Hacker News Reader

> For sure, you can do PGP, but if it's decades old, you have to ask yourself: Why hasn't public key cryptography taken off as a sign in solution in the same way that email or Google or Facebook have been?

For the same reason a Metamask extension to do so won't take off outside of specialized applications.

Since users have not yet authenticated, this is part of a conversation process of potential users to registered, authenticated users. Only options which will increase that will be supported.

People to some very high double-digit percentage understand what a "Sign in with Google" button does, what will happen if they hit it. Because of that, there is high likelyhood if someone hits that button that they will return successfully authenticated.

PGP never had a website-based authentication option. Mutual TLS did, but other than a few certificate authorities I've never seen it out of the enterprise space - the compatibility and user experience were never even close to sufficient to offer as a broader option.

As optimized as the sign in with Google experience is, there are still sites which will not support it because they want to make sure the user does not get 'lost' on another site if there are failures. They simply will not outsource their funnel.

chrome will never have a "login with pgp" function

brave already supports "login with ethereum"

adoption matters

> Why hasn't public key cryptography taken off as a sign in solution in the same way that email or Google or Facebook have been?

Because people haven't been financially motivated to evangelize it.

I believe that's the core of blockchain/web3 innovations. It's a worse way to do it, but the social hype (driven almost entirely by get rich FOMO) is enough to push it over the edge.

The most efficient way to do it would be to bootstrap the ecosystem with blockchain buzziness and then just deprecate the blockchain part eventually. MetaMask already relies on "Web2" apis to query blockchains, who says they have to actually hit a blockchain all the time?

This is exactly what’s happening with crypto.

A user’s transaction on Coinbase rarely represents an actual transaction on the blockchain. A transaction actually represents a row in a Coinbase SQL database, which Coinbase will eventually batch and then convert into a blockchain operation.

Coinbase is a centralized exchange. Of course it runs in a SQL db or whatever. They only need to touch the chain when settling inflows/outflows.

But something like Uniswap: https://app.uniswap.org/#/swap is fully on-chain. Every trade happens on chain, because the application is an immutable smart contract liquidity protocol, called an AMM, or automated market maker.

It does as much, if not more, volume than Coinbase ($1.98B in last 24H): https://info.uniswap.org/#/

So... a dark pool? Oy vey.

> MetaMask already relies on "Web2" apis to query blockchains

False. MetaMask uses Infura as a default, but you can edit your RPC URL to whatever you want. You can even run your own node and sync the chain if you've got a couple hundred gigabytes to spare (no stake required to run a non-validating node).

They don't have to hit the blockchain all the time. Only when it makes sense. For everything else, there's off-chain signatures. That's the beauty of it. Hey, you don't want to use the chain, just use the sign-in with Ethereum feature, and that's totally cool!

> This will be proven to be false in the long run. This was the same argument against Linux back in the day vs. Windows. The bazaar will win against the cathedral in the end.

Linux is still sitting at ~2% desktop market share compared to 90% for macOS+Windows. I'd hardly call that a win for the bazaar.

Okay, but the login bit for MetaMask is "just" using public key cryptography though, right? You could strip out the blockchain stuff from MetaMask and that part would still work.

You could also do Web Authentication, which is based on Public Key cryptography and ships with every major browser and is integrated into many operating systems.

Exactly! AFAIK client certificates have been in browsers for decades and almost no one uses them. Whereas, like you said, millions of people now the ability and basic know-how to generate and sign with public-private key pairs, adopted via incentives that keep the wallet ecosystem thriving.

People only use Metamask to engage in speculative crypto schemes.

Blockchain doesn’t really solve the whole “who is giving me this key” issue with PGP.