Hacker News Reader

Comment by greenail | Hacker News Reader

I really like the general idea of decentralized identity. Personally I'd prefer to keep my identities on different apps/platforms mostly (99%) separate. It seems to me that giving an adversary a map (especially usernames and email identities) of your online presence is a bad idea especially if they get access to one account and get some private details they may be able to use to socially engineer their way into other accounts.

View on HN

I'm not sure what the best implementation of decentralized identity is (although proof-of-personhood systems like BrightID seem interesting[0]), but ideally the different platforms would cryptographically sign statements for you like "This user has a positive reputation on our platform" which you can disclose to other platforms without them being able to learn your username on the original platform.

[0] https://www.brightid.org/

A tool like TLS Notary could be used to generate proofs of this nature. And do not require the participation of the host / subject of proof.

https://github.com/tlsnotary

Has some issues, but I find the approach very interesting.

I think it's not really viable to expect people to install a browser extension that interferes with their login sessions to sensitive websites, but if this technology was built into browsers it could be very interesting.

The UX might be a little awkward, but you could have a "Notarised documents" location under "Save Page As" which stores the current page with an accompanying file containing the notary details. Then you'd be able to upload these documents via a web interface to a smart contract.

There would have to be some way to cryptographically blind the connection between the distributed ID and these documents, though, as the documents would be plaintext and contain actual usernames.

I'm guessing most people try to obtain the same username on every service, so generally it's not hard to trace people's other identities. And some people, including myself, are happy to have all their identities out there.

It's also possible to correlate the shape of the social graph across services to deanonymize users across social networks.

So I don't think not proving ownership of multiple identities buys much for anonymity. For deanonimization just a reasonable probability is sufficient. But a proof adds more utility to the person proving their identity. You can still have hidden throwaway accounts when needed.

Ideally with decentralized identity, you use a separate identifier with every relationship. Otherwise you have created the ultimate super cookie.

Reply on news.ycombinator.com