Comment by gremlinsinc | Hacker News Reader

Comment by gremlinsinc | Hacker News Reader

What if there were a way to create some sort of centralized/decentralized identity store... where anyone wanting access to your information would have to request it, you then supply them a 'key' to gain access...like a pgp key... they can then use your data for business purposes that you allow... you can destroy keys at will so you ALWAYS have the means to shut off a business who's abusing your information, or you could drop off the entire grid by basically revoking all keys...

This would apply to images as well with your likeness (ai-made or w/e)...though I'm not sure how you'd enforce that, unless the protocol also did facial reck/search online notifying you of images of you, that you can then force to be taken offline through legal means.

Of course there's the argument of who owns the copyright -- the person in the picture or the photographer even if they took photo w/ or without your permission/knowledge...etc...

I'm not sure how this would work in the wild, and it's just a concept idea... It would be nice though in the case of a true dystopian future to be able to pull yourself off the grid easier than it is today.

I have also pondered on variations of this idea of users _owning_ their own data and only granting access to their data to apps they trust, as a means to counter the status quo of every company holding users' data hostage in their own walled gardens and preventing data mobility between apps.

However, the one thing that I've always struggled with is how to handle apps that need write access to users' data in order to be useful. For instance, a messaging app needs to be able to write new messages onto the user-owned data store, but if we allow arbitrary reads/writes to some namespaced path to the store, an app simply needs to encrypt the data with some secret key that the user doesn't know in order to build a decentralized walled garden that stifles data mobility in the same way that centralized walled gardens do today.

Sometimes problems are better solved legally rather than technically. You could spend all year thinking of a way to prevent this or you could just have a law that states that users must have access to machine readable copies of all the data you collect about them.

To a computer there is very little you can do to distinguish between obfuscated and regular data but to a human/legal system the difference is clear.

the app would have rights to clone data locally, however certain 'fields' would source content via key from source of truth... for instance username/profile name... so that if you revoke key the content remains but the username/name on account would be redacted...similar to how reddit has content w/ a deleted_user...

That's almost what TimBL's other project does, Solid: https://solidproject.org/

Sans the encryption - it's been looked as, IIRC, but not there yet. I'm not sure whether that would actually make it easy to revoke access though; as soon as someone has a key to decrypt it, they can just copy the decrypted information elsewhere, right?

(Disclosure: I work at inrupt, TimBL's startup that exists to stimulate Solid adoption. Opinions are my own.)

This exists. https://identity.foundation/

Reply on news.ycombinator.com