Comment by georgelyon | Hacker News Reader

Comment by georgelyon | Hacker News Reader

This is an excellent write-up, and I genuinely hope that the brain-cycles the web3 world is spending on this eventually benefit the rest of society.

I’ve been musing about a similar but more simple problem: how can we prove we are an individual human in the context of a web service. Think of this like the ultimate CAPTCHA where not only can you prove you are human but every person can do so at most once or, more pragmatically, O(once).

The closest thing we have in society today is Sign in with Apple, where you have a delegated identity provided by a company which has effectively put up a large portion of its brand value as collateral that it won’t be shady, for some definition of the term “be shady”. This is suboptimal for a number of reasons, not least of which is that they can be compelled by a government to divulge this data while (mostly) protecting their brand-value-collateral, and they can be selective in what types of services are allowed to use this system.

I’m hopeful some of the non-charlatan web3 folks can come up with some sort of scheme where a trusted entity (a government or a civil rights oriented NGO) can participate in a cryptographic handshake with an end user and a service where at the end the service receives a unique identifier for that user which can not be used to associate that user across services, or divulge to the trusted entity which services a particular individual is using. This wouldn’t fully solve the “can I give this person a loan” problem, but would make many things on the web much better (most bots pretending to be human would become cost prohibitive). I also feel like trustworthiness attestation can be incrementally built on such a system (if such a system is possible).

In Iceland we already have digital identity from a centralised authority. I log into my bank, health service, sign papers (including loans) and so on with a government managed digital ID. So this isn’t even something that needs invention let alone by web3.

The tech world will start making more sense when you realize that a large chunk of tech is created because of US hyperindividualism and lack of trust in other people so folks keep trying to create tech solutions for social problems they consider intractable (several of which don't even exist in other developed countries).

Purely tech solutions for social problems generally don't work and frequently create more social problems.

But does it allow you to anonymously prove that you are a human? You don't want to go telling random websites who you are.

No one says this can't be done. In fact, it's explicitly mentioned in the essay, that the problem this approach has is that it's centralized and you typically can't use it as an anonymous proof of humanity, or disclosing information selectively.

So, why is this important? Well, while you can still make a website and trust you won't be popular enough to become a target, the truth is that without proof of uniqueness / humanity, many services and systems can't be put to the service of the people without potentially falling into an insane battle against spam, in protection of user data, in protection of privacy, etc. And while you can absolutely build lots of things without giving a shit about all this and actually be successful, it's simply immoral (and progressively becoming more and more legally restricted). If this was a solved problem, digital services could finally become truly democratized. Nowadays, this is the main issue preventing many programmers from setting up useful services, very often intended to serve the local community, requiring us instead to start a whole company, getting in touch with some lawyers and storing user data like their actual state IDs. Which we can't do if we don't intend to monetize the service! Without this barrier, we could really do a lot more for our local communities in the digital space.

What sort of digital services are you thinking of?

In a local context, many kinds of "social networks" or spaces to share things with other people from the same area, specially related to art and culture. Also many local associations organizing events could use unique identities to make it easier to make reserves for events with food, races, slots in talks, concerts, etc. Many other kinds of specific applications are also possible. You could even organize games and augmented reality activities much more easily if people didn't have to create accounts for everything, we had an easy way to verify that a human is trying to use the service... and even more if we could verify some info like "this person is from this area" (though there are some workarounds for that). Mostly, use tech to reivindicate public space, which public administrations have a tendency to mismanage as if it was their own private space (lack of vision is typically also an issue). There are many other ways to do similar things, but that's what I had in mind when I talked about democratization.

This reply hits the nail on the head, but I’ll just add that this isn’t only a benefit to small scale services. I’ve been at well funded startups and medium sized companies where we spent quite a bit of time and effort dealing with spam and bot activity, to the point of making trade offs in the product to lower the impact of bad actors. Even companies that are more or less successful at this spend a TON of money and engineering resources on this problem, and it still manages to detract from the UX (think Twitter bots). I wouldn’t be surprised if the economic benefit of a technical solution to this problem was on the order of tens of billions of $$.

I mean, client side TLS certificate support goes back to the netscape days. Not like its a new idea on the web.

Having to identify yourself to every website ever does sound dystopian (albeit there are cryptography (the old fashioned type not botcoin) solutions like blacklistable anonoymous credentials.

I would say https://privacypass.github.io/ is a lot closer than "sign in with apple"

See also crypto papers on blacklistable credentials, e.g. https://www.cypherpunks.ca/~iang/pubs/blacronym-wpes.pdf

Reply on news.ycombinator.com