Hacker News Reader

Comment by UncleMeat | Hacker News Reader

> The same account could be used by multiple independent services and this removes the need for a signup process altogether.

This is only marginally better than SSO with Google/Apple/Facebook/whatever. It dodges the "Google closed my account" problem, which is a meaningful improvement. But I'm not fully certain why you need the public key to be part of a blockchain for this to work. Couldn't you just publish your public key identity on any number of considerably less wasteful systems? As far as I can tell, the only advantage here is the mapping between the name "UncleMeat" and my public key would be able to be reused across services... but in so many cases I don't want my identity to be consistent across services.

View on HN

- Resistant to centralized censorship (as you pointed out)

- It allows you to use the same passphrase for all services without compromising security since your passphrase never needs to leave your own machine; it is never sent over the wire. You just send signatures to different services.

- The cost associated with purchasing tokens needed to initialize an account on the blockchain would serve as a spam prevention mechanism; an alternative to SIM cards which most centralized services rely on today as a cost barrier to limit the creation of spam accounts.

- Superior integration potential between different services/systems provided by different companies/groups since they can all refer to the exact same account on the same blockchain and provide new ways to unify data between the different services.

> Resistant to centralized censorship (as you pointed out)

I'd wager that most people don't care about this much, though it is real. Still, this can be achieved with signature-based authentication that doesn't require the tremendous waste of BTC. Just... tell the service your public key and sign a message when you sign up. Your key pair doesn't need to be associated with some distributed system for that to work. This has been around for decades and not exactly caught on.

> It allows you to use the same passphrase for all services without compromising security since your passphrase never needs to leave your own machine; it is never sent over the wire. You just send signatures to different services.

This is true for all signature-based authentication, which does not necessitate a blockchain.

> The cost associated with purchasing tokens needed to initialize an account on the blockchain would serve as a spam prevention mechanism; an alternative to SIM cards which most centralized services rely on today to limit the creation of spam accounts.

This sounds like an anti-feature to me. Especially since it'd be foolish for a service to only support authentication via a blockchain. Imagine telling my grandmother that she needed to buy some btc in order to sign up for the service that hosted my wedding photos.

>> This sounds like an anti-feature to me. Especially since it'd be foolish for a service to only support authentication via a blockchain. Imagine telling my grandmother that she needed to buy some btc in order to sign up for the service that hosted my wedding photos.

This is different because your grandma would have to buy the tokens once and signup once and she will have access not only to the 'wedding photo service' but a large number of other services. It's more like paying a small amount of money to get access to an ecosystem of services. Like how people pay money to buy an iPhone and this gives them access to the Apple App Store and all the apps therein.

There will also be network effects associated with the blockchain price going up with adoption. People who signed up early to the right blockchains will have priority access to certain software ecosystems and exclusive services which are only accessible to the richest among them (for example).

> People who signed up early to the right blockchains will have priority access to certain software ecosystems and exclusive services which are only accessible to the richest among them (for example).

This seems even more like an anti-feature TBH. Imagine not being allowed to use the future equivalent of basic services because you were not "early enough". Sorry grandma, no wedding photos for you because you didn't buy these specific three coins out of the thousands started every month.

I cannot possibly imagine a world where services will choose to only permit authentication via some expensive blockchain such that they deny themselves access to markets outside of the global rich.

And telling my grandma "don't worry, the coins you don't understand will go up in price" is not going to help.

This is the core question: why is signature-based authentication using public keys associated with BTC wallets superior to signature-based authentication using public keys not associated with BTC wallets? As far as I can tell, the only benefit here is that now my identity on my photo sharing service can be linked to my identity on my wine rating service. Why do I want that?

The benefit is that many third-party services and many users don't want to have to trust a centralized auth provider. The blockchain provides redundancy and security guarantees which don't require trusting company employees. Not to mention the financial incentives which are associated with being an early adopter of a blockchain project and the network effects which come from that.

I'm convinced that decentralized communities will eventually corrupt and destroy all centralized services and agencies by manipulating their employees and members... Because they can. People will always find a way to create new problems to make themselves necessary. In these political games, decentralized anonymous communities have the upper hand. Unlike centralized projects, you can't corrupt decentralized projects. What can be corrupted, will be corrupted.

To understand why it's the future, you need to look at the big picture. You're assuming that centralized auth providers are secure and trustworthy. This is not going to be true in the future. Trust in institutions and organizations has been eroding and will continue to erode.

OK let’s try again. What precisely is the difference between signature based auth that uses a key pair associated with a wallet and a key pair that the user submits the public key for when they sign up? Why would the latter be vulnerable to additional insider threats?

“Services will make more money because blockchains are trendy” isn’t a meaningful difference.

> - The cost associated with purchasing tokens needed to initialize an account on the blockchain would serve as a spam prevention mechanism; an alternative to SIM cards which most centralized services rely on today as a cost barrier to limit the creation of spam accounts.

Doesn't seem like that to me. If I get banned I can just move my cash to another account and start again, and assuming multiple services does this I can amortize the cost over all of them.

The rest seems to me like something mTLS could solve better.

> it is never sent over the wire. You just send signatures to different services.

You don’t need blockchains for this. Ordinary websites can implement this. They usually don’t, but, they could?

Reply on news.ycombinator.com