Hacker News Reader

Comment by hanniabu | Hacker News Reader

Web3 offers digital identities owned by the user.

I would offer that Web3 assumes that there are digital identities owned by the user, typically by proving control of a private key.

It doesn't really solve any of the traditional usability problems of maintaining a private key, which is why so many users end up just signing up for a website that will handle it for them.

Specifically the issues that come to mind are key recovery and rotation.

At least there is the prospect of full control by the user.

"Full control" by being forced to engage with a protocol they never designed in order to authenticate their own existence? That sounds more like full submission to me.

Only as long as enough others are in on the idea.

I.e MyAwesomeBlockchain can be totally awesome but since no one uses kt it is useless.

This will be the fate of well over 90% of the block chains that exist today I think. In fact I guess more than 90% of them.

What amount of personal hardware resources does a person need in order to have "full control?"

Is there a way to guarantee that a user maintains "full control" over their identity as opposed to having it be stored on a 3rd party site?

What would a 3rd party site that is operating less than trustworthy (a not uncommon situation in the web3 world) way be able to do with an identity that they hold in trust for someone who doesn't possess the consistent access to the previously mentioned hardware resources?

If your only computing device is your phone and someone steals it, do you lose your identity?

In the event that your house burnt down and all of your computing resources have been destroyed, is there a way to attest to be able to recover your identity?

In the event that your evil twin decides to burn down your house, what mechanisms exist to prevent them from claiming your identity?

Read up on account abstraction: https://blog.jarrodwatts.com/what-is-account-abstraction-and...

https://twitter.com/DefiIgnas/status/1633626349226319872

> 5/ Account abstraction is a huge breakthrough for crypto self-custody.

> It enables:

> • Create & restore a wallet with an email or a phone number

> • 1-Click transactions

> • App pre-approvals & limits

> • 2FA protection

> and much more.

Web3 offers digital identities owned by the type of strategy the blockchain uses.

Do you use Bitcoin and tomorrow Venezuela buys up 51% of global hashing power? Your identity is now managed by Venezuela, have fun

Yeah I am bearish on the web3 identity space because it’s chain infected. They are attacking the right problems but IMO not deploying the right solution. Just allow self-signed identity not backed by a chain.

Self signed identity is meaningless, especially online

How does putting your ID on a chain or even having an identity provider vouch for it change anything? By your logic being a human is meaningless because anybody can do it.

Self-signed identity means you own a private key. Being a human means you own a body. You can call yourself whatever you want in meatspace. People deal with it. You can sign whatever statements you want in cyberspace. If you need to verify that someone has passed a driving test, then yes you need an authority to issue a certificate (or whatever better tech you choose) saying this private key met these requirements.

There's no inherent problem with the identity being self-signed if you just need a user-id.

Identity cannot be self-signed. "Self signed identity" as you call it is just a pseudonym. Anyone who has access to your private key can post with your "identity" and there is no way for checking fraudolent usage. If you see two instances of an account signing something with the same private key you cannot say that those two actions belong to the same person. You can only say that those two actions were performed by some entity which knows the private key. It could be the righful owner, it could be a hacker, it could be a bot.

On the other hand, a real ID check makes sure with a high degree of certainty that the person is actually the same one who performed other actions (was born, purchased a home, has money, etc.)

I can use a pseudonym in real life. Nobody is "hard checking" my identity 99% of the time. Not even the government. They don't care if someone else does my taxes. It's up to me to share details about my identity with my tax accountant as I see fit. About the only institutions that actually care are banks because they don't want to give my money to someone else and airports because they don't want 9/11.

So yes, you can have self-signed identity. And you can use it 99% of the time. If you need government-level identity verification, you can build that, do the hard check, and link to a self-signed identity by issuing a certificate for a reasonable amount of time until a re-check is desired. Your drivers license is exactly that in physical form. I'm not saying we shouldn't have a digital DMV that issues digital drivers licenses. I'm saying you don't need that as the foundation of your identity system. Identity is self-sovereign by nature. Don't fight it.

As far as I know, DIDs don't have to be "on chain".

If DIDs are just a self-signed document format/spec for what the fields look like and how to handle/process one and how to attach signed assertions then great! That's all we need. I thought the idea was you'd publish your identity to a chain and the chain would "ratify" it or something. That part seems unnecessary.

Why is Ethereum not the right solution?

Nothing is happening on Bitcoin anymore. Bitcoin is not web3. Everything interesting happening is on Ethereum.