4 ms·

They use the email example, but if Google bans me, my identity is also banned and that may be how people contact me. We also need decentralized identity so my

They use the email example, but if Google bans me, my identity is also banned and that may be how people contact me. We also need decentralized identity so my identity can exist independently of service providers, but still be owned by me and not an impersonator.

paulddraper 7mo ago
That exists in the form of domain names. Which for reputable TLDs is permanent, outside illegal activities.
- watermelon0 7mo ago
  Country code TLDs are also reputable, but you might lose access if you move or if something happens to the country.
wilg 7mo ago
atproto has a very elegant decentralized identity solution imho https://atproto.com/guides/identity https://atproto.com/guides/identity
- vvpan 7mo ago
  Atproto identity is going in the right direction but I hope they go in that direction harder. For example plc.directory (maps DID to public keys I think?) is heavily centralizing force.
voxic11 7mo ago
You can use a custom domain that you own with gmail. But of course domains aren't that great either as they are only somewhat decentralized and it's still pretty easy to lose your domain.
Seattle3503 7mo ago
Identity is "infrastructure" government should provide via something like mDLS. A lot of work needs to go into make sure it is secure and it can be used in a way that protects privacy. Eg selective disclosure of attributes for verifying age. Pairwise pseudonyms for identity when your online identity doesn't need to be tied to you real identity, which is most of the time. Something like that would go far in dealing with sybil issues in decentralized systems, which is often the source of a lot of headaches for system designers.
- drdaeman 7mo ago
  Only as a last resort. If possible, governments, just like any other organizations, should have absolutely no say about anyone’s identity. They (like any other entity) can attest, but such attestation should hold as few of any special value as possible.
  - Seattle3503 7mo ago
    We've seen ~20 years of people trying to solve identity without the government. We've seen plenty of solutions that can provide stable identities over time, but we haven't really seen anything that provides meaningful sybil resistance. As computer systems become more and more "autonomous", sybil resistance is increasingly the most important feature of any identity system. Any identity system that doesn't solve that problem pushes to the application layer, where it usually has UX impacts that have serious tradeoffs with adoption.
    - drdaeman 7mo ago
      I understand this. I also understand that if history teaches us anything it’s that any centralized governance (of any nature, not just traditional national and regional governments, but any centrally organized communities, like corporations) is to be constantly distrusted and kept in check, and even then it’s dangerous to let it take over social functions. That’s why I wrote “only as a last resort”, that is, unless and until someone thinks of something better. (And then switching over is another issue… that may need some pre-planning even better new solution exists.) Or maybe someday we’ll have some interesting revelations about personal identity and sybil resistance won’t be necessary. But that’ll probably be only some centuries later.
      - Seattle3503 7mo ago
        To be clear, all we need from the government is to establish a person really exists and verify basic properties. We don't need more than that, so we can and should use all cryptography at our disposal (and invent more) to prevent any more information disclosure to both services and government. I get that identity is a sort of last holdout for the tech libertarians of old. But after years working in KYC, what I saw was the accumulation of vast amounts of sensitive information held by private actors in a way that was completely democratically unaccountable and couldn't be corrected by the average citizen. It's time to bring identity out of the shadows and make it ours to control.
jrm4 7mo ago
So, (especially after watching Bluesky / ATProto) I'm increasingly convinced that this is not a problem that needs solving. Email is still a protocol, and the thing that ATProto is doing causes as many problems as it purports to solve. Mostly because "decentralized identity" is still "identity." And the safest way to do identity is to have it be destructable and remakable on the fly.
- cortesoft 7mo ago
  > And the safest way to do identity is to have it be destructable and remakable on the fly. It might be the safest, but it defeats lot of the purpose of identity. There is a reason it is a hassle to change your email address... so many services are tied to that identity. You can change it, but you have to change every service that is relying on it as your identity, and you still have to own your old email so you can prove to the service that you are the same person. I am not sure how you could ever avoid this problem? The purpose of an identity is to be able to tell that one request is made by the same person who made a previous request... persistence is a requirement.
  - jrm4 7mo ago
    Yes. And as much as I hate "well, users should just be smarter and deal with inconvenience," I think it may fit here. Identity is always hard, and I strongly doubt there is any great way that makes it "easier" and still safe. Aka, yes please kill passkeys, or at least be super upfront and informative. "When you use passkeys, you are giving your keys to Apple or Google, and they cannot guarantee safety."
    - iamnothere 7mo ago
      It may be that different types of identity are preferable for different use cases, rather than converging on a single system. > "When you use passkeys, you are giving your keys to Apple or Google, and they cannot guarantee safety." Not true with hardware passkeys, which also add a true second factor. Central passkeys are a problem, though.
vvpan 7mo ago
The underlying problem to both protocols and non-protocols is identity. Gmail works because Google owns the identity and acts effectively as a proof of humanity. To go on a tangent - I think that more people having personal public key pairs (via crypto) than ever is actually a positive direction. Atprotocol is another big player in identity at the moment, just as long as "can't be evil" mechanisms are kept alive and have good UX.

paulddraper 7mo ago

That exists in the form of domain names. Which for reputable TLDs is permanent, outside illegal activities.

watermelon0 7mo ago
Country code TLDs are also reputable, but you might lose access if you move or if something happens to the country.

wilg 7mo ago

atproto has a very elegant decentralized identity solution imho https://atproto.com/guides/identity https://atproto.com/guides/identity

vvpan 7mo ago
Atproto identity is going in the right direction but I hope they go in that direction harder. For example plc.directory (maps DID to public keys I think?) is heavily centralizing force.

voxic11 7mo ago

You can use a custom domain that you own with gmail. But of course domains aren't that great either as they are only somewhat decentralized and it's still pretty easy to lose your domain.

Seattle3503 7mo ago

Identity is "infrastructure" government should provide via something like mDLS. A lot of work needs to go into make sure it is secure and it can be used in a way that protects privacy. Eg selective disclosure of attributes for verifying age. Pairwise pseudonyms for identity when your online identity doesn't need to be tied to you real identity, which is most of the time. Something like that would go far in dealing with sybil issues in decentralized systems, which is often the source of a lot of headaches for system designers.

drdaeman 7mo ago
Only as a last resort. If possible, governments, just like any other organizations, should have absolutely no say about anyone’s identity. They (like any other entity) can attest, but such attestation should hold as few of any special value as possible.
- Seattle3503 7mo ago
  We've seen ~20 years of people trying to solve identity without the government. We've seen plenty of solutions that can provide stable identities over time, but we haven't really seen anything that provides meaningful sybil resistance. As computer systems become more and more "autonomous", sybil resistance is increasingly the most important feature of any identity system. Any identity system that doesn't solve that problem pushes to the application layer, where it usually has UX impacts that have serious tradeoffs with adoption.
  - drdaeman 7mo ago
    I understand this. I also understand that if history teaches us anything it’s that any centralized governance (of any nature, not just traditional national and regional governments, but any centrally organized communities, like corporations) is to be constantly distrusted and kept in check, and even then it’s dangerous to let it take over social functions. That’s why I wrote “only as a last resort”, that is, unless and until someone thinks of something better. (And then switching over is another issue… that may need some pre-planning even better new solution exists.) Or maybe someday we’ll have some interesting revelations about personal identity and sybil resistance won’t be necessary. But that’ll probably be only some centuries later.
    - Seattle3503 7mo ago
      To be clear, all we need from the government is to establish a person really exists and verify basic properties. We don't need more than that, so we can and should use all cryptography at our disposal (and invent more) to prevent any more information disclosure to both services and government. I get that identity is a sort of last holdout for the tech libertarians of old. But after years working in KYC, what I saw was the accumulation of vast amounts of sensitive information held by private actors in a way that was completely democratically unaccountable and couldn't be corrected by the average citizen. It's time to bring identity out of the shadows and make it ours to control.

jrm4 7mo ago

So, (especially after watching Bluesky / ATProto) I'm increasingly convinced that this is not a problem that needs solving. Email is still a protocol, and the thing that ATProto is doing causes as many problems as it purports to solve. Mostly because "decentralized identity" is still "identity." And the safest way to do identity is to have it be destructable and remakable on the fly.

cortesoft 7mo ago
> And the safest way to do identity is to have it be destructable and remakable on the fly. It might be the safest, but it defeats lot of the purpose of identity. There is a reason it is a hassle to change your email address... so many services are tied to that identity. You can change it, but you have to change every service that is relying on it as your identity, and you still have to own your old email so you can prove to the service that you are the same person. I am not sure how you could ever avoid this problem? The purpose of an identity is to be able to tell that one request is made by the same person who made a previous request... persistence is a requirement.
- jrm4 7mo ago
  Yes. And as much as I hate "well, users should just be smarter and deal with inconvenience," I think it may fit here. Identity is always hard, and I strongly doubt there is any great way that makes it "easier" and still safe. Aka, yes please kill passkeys, or at least be super upfront and informative. "When you use passkeys, you are giving your keys to Apple or Google, and they cannot guarantee safety."
  - iamnothere 7mo ago
    It may be that different types of identity are preferable for different use cases, rather than converging on a single system. > "When you use passkeys, you are giving your keys to Apple or Google, and they cannot guarantee safety." Not true with hardware passkeys, which also add a true second factor. Central passkeys are a problem, though.

vvpan 7mo ago

The underlying problem to both protocols and non-protocols is identity. Gmail works because Google owns the identity and acts effectively as a proof of humanity. To go on a tangent - I think that more people having personal public key pairs (via crypto) than ever is actually a positive direction. Atprotocol is another big player in identity at the moment, just as long as "can't be evil" mechanisms are kept alive and have good UX.