Hacker News Reader

Comment by grumbel | Hacker News Reader

> Creating an account per node is federation working as intended.

I call that broken by design. Having your identity tied to a server means somebody else controls it. Email has the same problem, if GMail changes the ways it handles emails and makes a provider switch necessary, tough luck, you now have to tell everybody that you are moving to a new sever and your email/identity changed.

Just using a GPG key to represent your identity or something along those lines would be a much better way to handle it.

View on HN

> Just using a GPG key to represent your identity or something along those lines would be a much better way to handle it.

This is something the web3 world is moving towards a user-friendly solution for[1]. A web3 wallet (something like metamask which is a browser extension) actually holds a public/private key pair. Websites can authenticate by asking the user to "connect their wallet"[2] which actually means signing a message which the site can validate. To do this, the browser extension shows a popup showing the relevant bits of the request with "Approve" and "Reject" buttons. Once signed you are able to use the facilities of whatever website even though you don't have any sort of account. If at a later stage I want to revoke my approval I can just do that in my wallet - I don't even need to go to the site and there is of course no account to delete there. You can easily maintain multiple distinct personas because a wallet can contain multiple "accounts".[3]

Something similar might presumably work for the fediverse. No accounts just an identity service/API that allows sites to get your public key and ask you to verify things by signing with the private key.

[1] I say moving towards because there are plenty of rough edges, but the basic idea is pretty good and the UX is already streets ahead of the normal GPG verification/signing type workflows

[2] There is an API called "walletConnect" and as long as wallets and sites implement that, they are able to interoperate fairly seamlessly (in theory). In practise it doesn't always work that great. https://docs.walletconnect.com/

[3] These are actually an address and a keypair. The address is used to perform transactions on the blockchain so wouldn't be relevant to the fediverse I wouldn't think.

I see this a lot as a justification for crypto and tbh I don’t buy it.

Why can’t we just use key pairs without all the commodity token nonsense? Blockchains are a hyper redundant global network of adversarial servers. This is the silliest way possible to implement a key based id system.

You absolutely can, and if you read what I wrote above I'm not shilling for any token or pushing any kind of blockchain.

I'm saying the user experience of having your keypair in a browser extension with an API that lots of sites agree to use is significantly superior to the old gpg way of doing signatures and verification and means that you can do what the GP wanted (having a key that you control representing your identity which is strongly authenticated with zero knowledge and not an account on each server). You can do all of that without any sort of blockchain and it's something fediverse sites could adopt.

That’s fair I just assumed you were shilling because you mentioned web3 and metamask.

I totally agree and hope the web moves in that direction. Unfortunately I think the tech giants will fight tooth and nail to retain their sso products. People also generally do not want to perform key management :(

Another issue is that if you choose the wrong node and they decide to shut down for some reason, you lose all your content.[1] There has already been precedent for this.[2] All it takes is being out of the loop for too long and missing a message announcing a shutdown/migration to lose your data. In practice this makes the largest nodes the most appealing for registering an account since their popularity gives you the highest chance of your data living on, which defeats the point of decentralization.

Also, if you're Twitter, you can afford lawyers and moderators to clean up illicit content. If you're operating a Mastodon instance, that responsibility falls on you. It's simply a question of who has more capital, human resources, and free time.[3]

Twitter being centralized means that it's unlikely that Twitter will go away in the long term. That's what would make me choose Twitter over a Mastodon instance if I wanted a public archive of something. I have to wonder what would happen if content of more and more importance started to be hosted on the Fediverse if it was subject to link rot from the nature of federalization.

[1] https://github.com/mastodon/mastodon/issues/10305

[2] https://mastodon.social/@Gargron/103295961293741634

[3] https://news.ycombinator.com/item?id=14290985

Reply on news.ycombinator.com