Hacker News Reader

Comment by betwixthewires | Hacker News Reader

So the thing about this is that there is no need to permanently tie identity across all sites and services you used (and provide), rather, the ability to do so when and where you need to do it.

There's nothing requiring a user to use the same identity across every service they interact with, but the option should be there. I wouldn't want my matrix username(s) and my fediverse account(s) tied to my HN username(s), but I might want a github/gitlab/codeberg account tied to a social/messaging account while having different "personas" for different applications. Overall it's a useful tool to have in your belt, so long as it doesn't limit you in other ways.

View on HN

So if you are not going to go whole-hog and have one true identity for everything, why bother using anything apart from an email address?

The argument seems to be that consistency allows you to prove ownership and re-use all of your content etc across the web by tying everything back to one verified identity. If you are having different identities on different sites then that benefit disappears, and I fail to see how it is then any better than using email addresses? You end up with different wallet IDs each with their own island of content, just like you have with email addresses.

Sure you could chose to "move" content with one of your many identities by just logging in with the ID (presumably losing all of your existing content), but we have copy-paste for that already (and I am only half-joking saying that...)

Email addresses aren't really good for this. It's really easy to sign up for a service with someone else's email address, for example. Sure, if that person ever finds out they can potentially claim ownership of the account through a password reset, but it doesn't erase the fact that you have been using their "identity" for some time.

Is this still a thing though? Pretty much everything I've used in the past 10-15 years has required email validation before allowing you to do anything meaningful.

Either way though, I don't see how an account claiming to be "wan23" would be any more trustworthy to me as created off of the back of an email account or off of a wallet ID - I still have no idea (nor do I care) who you are.

It is still a thing. Hell, even AWS let someone create an account with my email address without validation. Stupid system kept spamming me to alert me that the instance of whatever they spun up was stopped because there was no money in the account.

> Email addresses aren't really good for this. It's really easy to sign up for a service with someone else's email address, for example. Sure, if that person ever finds out they can potentially claim ownership of the account through a password reset, but it doesn't erase the fact that you have been using their "identity" for some time.

This is also true of a private key, in fact it's literally the same scenario...

Presumably a service that allows you to register using a public key as a unique identifier would require you to sign something with the private key.

That's what email confirmation is for. Let's you confirm possession of the email account you enrolled with.

Well I thought I explained it effectively, but there are numerous scenarios where you'd want to use the same identity across multiple services, cross sharing of data, provable rights, etc. But that doesn't mean you're limited to one, or that you want to use it for every service you use. The benefit doesn't disappear, the benefit only applies when you want it. It isn't all or nothing.

You just described OAuth/OIDC.

OAuth helps but it still forces you to rely on a single central provider as your "root". So it's not a complete solution.

> still forces you to rely on a single central provider as your "root"

So what ? I am still struggling to understand what immediate and painful need users have with trusting Apple, Facebook, Google etc with their identity.

If people had some issue with this then users would simply not use OAuth and default to creating an account for each service they use.

> I am still struggling to understand what immediate and painful need users have with trusting Apple, Facebook, Google etc with their identity.

It's not so immediate until you get banned, but they've all been gradually stepping up their politicised banwaves. And there's always the concern about what happens when one of them goes the way of Yahoo.

> If people had some issue with this then users would simply not use OAuth and default to creating an account for each service they use.

Which has huge practical headaches, to the point that OAuth being the least-bad option doesn't say a lot.

What's to stop e.g. Google from creating a blacklist of these public identities again?

Defaults and ease for site operators matter. Google could publish a blacklist but it would be opt-in, and if one blacklist starts being unreasonable then site operators can easily switch to another.

What's to stop Google from creating and using an internal blacklist - not for publishing.

Google can blacklist you from Google, but they wouldn't control your login to other sites the way they currently do with OAuth.

>>> I am still struggling to understand what immediate and painful need users have with trusting Apple, Facebook, Google etc with their identity.

Using your Google account to log into everything is great....until your account gets locked.

https://www.pcmag.com/news/not-even-google-employees-can-unl...

>I am still struggling to understand what immediate and painful need users have with trusting Apple, Facebook, Google etc with their identity.

Are you actually serious right now?

> If people had some issue with this then users would simply not use OAuth and default to creating an account for each service they use.

Do you really believe this? Plenty of people use services they don't particularly like because it's better than the alternative or they have an immediate need. I know lots of people who didn't want to use zoom but needed to, have a Facebook account to keep up with family even though they'd rather not, etc.

Plenty of people would love an option that works as easy as oauth but doesn't lock them to a FAANG provider. Just because they use it when there's not another option doesn't mean they wouldn't use another option if it existed.

Because the number won't go up if we don't decentralise it duh

For one thing, I don’t have to deal with every new website’s crappy signup and email confirmation flows, broken password reset flows, login forms that deliberately break password managers, etc. Obviously Web3 has nothing directly to do with these things, but a consistent auth system becoming ubiquitous could be inherently nice.

Your wallet is your identity, and so can directly be tied to web3. It could be implemented in alternate ways as well, but that's one situation that web3 can already handle. (Sort of. Password (private key) resets aren't a thing, yet.

It doesn't give you that ability though. The reason we use Google and Facebook OAuth is because Google and Facebook did their due diligence with the account. We would just accept any OAuth provider if we didn't care about that validation.

And again, with these web3 identities, centralized services would still be providing the authorization even if they did not provide the authentication. I don't see what web3 identities provide.

Reply on news.ycombinator.com