Hacker News Reader

Comment by randomhodler84 | Hacker News Reader

Nah, missing the point. I’ll still stand by some web3 idea like using an NFT as some kind of license to access a service using web3 auth is a true and valid use case. It doesn’t need a monetary-like token but it does need a single record bound to an address stored eternally.

Jpeg NFTs are dumb, cos the record is public. But a singular record that can out of band handle authorizations? Neat.

View on HN

> NFT as some kind of license to access a service using web3 auth

Firstly, we have that on the web today with OAuth. It is centralised in the hands of a few companies but that's because people trust those companies. There simply is no consumer demand to allow other options but it's easy enough to do.

Secondly, the problem with the NFT approach you described is that it coerces people to use a single wallet for everything. Which goes against the best practice for crypto at the moment which is to have multiple wallets due to the many, many NFT scams that can steal your wallet. So in effect your approach trades off centralisation in one area for another. With the end user not really being in a fundamentally better position.

> It is centralised in the hands of a few companies but that's because people trust those companies.

You trust them. I don't. Now what? Are you saying I'm forced to trust them, because you do?

For every story of crypto projects going awry we can find a story of Google shutting down someone's account without any recourse, Apple abusing their App Store position to ban reasonable content (commentary on sweat shops or even mildly adult content), or Facebook accidentally toppling an entire democracy.

The reality is that these centralized systems aren't some panacea and you are frankly naive to be so happy about using them for the rest of your life.

We can play this game on the Web3 side as well.

OpenSea takes the blockchain data, filters it and augments it with their proprietary data. Which means that as a user I may buy an NFT that OpenSea is filtering and which therefore is useless on other sites.

There is nothing inherently special about blockchain that prevents centralisation or allows you to have a trustless ecosystem. At some point I will trust Metamask with my wallet, Binance for my trades etc.

Opensea can only make your NFTs useless on Opensea, that's the difference. You can still trade them on Looksrare or other marketplaces.

Metamask is the same, if you can't use it you can easily take your coins to another wallet and use them there, you just import your seed phrase.

> I’ll still stand by some web3 idea like using an NFT as some kind of license to access a service using web3 auth is a true and valid use case.

How is this different from setting up a website and requiring a password to access it?

The whole not needing an a&a database part? That’s the onchain part. You don’t need to track authz as it’s just real-time lookups on blockchain state.

Rather than maintain and protect a local set of usernames and hashes, you let anyone in who can present signature and address. Then server side you check that address has some NFT. Done. No hashes or usernames or anything.

How is that actually better? Like, what part of that makes it faster/cheaper/better?

Let’s say I’m a saas vendor that has some web product, it doesn’t need user profiles as such, just gated access. Without need to take credit card payments, one can sell a token that provides access, and know that the api to query its status is going to be stable and eternal. It simplifies a particular use case that I think works.

Couldn’t they just give them a public/private key combo and solve the exact same problem without maintaining a blockchain?

Blockchain solves the double spend problem here, without reliance on a central clearing house.

They don’t need the generate it, the user supplies it with the client side web3 wallet. They don’t need to maintain a blockchain, they can use various portable apis to query it.

You don't need to handle authorisation.

OAuth or one of many services e.g. Auth0, AWS Cognito, Okta can provide a managed service for you.

This isn't a problem Web3 is uniquely solving.

Ok now how do I do it with storage in some eternal way that doesn’t required a trusted third party. And not having to maintain any kind of session or user state mapping between my app and the oauth2 or saml provider.

Ya know, about 14 years ago something happened where we could maintain these eternal data structures with rules around state mutation. Humanity is only learning the power of such structures a decade later. There are very much unique problems being solved here and you are missing the dark forest for the legacy trees.

So how does the service authenticate the user?

User installs a browser extension (wallet) that is created by a third party that they have to trust unconditionally?

Is that what the promised land of zero trust is about? Trusting a 3rd party with all your finances?

The user can read the source code of a wallet and they know it's never going to change on them or have a service block them, and there are many options available which they can switch between at any time.

It's about user empowerment and not letting other entities have any control over any aspect of it.

Who is your theoretical empowered user? A CS major?

Reply on news.ycombinator.com