Hacker News Reader

Comment by sk0g | Hacker News Reader

> you’d be an idiot to ignore the realistic and adopted use-cases

Ignoring the hostility, what would you list as the realistic and adopted use-cases for crypto?

You can proof that a digital file existed at a given time and hasn't been altered since. It is something that I use on a daily basis.

We've been able to do this for decades. It's a core part of our PKI ecosystem.

Surely, but PKI still relies on cert authorities which have been compromised before

DeFi is, after all, notably devoid of serious compromises :-)

More seriously: there are cryptographically sound schemes (like CT) that address CA compromise.

CT is cool, but who is writing/submitting those logs?

There are multiple, independent entities both maintaining and submitting to the logs. The short answer: CAs submit precertificates to the logs; the logs respond with signed certificate timestamps that are embedded within the ultimate certificate rendered to the user. User agents (i.e., browsers) cross-check against the logs using the SCTs. Third parties ("monitors") additionally watch the logs for suspicious events (unexpected issuances, unusual certificates being signed for, etc.)

There's a nice visualization here[1].

[1]: https://certificate.transparency.dev/howctworks/#stepby

Not without a middlemen that we trust (cert authority in this case).

That's certainly not true. P2P file transfer systems have long provided cryptographic guarantees that the file you receive hasn't been modified by anyone, even though you're fetching it from multiple untrusted sources simultaneously.

Merkle trees have made this more efficient and offered maybe more guarantees, but being able to have files be transferred in a distributed fashion but impervious to corruption is not a new invention.

The one thing cryptocurrencies have not figured out how to solve is the root problem of all PKI systems, which is establishing trust of identity.

That is different use case. How would I prove that a file existed without a middlemen?

I would gladly switch since the method I am currently using isn't exactly cheap.

> How would I prove that a file existed without a middlemen?

How are you defining "middleman"? You can do this with any basic commitment scheme: take a cryptographically secure hash of your file and publish it somewhere that's either (1) trivially copyable, or (2) difficult to tamper with. Alternatively, you could do an online scheme where someone asks you for your proof and you present them with your hash after being challenged. That's a gross oversimplification, but it's the general idea.

(In general, "prove that a file existed" is not something that you often want to do in the real world. What is it you're actually trying to accomplish?)

I work with ALOT of documents that have a deadline / need to be finished at a certain time. The blockchain helps me to proof mathematical in front of a curt that the file already existed at a given date. It is the most secure way that I know.

A simple example of what I need without a middlemen.

A student writes a thesis. The last time he is allowed to modify the file is friday evening. He can now send the file via mail or deliver in person to prove that the thesis was finished by then. However he then trusts either the mail server administration or the person at the front desk. This is fine in most cases and works like this since decades. I however do not want to trust a person or company. I do not want ANY possible explanation how I could have archived it in a different way.

Naive response here, but that particular use case seems solved by a central authority, where the school is the entity that (1) cares the most and (2) should other students or decentralised entities be involved in observing student progress?

It’s accepted in court that a simple email showing the file as an attachment is acceptable.

Certainly blockchains are more trustworthy, but acceptableness in court is a pretty low bar. I mean having something signed on paper in front of a notary is acceptable.

What cases are you involved with where a notary isn’t acceptable? Or a non-blockchain digital signature?

I’m involved in really high dollar amount contracts and we just use pki-based digital signatures with a time stamp. Of course the time stamp could be fraudulent, but so could the notary’s stamp. But its acceptable in court and stands up to litigation.

I also teach a class and would accept an email from the student as proof. To me that’s more reliable than me having to research some blockchain signature that I’m unfamiliar with.

These are hypothetical use cases and don’t solve a real problem. And they certainly don’t justify paying transaction fees as they are now. It’s cheaper to just pay DocuSign.

A good place to look for middleman that can be cut with blockchain is the exchange between two random people that a third party needs to trust.

The example with the email in the court is a bad example because it is not the court's job to prove whether or not an email is fraudulent. It is the opposing counsel. Non digital evidence works the same way. This is why you have expert witnesses to verify or invalidate some evidence.

A better example would be real estate transactions. It would be best for everyone involved to move real estate transactions to the blockchain. I want to know that John Doe is the real owner of a house when I pay him $500k for the house. The government handles this with paper and their databases now but it would be far more efficient to do this on the blockchain.

> The example with the email in the court is a bad example because it is not the court's job to prove whether or not an email is fraudulent.

But it’s good because it is acceptable, predictable, durable, and low cost. Blockchain is solving for a problem that doesn’t exist as there aren’t a ton of fraud cases in this area (accused nor proven). So perhaps there’s an argument for the new uses that would be possible without the risk of fraud but they aren’t brought up.

Blockchain is more expensive than PKI and digital signatures so why propose it over a simple government PKI issuer? If the goal is to be useful in courts then certainly a government issuer is better as it’s trusted.

In this case blockchain is inferior to just including PKI with every drivers license, passport, and government id.

> A better example would be real estate transactions. It would be best for everyone involved to move real estate transactions to the blockchain.

Not better for the consumer who has to pay more for this new feature.

This is already done by closing attorneys and title search companies. Forcing local counties in the US to provide APIs is much more effective than a blockchain because the county deed office is the legal authority. The issue isn’t trust, the issue is assess. In a world where counties aren’t the source of truth for deeds a blockchain would be nice, although having a single, National registrar would be better. But since you have to ask the county if John Doe is the real owner, blockchains don’t help with this. A simple free, http, unencrypted, rest api is needed.

As an engineer this bugs me because these problems are better solved with technologies other than blockchain.

You've run into a person here who has confused "a blockchain would fix this" with "better systems, standards and openness would fix this, the exact implementation doesn't matter so much".

I ran into one last week talking about concert tickets. Apparently we could fix the problems of ticketmaster dominance by using a blockchain. When I proposed that an API+DB system would do the job just as well, and we have an authority in the picture already (the venue operator) so distributed trust was overkill, I was told "good luck getting ticketmaster to use your API system".

Because apparently the data-structure and trust model now dictate how the market works, and if we just chant "blockchain" loud enough, that'll magically fix monopoly issues. It's very weird thinking.

I mean, sure, if we force ticket issuing, or the land registry or whatever onto a public blockchain solution, that would address some of the issues. But the improvement comes from the forcing, not the specific tech...

I’d love to see Tickmaster’s blockchain+NFT system for how horrible and anti-user it would be.

I agree with both points. For a while it seemed like small venues were using indie $1 ticket processing services that would basically just generate a QR code and keep everything cheap. But those seem to be going away as Ticketmaster just takes over and turns a $1 transaction into a $20 transaction.

If venues just used Shopify then they’d have their db+api solution. But I think vendors like being able to 1) reduce their work, 2) blame Ticketmaster for all fees, and 3) make more money.

For the same reason vendors don’t use api+db, I don’t see them using a blockchain.

Another reason is that blockchains are forever and I don’t see the value in a huge blockchain with mostly garbage data of tickets sold 50 years ago. This seems like a really unnecessary expense for something simple like temporal transactions that are meaningless after the event.

An api+db can be flushed out so the storage costs are very low.

I'm still not convinced blockchain is a good solution here. Why is a cryptographic signature by each party that they acknowledge the transfer insufficient?

About the only arguable place is maybe escrow but the marginal increase in cost of traditional escrow vs blockchain seems insignificant vs the magnitudes of monies being discussed. Additionally, if I make a mistake and send things to the wrong account, with escrow & traditional banking I probably can unwind that transaction. With blockchain, not so much.

to me a blockchain is very similar to a cryptographic signature used in a recursive manner, meaning that a new document which is based on the previous document history includes the signatures for all those documents and signs it all in order to prove that the chain has not been tampered with.

im not at all a blockchain proponent but i really see a usecase here. but then again i see even git as a blockchain so its not that it would be expensive or exciting to get it working. (Dubai reportedly uses blockchain for their property register)

this is actually a common attack vector in countries like Pakistan were someone falsifies a stamped court document that actually the current owner of a certain property is not valid because he bought it from someone who did not actually own the property. the rightful owner is therefor me. (called qabza in urdu)

Could you share you use-case and current method? I have no advice for you I'm just interested in how this is being used and who is providing said services.

You trust those same certificate authorities every time you enter your credit card number in a web form.

That's because there were no other options. This is now another option.

Now we trust mining pools which can become monopolies instead... Everyone seems to not see the positive feedback loops somehow. It results in the same system in the end.