Hacker News Reader

Comment by JimDabell | Hacker News Reader

> So I think we will need a different detection mechanism. Maybe something from the real world, some type of ID, or even micropayments. I'm not sure, but it's clear that bot detection is at the opposite, and currently losing, side of the AI race.

I think the most likely long-term solution is something like DIDs.

https://en.wikipedia.org/wiki/Decentralized_identifier

A small number of trusted authorities (e.g. governments) issue IDs. Users can identify themselves to third-parties without disclosing their real-world identity to the third-party and without disclosing their interaction with the third-party to the issuing body.

The key part of this is that the identity is persistent. A website might not know who you are, but they know when it’s you returning. So if you get banned, you can’t just register a new account to evade the ban. You’d need to do the equivalent of getting a new passport from your government.

View on HN

But this mean that now a saas baning you from your account for spurious reason can be a serious problem.

You could roll a new id to replace the previous one. Each user would still have only one at a time. If this isn't acceptable a service may ask to have the feature disabled for clear mission critical reasons and/or a fee.

That’s the point. Bans should be effective.

I get it. And also, I know that Apple and Google would abuse that, and destroy lives and businesses as casually as I eat my breakfast. Then 1000's of disposable companies would pop up with valid id, and abuse some system (like terrible DMCA) and make it worse.

If you think people self-censoring themselves on social media is now a problem (the "unlive" novlang is always such a dystopic hint to me), you have seen nothing.

Businesses should not be forced to serve abusive users. They should have the choice to refuse to serve somebody permanently. You do not have the right to use somebody else’s service without their permission. If they want you off their platform, they should be able to do so.

The whole point of having trusted issuers is that there aren’t any “disposable companies” who hand out many identities in an uncontrolled manner. If there were, they would quickly become untrusted, making the IDs worthless.

Why is it the responsibility of the customer and the government to enable a business model someone wants that doesn't work well otherwise? Like I agree with some of your sentiment but where does this end? Anyone can come up with any untenable business model and then the government should intervene to make it work the way they want, at the citizens expense? I doubt that's your point and I'm not trying to put words in your mouth but what's the difference here? "I should be able to control people on the internet better" doesn't feel like a thing we should all collectively bend over to enable.

> Anyone can come up with any untenable business model and then the government should intervene to make it work the way they want, at the citizens expense?

> I should be able to control people on the internet better

This is so twisted out of all proportion I find it difficult to believe you are being genuine.

A government giving an ID to somebody is not propping up “an untenable business model”.

Saying “I don’t want you to access my service” is not “controlling people on the Internet”.

If you are a monopoly like youtube or the apple store, with a "winner take all" market, and your conditions are abusive, I hope you can see this is a problem.

E.G: youtube has a disproportionate share of the attention market, therefore can control what people think, and they are heavily influenced by big companies that will tell users what they can say or not on the platforms.

Your account on youtube is linked to your phone, emails, photos, calendar... So do something that one of those companies don't want you to do because it's not profitable for them,

And of course, they change the rules of the time.

That's why I don't have a google account. But most people are not capable of such insights, they don't have the knowledge to realize how much they can be screwed.

> If you are a monopoly like youtube or the apple store

What happened to this being a case of the government propping up an untenable business model?

You don’t have a solid view point, you’re just saying whatever springs to mind that disagrees with what I say. This isn’t a genuine conversation, you’re just arguing for entertainment. I’m out.

https://www.wired.com/story/worldcoin-sam-altman-orb/

Yup, Worldcoin has been the one of the efforts in this space. We're trying to have a frictionless, less privacy-invasive method than biometric scanning

Do you work for Worldcoin?

That is the silicon valley cryptoscam version.

This concept has been studied already extensively, e.g [1] (in 2000!) by people like Rivest and Chaum, who have actual decade-old competence in that field.

[1] https://people.csail.mit.edu/rivest/pubs/pubs/LRSW99.pdf

Or just charge bots and humans and we're good to go

https://www.nytimes.com/2006/02/05/technology/postage-is-due...

While that works for attacks that are like spam, bot detection for high margin attacks like show ticket scalping really wants an identity-oriented solution.

Ah yes, postage has stopped all the spam coming to my house!

This is an extremely ignorant take. It's extremely well-known that one of the primary ways you stop spam is by making it economically infeasible, specifically by making the cost of distribution higher than the expected return. It's also extremely well-known that spam snail-mail is subsidized by the US post office and doesn't pay normal post rates.

> Say something everyone lives everyday around the world. > "This is an extremely ignorant take."

I think worldcoin added this year (?) identification using government e-passport as well (not only orb) - all modern passport have NFC/RFID chip, you won't get all data from that in public way but can verify signature and can get basic information. There are already apps in appstore doing that.

It also allows automated software to act on behalf of a person, which is excellent for assistive technologies and something most current bot detection leaves behind.

I think this will be a positive effect of the rise of AI agents. We’re going to have a much different distribution of automated vs human traffic and authentication/methods will have to be more robust than they are now

On the one hand, yes, this might work, but I'm concerned that it will inevitably require loss of anonymity and be abused by companies for user tracking. I suppose any type of user identification or fingerprinting is at the expense of user privacy, but I hope we can come up with solutions that don't have these drawbacks.

The benefit of majorly reducing fraud can create an ecosystem where the trade off is worth it for users to take. For example generous free plans or trials can exist without companies needing to invest so much in antifraud for them.

> I'm concerned that it will inevitably require loss of anonymity and be abused by companies for user tracking.

Are you sure you read my comment fully?

> trusted authorities (e.g. governments)

the governments powerful enough to roll something like this out are not trusted authorities which will protect the privacy of their citizens. remember before the Snowden revelations when the NSA's director of national intelligence swore under oath that they did not collect "any type of data at all on millions of Americans"?

https://en.wikipedia.org/wiki/James_Clapper#Testimony_to_Con...

Ultimately trust must be placed in an entity of some type. A democratically elected body isn't perfect but I can't think of a better option. If the electorate don't care about digital privacy or elected lawmakers do not protect their rights, then that needs to be addressed first. Governments have a monopoly on violence. If a citizen can't trust their government to enact (or enact but then not follow) laws that protect human rights, they frankly have much bigger problems to solve.

Part of solving that problem is to make it expensive for governments to violate human rights. If spying on everyone is easier than targeted spying, they'll spy on everyone. Governments have a lot of different priorities and it's not always easy to balance them.

Online identity verification is probably best handled by an organization with that as a single priority.

Under the government ID scheme, we have to trust [bad corrupt government] to verify all citizens of [bad corrupt government]. Since that government frequently lies and acts maliciously using every means at their disposal, platforms will treat IDs verified by that government similar to bot traffic and the country will be cut off from the public internet. You'll be banning scientists and journalists from working with others around the world, just because they live in a country with an obnoxious government.

Isn't it also best if people can have multiple identities? Or should someone's contributions to X field be discounted because of their dabbling in fringe Y field?

> the governments powerful enough to roll something like this out are not trusted authorities which will protect the privacy of their citizens.

The trust I mentioned was the ability for third-parties to trust that the authority will not hand out IDs in an uncontrolled manner. I was not saying that the ID holders need to trust the authority:

> Users can identify themselves to third-parties without disclosing their real-world identity to the third-party and without disclosing their interaction with the third-party to the issuing body.

If the authority doesn’t know how your ID is used, you don’t have to trust the authority to keep that information private.

I did. It doesn't matter that the website might not be able to directly associate a real-world identity with a digital one. It takes a small number of signals to uniquely fingerprint a user, so it's only a matter of associating the fingerprint with the ID, whether that's a real-world or digital one. It can still be used for tracking. By having a static ID that can only be issued by governments or approved agencies we'd only be making things easier for companies to track users.

This sounds like a red herring to me.

If the only way to associate a user with their ID is by fingerprinting them, you can do the same thing without an ID with having shadow profiles. If the proof system is designed for privacy, the ID doesn't make you more trackable.

In other words, if the ID never directly leaks companies can just make up a static ID for you and get the same results.

Kind of. A fingerprint is an implicit ID, whereas the ID suggested by GP would be semi-permanently associated to an individual. So it would make tracking even easier, since most web sites outside of adtech don't bother with sophisticated fingerprinting. It would be similar to a tracking cookie, except the user would have no control over it.

> the ID suggested by GP would be semi-permanently associated to an individual

There is a permanent ID, but it doesn't have to be told to the site.

In which case it doesn't make tracking any easier than the site making up a "fake" ID for you.

> It can still be used for tracking.

This doesn’t make sense. The whole point of using IDs in this way is in an authenticated context.

Did you think I was suggesting that this ID would be accessible to any website without asking? This is something you would send as part of a registration step. So, for instance, if you spam Hacker News, you get banned, you try to register again, it receives the same ID as before and knows not to let you register.

Every website would just move on to force people to register. That's already happening - good luck browsing public posts on Twitter/X.

Again, this is a mechanism for making existing auth more resilient.

As you note, websites can already force people to register, so this isn’t adding anything new there.

If this gets implemented, the next thing the govt will do is require all websites to store DIDs of visitors for at least 10 years and not accept visitors without them.

This makes no sense at all. If a government wanted to pass a law to force logins and track people, they could do that today without using an identifier that is worthless for that purpose.

I have not heard about DIDs at all before. How does this really work? They are Government-issued? I am not sure I would trust that though.

I have to ask the government for a roided up tracking cookie?

Hell. No.

Reply on news.ycombinator.com