Hacker News Reader

Comment by throwme_123 | Hacker News Reader

This problem, namely bazillions of ways to get auth wrong, is solved by Web3.

I really don't get why everyone here hates it.

Edit: Yes, I meant that login is tied to your wallet. This can be a hardware wallet, so it's very difficult to have it attacked, can be backed up, never expires, etc. This auth mechanism removes _tons_ of problems with existing web sites & giant corporations. But I guess most of you work for them, so have fun mocking people who are not like you :)

View on HN

> solved by Web3.

To the extent that web3 is even well defined, no it absolutely doesn't. The blockchain space right now is rife with scams and people getting stuff stolen from their wallets. At best it makes it harder for the average user to understand how to be secure and at worst it changes this scenario from "I lost my facebook account" to "I lost control of every asset I own and my entire identity".

It would be helpful if you were to explain why Web3 would be beneficial here instead of just tossing snark towards HN.

It'd also be useful for them to define what they mean by Web3 in this context.

metamask with login with wallet, i assume, is what they mean.

Like pretty much everything else involving blockchain there are more straightforward ways to solve the problem without all the BS.

yeah for auth is a blockchain even required? it's pretty much just asymmetric crypto at that point isn't it?

I think the 'web3' way would make it worse wouldn't it? like metamask relying on centeralized service to query the blockchain

I guess a real benifit I could see would be being able to use a blockchain to revoke your keys somehow but that's not how metamask and web3 stuff seems to work right now

Metamask can sign data, which would help you prove the user has the private for a given public key. You do not need the blockchain.

The chrome extension to cryptography would help - but we have FIDO that does exactly that (and webauthn i guess).

Indeed that is possible, the problem is all the greedy corporations that want to suck all our data, so they can't simply trust the signed messages of Metamask and want instead to implement layers of poor software for their profit

oh i mean, identity/authentication alone doesn't make profit right?

The problem with using PK cryptography is that if you lose your keys, you'd be locked out.

Then we would probably have other key schemes M-of-N etc or social proof to compensate for the problems with single-key PK, which then has other problems.

Metamask relies on whatever RPC you give it, including your own node if you want

The asym crypto is enough for proper authentication, but decentralized apps generally are built to use it, without relying on centralized data. A message signature being verified by a stateless service is all that is required

Could do without web3, but the practice of predatory web giants and smaller startups is to exploit the users so they don't do that

The BS makes it a more sticky though.

If your entire life (identity and finance) is gated by a single password, a user will Care more and that makes it easier to use and remember.

In other words, having your wallet behind the same password supports adoption.

> I really don't get why everyone here hates it.

Partly because comments like this.

Thanks for being helpful.

All the web3 or crypto hate if you prefer is a very strong bias in this site. There are no real arguments, just that it is a scam or whatever. Is asymmetric crypto a scam? Is Leslie Lamport an idiot and nobody needs decentralized computing?

Please enlighten me

You just name dropped web3 as a solution without having any explanation about how and why exactly would it help and now you are complaining I'm not being helpful? You serious?

Not really. People have their cryptocurrencies stolen all the time from similar problems.

https://fabricegrinda.com/hacked-cryptocurrencies-stolen/

https://krebsonsecurity.com/2020/11/godaddy-employees-used-i...

https://therecord.media/two-cryptocurrency-portals-are-exper...

https://cryptonews.com.au/godaddy-website-hack-leaves-defi-p...

https://news.bitcoin.com/hackers-compromise-web-portal-bitco...

https://www.engadget.com/2018-04-25-hackers-dns-phishing-sca...

The problem here is that the user had their own domain and lost it. Obviously the analog here is having their own wallet and losing it, in which case they're probably more screwed rather than less.

Run out of time is a little more accurate, and a failure mode that Cannot Happen with crypto, though. Steps can be made to make your wallet impossible to lose, but not your domain.

Wallets do not expire

Technically true, but if you lose your key and don't have a backup, or forget your password, you're stuck; there's no recovery process (except brute force, which doesn't work on secure passwords), by design.

Reply on news.ycombinator.com