Hacker News Reader

Comment by ijpsud | Hacker News Reader

I was talking about this with a friend the other day. I don't know about the technical feasibility (RE sybil attack[0]), but if it were possible, it would have a massive impact on the web. The current state of the art (in terms of new user signup) is using phone numbers as representing unique "trustable" people, which is kind of absurd.

This reminds me of how social security numbers weren't originally intended to be used as unique identification, but the demand for some form of identification was so strong that organisations ended up hackily using it anyway.[1]

[0] https://en.wikipedia.org/wiki/Sybil_attack

[1] https://www.youtube.com/watch?v=Erp8IAUouus

View on HN

Just post a bond that is forfeited if you engage in verifiable abuse, the proceeds of which are used to compensate the victims (if applicable). Use pseudonymous identity to link any number of site-specific "identities" to that same initial posting. Real-name identity can then be optional (although some sites may still insist on it), but users in good standing are protected from "sybil" attacks because each entirely-new user requires posting a separate bond, so the cost quickly becomes infeasible.

I naïve reading of your solution implies that the poor wouldn't be able to put up such a bond and would therefore be excluded from this techno utopia - where the rich would be able to create Sybil's and game systems all day long.

Posting bonds might be part of a solution, but there is still a question of who gets to decide whether or not something is abuse (or who is a victim, for that matter). The closest I've seen to this sort of system is OpenBazaar's use of "proof of burn":

https://openbazaar.org/blog/why-proof-of-burn/

> but there is still a question of who gets to decide whether or not something is abuse (or who is a victim, for that matter)

In principle, all you need is a trusted arbitrator that's acceptable to all involved parties. This is how "multiple signatures" work on Bitcoin already; the third-party escrow can decide who's going to keep the coins by adding her signature to either party's claim.

This doesn't solve the problem of identity. You still would need some way of differentiating the accounts with the bond, or else I can just sybil the system by having a lot of money and a really good way of impersonating people.

Hot take, but the only real way to solve this identity problem is to take people's DNA. The only attack on that is to literally synthesize fake DNA/fake hair/fake saliva. Even then you can prompt randomly for DNA the way Twitter randomly prompts for phone number verification. Or ask the user for a selfie and spot inconsistencies in the mapping from DNA to face.

It's scary to let internet companies have your actual DNA (though that didn't stop 23andme customers), so there could be an layer in between (a nonprofit? machine with a hardware security module?) that does the DNA sequencing and returns a digital signature to authenticate you.

The obvious downside is that it would work too well. Banning becomes much more serious of a thing when it's lifelong and potentially could affect your descendants. I hope I'm not giving anyone any ideas because this is horrible.

Even DNA wouldn't work because of weird shit like chimerism. Our classic assumptions about this stuff just don't hold in reality.

Reply on news.ycombinator.com