Comment by dcolkitt | Hacker News Reader

Comment by dcolkitt | Hacker News Reader

Parent Full thread

> The idea of... not having people login using Facebook/Google sounds great to a lot of us, but that needs to be predicated on system which would actually get normal people to switch by being cheaper, safer, etc. Appeals to ideological purity don't tend to get traction

But it's quite the opposite of an appeal to ideological purity. If you care about building out widespread truly decentralized cryptography, the practical results of cryptocurrency are nothing short of incredible. Because of crypto, millions of people now self custody their own private encryption keys without any dependency on centralized services. Yes, they're doing so because they want to play in a giant on-chain casino. But the same ECDSA key that secures your Ethereum wallet can also serve as your decentralized cryptographic identity.

It's hard to overstate how much of a miracle this is compared to what anyone expected 15 years ago. Hardcore cryptography engineers would joke about how even their small, highly committed community couldn't build a decentralized a web of trust with decent opsec. Now even dentists are self-custodying their crypto keys with decentralized identity powered by ENS.

Quite the opposite the only reason to dismiss this achievement is an appeal to ideological purity. The cryptography infrastructure may have been built for the "wrong reason", to gamble in the world's largest casino, but a once undreamt of decentralized infrastructure now exists.

Why would I care about building widespread “truly” decentralised cryptography?

This also sounds like idealism. And I speak as someone that works in cryptography-related spaces including PKI.

How many of those millions of people get compromised in some way, lose their ‘money’ and are then chided for poor opsec? How many don’t even bother with self-custody and just use centralised services like exchanges?

Honestly it all seems ideological.

You don't see any value to people owning their own crypto keys and identity instead of relying on a centralized party like Facebook?

I'm not even talking about digital assets. I'm purely talking about the ability of someone to sign their own emails without being dependent on a monopoly like Gmail to do it for them.

I don’t see that for most people this is any sort of enabling technology, no. In fact I think for average humans that delegation is a very worthwhile service.

Edit — And whether we agree or not, this really seems to fall into an ideological space rather than being a practical thing.

> I'm purely talking about the ability of someone to sign their own emails without being dependent on a monopoly like Gmail to do it for them.

What is blockchain adding for this usecase that's beyond what PGP [1] offers?

[1] https://en.wikipedia.org/wiki/Pretty_Good_Privacy

No.

The centralized platforms and social networks you reference have tens of millions to billions of users.

I would not be surprised at all if between all of them they do millions of password resets daily.

No matter how much the crypto community tries to force it people forget stuff and mess things up.

The concept of average users managing their own keys is DOA.

My personal project is a working case study proving the practicality of the idea. It’s not ideological and enables things you would dare do with prior existing server/client models.

> If you care about building out widespread truly decentralized cryptography, the practical results of cryptocurrency are nothing short of incredible. Because of crypto, millions of people now self custody their own private encryption keys without any dependency on centralized services.

You mean the exchanges the vast majority of cryptocurrency users rely on have control, right?

I mention that because a greater number of people already have cryptographic keys to use to assert their identity (every iOS user, most Android, and Windows Hello users) in the form of WebAuthn passkeys. Unlike Ethereum, that system does not cost money to use, is free for anyone to implement, and does not depend on a slow centralized data store being available.

One important note: ENS doesn’t in any way solve the question of identity, any more than DNS does. In both cases, they link a name to a machine id without solving the much harder problems of verifying identity or disambiguating people with the same name.

Most importantly, not conflating money with identity makes attacks harder (if I get your keys, I can compromise your brokerage account but I still have to convince them to transfer your assets) and lowers the costs of errors because I’m not pushed into having to decide whether I’m more concerned about losing access to my money if I don’t make a backup and having my money stolen because I did. That’s going to matter to their next of kin if our hypothetical dentist is run over by some SUV driver on their next bike ride.

That last part gets to back to the question of goals. Self-hosting cryptographic keys isn’t a goal anyone has for non-ideological reasons. People care about things like communicating privately and not being impersonated, and will gravitate to the systems which make that safe and easy. Cryptocurrency projects haven’t delivered on either of those so far and since they inevitably depend on real-world systems to handle identity or resolve disputes, it’s hard to offer a compelling reason to pay the extra cost to use them.

Going back to my hypothetical person at a non-crypto business, he goes to his boss and says “we should have our customers login using self-managed private keys”. When she says “how does that make us more money?”, what’s the answer?

Reply on news.ycombinator.com