a bunch of bullshit.

That's because based on everything that's been demonstrated by 'web3' is essentially useless. And this post you're responding to is a well.

They claim the benefit of web3 is you'll be able to have 'privacy' by controlling you identity and transaction history and choosing what to share by using blockchain.

Prevent a large company from having all your info. By putting it in a blockchain? So now instead of one, every large company has your info! You aren't gaining privacy by putting your private info in a public distributed db!

And just like almost everything I see posted about web3 a few mins of thought by any serious engineer shows this again is all hype that can't be backed up by the tech. And just like web3 in general, in this HN thread you see people caught up in the hype and missing the obvious core flaw with the very premise.

This is the problem with web3, the main product it successfully produces is hype.

>The idea that we use our email accounts, attached to huge corporations which siphon every detail about us for their advertising engines is absolutely absurd. I just want to be able to log in to applications and carry some of the simple data like my identity and what assets I have available with me, without having to pay for it by losing my privacy and autonomy.

Okay but instead of it being known to just say one company, anything on the block chain is known to everyone. I fail to see how that's any better or even remotely "powerful".

How does it feel knowing that you've signed up to 100 applications, which you use for everything from work to pleasure, and that that authenticating account can be taken from you at the whim of a company? Feels bad to me, man.

Couldn't someone just steal your token and you lose access to 100 applications?

No. It's not a token. It's an on-chain account verified by multiple permissions that are controlled by key pairs. It's based on EOSIO technology and is pretty robust.

How do you recover your account when you lose your keys?

You can’t.

Check out Vitaliks post on social recovery wallets https://vitalik.ca/general/2021/01/11/recovery.html

That doesn't address their concern, really. Threat models are personalized to everyone, and for a _lot_ of people, they choose Google/Apple/Microsoft and are fine with that company knowing their 3p logins - but wouldn't be fine with anyone being able to plug in their crypto address and see all the services they've connected with.

Although, i'm sure a blockchain identity service could be properly architected to keep connections secret - i'm eager to see if that ever comes to fruition.

On the other hand, a company providing the service can ban users for spreading harmful information. Imagine a situation where, say, the president of the US was spreading misinformation regarding a pandemic for example. To me it sounds good that there is some control to it.

There is no such thing as harmful information. Only actions can cause harm.

Do you think we should trust unaccountable corporate managers more than elected leaders to determine what is misinformation?

>only actions can cause harm

Disseminating information is an action. Also misinformation does not always contain information: Many times it's just a more polite way of calling something a lie, or simply wrong. Even when there is information, cherry picking which information to share can give the opposite impression of what more robust information would show.

The question of who to trust is a good one. The issue I have with the viewpoint that platforms shouldn't be allowed to make these decisions for their own platforms is that it takes away property rights by having the government mandate what can or cannot be done with privately owned property. Should people have the right to decide what people can do on their privately owned property? Businesses are allowed to make all kinds of rules about this, from dress codes to what they consider disruptive conduct. Limiting that ability seems problematic to me.

I don't have anything that I would consider a solution to finding the right answers or balance here, but I don't think we can ignore these issues.

> There is no such thing as harmful information. Only actions can cause harm.

Perhaps in some idealistic model of society this is true. However, in reality people cannot process and evaluate the factual basis of all information that is pushed on them. Otherwise we would not be seeing so wide-spread misinformation campaigning, fake news and conspiracy theories. Harmful information tends to transform into harmful actions (harmful here being subjective - there's often someone benefiting as well).

I don't have a clear-cut answer who should be determining what is misinformation. Also, I don't believe one bit that a free-for-all model is a good one, quite the opposite. Currently it seems that when someone clearly crosses the line, public opinion or perception forces the company to reconsider allowing the violator to remain on their platform. It might not be the most elegant model, but possibly the best we have.

I think this touches on the heart of such issues. Many people see a big difference between censorship and an obligation to follow certain rules. Others seem to view any rules as a defacto form of censorship. I don't think these positions can be fully reconciled with each other.

That is a valid concern. But in practice most of the sites which allow federated authentication support multiple providers, typically Google, Facebook, and Apple. I expect one of those will eventually ban me for wrongthink, but probably not all of them simultaneously.

To me, it seems the solution here is not to centralize into one identity for everything but the opposite: to distribute each account into its own identity. Software can then manage each disparate identity to ease the burden for the account owner.

> Okay but instead of it being known to just say one company, anything on the block chain is known to everyone.

Bitcoin != blockchain. Technology exists [1] to store data on the blockchain in a private manner without sacrificing its decentralized nature.

[1]: https://www.getmonero.org/resources/moneropedia/ringCT.html

But if you encrypt it so nobody else can read it then the big bad companies of evil will still need to collect your data individually - which brings us back to the initial point, but now with a blockchain for some reason

Companies are going to collect our data as long as they are able to use that data as an income stream.

I don’t have a Facebook account but I know they have data on me.

Yeah, and even if they can't sell collected data because we all agreed to just put them on a blockchain aggregates and whatnot will still be valuable assets. This isn't an issue that can be solved by technology. It will need regulation/laws and I don't see that happening.

But it’s different! Because blockchain!! /s

OpenID let you have custom auth that you controlled. Basically no one supported it, and basically no one used it.

What would make the "web3" version different?

The honest answer here is because valuable assets are attached to that account. Money makes a big difference in what a company is incentivized to integrate and what they are not.

OpenId is awesome, and is awesome FOR USERS. It's just not awesome for companies. They have zero incentive to integrate it.

I'm not sure it was awesome for users. I remember finding it confusing.

That seems very hopeful to me. You can attach certificates of ownership that mean nothing inherently and no one has any incentive to respect. I see no evidence of anyone finding a good use for NFTs right now, and all the suggestions I've heard have been hand-wavey and/or obviously deeply flawed.

A bunch of speculators aren't going to drive actual adoption.

To be clear: I used OpenID and I loved what it offered me, but I don't buy that "web3" fixes the problems that caused its death, or offers anything more than it did.

Unfortunately you acquire users by building what they actually want, not what they should want.

This is true and wise.

This is not incompatible with what the parent comment is talking about.

People want easy / seamless access to the services they use. If Web3 can find a way to provide that or improve upon the current hellscape of email based logins mixed with federated social logins mixed with the pain of maintaining 100 different accounts, it might just find a place.

But the people working on this need to focus on the user’s end goals and UX needs, and not just declare the problem solved once a solution is technically working.

> People want easy / seamless access to the services they use.

Free. People want it for free. Not free as in speech, but free as in beer.

History has shown that the vast majority of people will trade their entire personal data set if they can get fake internet points for free.

ABSOLUTELY.

Accounts and transactions are free on our network. We think eventually all networks will have to go this route. Paying per-transaction is mind-bogglingly anti-user.

Sure, people want things for free, but that is orthogonal to the simplicity angle. Something can be free, but won’t see use if it sucks badly.

People spend $$$ on Apple products because of the “just works” reputation. I’m not saying people want to pay for services, but I think it’s important to distinguish UX vs. cost when examining what motivates people.

> The idea that we use our email accounts, attached to huge corporations which siphon every detail about us for their advertising engines is absolutely absurd.

Is it, though? It’s just a trade off people make to get a free service. If I want my email to be free of advertising scanning by large corporate entities I can just pay for Protonmail or something.

This is what I feel like I see with web3 time and time again: it’s a complicated technological solution looking for a problem when (for the vast majority of people) that problem is already solvable without the complexity.

Honestly, I think the tech and infrastructure is simpler than what is currently deployed at google.

I strongly agree. Email is already a federated system that lets you own your own data. It turns out everyone would rather have convenience and that’s completely understandable.

Wouldn't that be just as bad (if not worse) than the current situation? Those huge corporations could just read everything from the blockchain. At least in the current situation companies need to provide some sort of service to get to your data.

I'm curious because I'd bet you're right that such a thing would be adopted really quickly if it were user-friendly but my biggest question is whether everybody would be limited to a single identity or if you'd allow multiples. If you allow multiples, would 'identities' be free? If so, I'd be concerned that the same thing would happen to your company and product that happened to Web 1.0: In THEORY we'll all have control over our own data, but in actuality, running software takes time, expertise, and money, so aren't we all (meaning the general public/average person) going to have a choose an intermediary anyway? And you think it should be your company. (Which maybe it should, idk).

I'd also be a bit concerned about:

- Ability to spin up alts and anonymous pseuds is a key component to Internet use, for me. One great thing about email is how easy it is to get an email address; I don't need a credit card, address, ID, etc. I don't need to use a real name. And so on. This is one of the things that makes the Web so powerful a force for the marginalized. For instance, I had an email address when I was 6. That's illegal now, but 13 year olds can have them. Or say you're a lady in Afghanistan.

- This information persisting over time and being unalterable might result in some very uncomfortable social situations if people keep the same credentials for decades.

None of this is a reason not to do such a thing, and I think it's a good idea and one I'd actually use in a heartbeat, I'm just not under any illusions I'd be doing much other than switching my 'alliance' away from an email service provider.

Leaving aside the discussions around PKI and necessary centralization in public/private key authentication I've seen this web3 debate a couple of times now.

It starts with "web3 is the second (third?) coming of the internet and will revolutionize everything".

If you ask for proof or use cases the very first comment is: "You can log into Twitter using a public/private key pair"

These are two very different statements. So even if you assume there is advantage in public/private key auth it is still nowhere close to an internet revolution.

Imagine the PostgreSQL team had praised the JSON data type as the revolution of the internet and disruption of all industries as we know it. It's a useful feature and it is used by a lot of companies but it has zero impact on everyday people. And Bloomberg and the Wall Street Journal are certainly not writing about it.

Legitimate companies are unlikely to rely on decentralized identity unless required to by law. Apple/Google federated login? Absolutely, they have the power to dictate it (Sign In With Apple). Login.gov and ID.me? Absolutely, they’re trusted government and private sector identity proofing providers. But trusting the identity of your users to a distributed ledger or computation fabric? I just don’t see it happening, and it’ll likely go the way for Mozilla’s federated identity provider.

You are seeking a technical fix for a regulatory issue (data sovereignty and portability & digital privacy).

(I work in digital identity and interface with decision makers)

Honest question: can that happen without users having to purchase ETH (or whatever the underlying token is)? My very limited understanding is that web3 is inherently tied to cryptocurrency and the miners have to be paid somehow.

The open network that we built has free accounts, free transactions, no resource staking requirements, etc. Gas on Ethereum is absolutely a problem and absolutely does not scale.

We do not have mining (proof of stake), and have been certified carbon neutral (https://medium.com/ultra-io/ultras-blockchain-is-carbonneutr...)

> With this in mind, we chose to assign seven designated Block Producers for Ultra’s blockchain.

This does not sound truly distributed. Like you might as well not use Blockchain if it's not distributed.

Git uses a kind of blockchain and is often centralized rather than distributed.

Pedantic but fine. I'll revise to "why use a trustless distributed ledger if you are going to only allow 7 validators. Might as well just use MySQL with an API.".

Decentralization is really a spectrum. We have a set of block producers that we've vetted and have worked closely with to set up the infrastructure for our network. They are external companies (Ubisoft is one of them). The code that runs on the network gets vetted by them and only goes into production after they sign a multisig and allow it.

It's not thousands of anonymous nodes, but it is also not a single entity that controls everything.

We intend to build out a more decentralized pattern with more complex governance as things mature. It's a software project and as you all well know, you can't launch your ideal at the start. You launch what you can and you improve as you go. Decentralization is that way, too.

Thats the fun part, you don't have to purchase any cryptocurrency. All you need is a crypto wallet and you have a public/private key pair.

Crypto only empowers this by encouraging people to maintain their keys with a serious financial incentive.

This is a cool insight.

That doesn't solve anything. People will still lose their keys. What is the key recovery strategy?

Check out Vitaliks post on the topic :

https://vitalik.ca/general/2021/01/11/recovery.html

In newer systems, users don't have to buy any tokens because VCs pay the transaction fees and they pay you to use the system.

But this can't last forever no?

Of course.

Reminded me of this Jaron Lanier quote from "Sway" podcast:

"I believe Facebook is undervalued for what it does. Because Facebook is essentially running identity for the internet, which is a very valuable function. So under a data dignity regime, I think Facebook would double or triple in value very quickly."

I do think that digital identity is going to be an existential(pun intended) question. Ideally it would be managed by a competent government agency. That's likely in many countries. I doubt that it'll be the case in the USA.

> The idea that we use our email accounts, attached to huge corporations which siphon every detail about us for their advertising engines is absolutely absurd.

That's what the companies want, though. Facebook and Twitter don't trust me because I have an email address, they trust me because I have a _Google_ email address.

Having a Gmail account means that Google trusts you. Google only trusts you if you provide a reputable phone number.

If you host your own email, you can't do anything because nobody trusts you.

Changing the protocol from email to crypto won't fix that. I either have to be reputable ("Yes I'm wealthy, Google trusts me, I have a phone number which means I have a bank account, which means I'm a legal citizen with a government ID, and this is my legal name") or I can't get in. Standing up my own throw-away identity will be as useless tomorrow as a Mailinator address is today.

For you and me, email auth is a dark pattern. For the companies, it's a feature. It keeps out freeloaders, spammers, and criminals.

> If you host your own email, you can't do anything because nobody trusts you.

Where can you not signup with your own hosted email? I can't think of any service. Twitter, bank, saas apps, just care that you have an email.

>> I think the killer app for web3 is going to be a decentralized, open identity/auth solution.

How would account recovery / password reset work in a web3-based system?

With Google, Apple, etc. there is a party that one can go to for account recovery.

How would it work for web3 if it is decentralized?

This is a really big problem that we spent a long time solving. The fact that if you lose your private key you lose your account and its associated identity and assets is a big deal.

We have a recovery mechanism that allows you to set and manage secondary authenticators which are used as witnesses in the case of loss of access to your primary account. Another working group that I'm involved in is trying to solve this problem in a tangentially similar way using multi-signatures. It's an interesting approach.

So what’s stopping my friends from stealing all of my money behind my back?

You're worried that a bunch of your most trusted friends, who you can even choose a subset of such that they don't know each other and have no connection other than you, will conspire to betray you in a provable way? Isn't that strictly less risk than giving a spare house key to a trusted friend or neighbor, which people do all the time?

Can’t à shared signed key algo be used ? Ala Shamir Shared secret algorithm?

If 2 out of the 5 keys ( or whatever value ) are present you can log in.

There are multisig social recovery wallets where one party or a group of parties is trusted to help you get regain access to the account with a new signing key. Gnosis lets you do this with arbitrary friends of your choosing. Or if you're like most crypto folks and have no friends, something like Argent can handle this for you with email/phone number authentication after a delay (a few days).

So what’s stopping my friends from stealing all of my money behind my back?

Social recovery with friends usually needs something like 3 of 5 or more to effectuate a recovery. So your friends would have to effectively collude with each other without any of them tipping you off about the plan.

> The idea that we use our email accounts, attached to huge corporations which siphon every detail about us for their advertising engines is absolutely absurd. I just want to be able to log in to applications and carry some of the simple data like my identity and what assets I have available with me, without having to pay for it by losing my privacy and autonomy. > > Nothing in the web2 tech stack currently allows this.

Anyone who wants to can get their own email address which doesn't require giving data to advertisers. You can run your own domain or use an email service which isn't run as a loss-leader for advertisers, and you can use services like the one Apple built into iOS if you want to prevent the sites you visit from having a common identifier. The cryptocurrency services will need a variation of that same solution since using one wallet for everything is bad for privacy but the average person has limited interest or ability to reliably juggle many wallets.

What's more interesting is to consider is why many people chose a single email provider when it started as a service which is at least as decentralized as any cryptocurrency. That includes the extremely important account recovery problems tptacek mentioned, spam, but also simply things like the different values most people have for security and operations. Cryptocurrencies are theoretically decentralized but in practice most of the people involved seem to use a handful of exchanges and ostensibly decentralized services often depend on one or two companies, and that tends to come down to the same answer: most people don't want to run servers or be one mistake away from losing everything, and would prefer that work be someone else's job.

The other problem we have is how much people are willing to pay. Fastmail, iCloud, etc. are not expensive but a LOT of people have reliably voted with their feet and there seems to be only a small number of people who mind ads enough to pay for alternatives. I don't see web3 as SSO going anywhere until there's a lot more value to be shown from buying in — that upfront non-trivial payment requirement for something which just allows you to access other services you presumably would also have to pay for seems like a tough sell as a mainstream movement.

I like this as well, but have zero faith in the wider public caring enough for that become the killer app. Most people do not care at all about Google/FB/Amazon owning their identity. It's sad, but true.

Sad, but true indeed. My hope is that there is a large enough minority that does care that will push for it's gradual integration and acceptance.

> Nothing in the web2 tech stack currently allows this.

Seriously? It takes five seconds online to find projects like https://solidproject.org (backed by people like Tim Berners-Lee) that don’t need blockchain and present strong arguments to address the kind of issues you raise.

But it’s an open specification for the web. How lame and very NOT crypto $$$diamond_hands$$$.

The most impressive thing about blockchain is its capacity to create zealots for the One True Way, all others be damned.

Also building on web3. I agree about authorization (permissions) but not about identity/authentication.

We do not need people to have to disclose their identities in order to use a service. We already have an authentication mechanism on every blockchain - the notion of an address/account. What we need is a decentralized way to associate permissions with those accounts.

This is something that must happen more by social consensus - projects adopting a standard. The technology already exists.

> Imagine being able to log in, securely, to HN, Twitter, your bank, et al., and with you comes basic data about how to contact you, how you pay, what assets you're holding, etc. You get to choose what you share, and you get to authenticate each transaction discretely. It's powerful and it puts that power in your hands, not in those of large corporate entities.

That sounds interesting! How could I learn more about that?

> that's what I work on

What's your company?

Yeah... How do I get to choose what I share? How would it work for HN or Twitter? Do they have to support this? Where should they start to be able to support this? Again, how am I going to choose what I share? Who exactly has to implement it? I really need some details.

If we actually have to rely on Twitter implementing something like this, then I do not have high hopes, as they most likely would not want to implement something like this. :)

Basically, we have an oauth-like mechanism that sites can integrate. The user gets to control, from their side, what data they whitelist and share. Whatever they don't, they don't get to have access to.

You're right, though: this is a steep hill to climb.

Ultra.io is the company.

I'm a bit confused by why this is in the "crypto" space. I thought the whole point of the "crypto" space was to prevent double spend. If you don't need to do that then a distributed/federated database seems sufficient. Are you planning to allow users to give/sell their accounts to others? If not then why are you using a "crypto" platform?

Because you get into the issue of who gets the right to modify what part of the database, and encrypted blockchain is supposedly a solution ?

Signature-based authentication has existed for decades. All that has changed now is that your public key is now a "wallet." If blockchain based authentication becomes the norm, it will be entirely because there is now an unrelated reason for people to create, publish, and store an asymmetric key pair.

This has been proposed as decentralized identifiers before actually: https://www.w3.org/TR/did-core/

Email is already decentralized. I pay for Fastmail with my own domain because I don't want Microsoft or Google to own my primary online identity.

> I work in the web3 (crypto) space

> Maybe it is all a giant scam

Normally you'd expect people who work on something supposedly worth billions to be able to say with a degree of confidence that it's not a giant scam.

Combine it with a decentralized/uncensorable web3 version of Twitter/Facebook and it also has the potential to become a killer app.

I don't think I agree that this is a killer app.

Virtually no one wants the consequences of a fully unmoderated (aka uncensored) social network.

Either there is are strong filter/segmentation capabilities (like "the algorithm" on current plattforms and different plattforms for different audiences) or anybody but the most radical / loud users leave sooner rather than later.

Most users also have any of their content removed.

So I don't see many advantages over the present state.

Reply on news.ycombinator.com