You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Create an app that utilizes the email address of the user and uses the public key of each users zone file to encrypt and confirm messages sent. (Transcribing from a one off convo with @jcnelson so hopefully everything is there to piece that together :-) )
I think this would be easier if you do this as integration (I think Matrix matches perfectly).
With Blockstack's capabilities Matrix could retrieve their handles and device keys from a given Blockstack ID and then do their chats as usual. With Blockstack's storage provider you could even store your own chat history in your profile.
Reacted by Odin Hørthe-Omdal Urdland, Marcos Marado and Friedger
So: on the Matrix side we're very much (still) looking for a decentralised identity system that could help users discover each other based on existing identifiers when starting a conversation. The requirements are:
A way for users to reliably assert ownership of a given identifier (e.g. email address). This means not blindly trusting a centralised email verifying service, but instead using DKIM and/or some kind of identity key signing to let the mailserver or end-user prove ownership.
Alternatively, if one uses centralised verifying services, you need a way to track the reputations of their identity claims. So for something unavoidably centralised such as MSISDN verification, you'd have a way to establish whether you trusted the reputation of the 2FA vendor(s) who made the claim.
We don't want users to ever have to pay to use the system (especially with a cryptocurrency)
From speaking to @muneeb-ali at DWS last year, I got the impression that the identity verifying services are assumed to be trusted - and blockstack concerns itself with maintaining the ledger of the claims, rather than tracking the reliability of the verifiers. I also got the impression that whilst blockstack was currently subsidising the cost of adding records, this was a temporary bootstrapping measure in the grand scheme of things.
Matrix should be a good fit for a blockstack-powered messaging system, assuming that blockstack could solve the identity piece!
Reacted by Patrick Stanley, Muneeb, Odin Hørthe-Omdal Urdland, Marcos Marado and Friedger
Blockstack gives users the ability to associate arbitrary off-chain data with their on-chain name and public key. This could easily include both a DKIM signature as well as any additional 3rd party attestations. The integration software could be written to query these attestations as part of the authentication process.
I got the impression that the identity verifying services are assumed to be trusted - and blockstack concerns itself with maintaining the ledger of the claims, rather than tracking the reliability of the verifiers
This is true. The user (or application) decides which claims are meaningful. We believe that determining the trustworthiness of a particular verifier is beyond the scope of an identity system, since it's fundamentally a social problem.
I also got the impression that whilst blockstack was currently subsidising the cost of adding records, this was a temporary bootstrapping measure in the grand scheme of things.
Yes, this is the case. Even if names had no cost of their own and didn't expire (both of which are supported in Blockstack), someone would still need to pay the transaction fee. We rely on this to both reduce spam and to rate-limit writes to the system (i.e. a node's local state cannot grow or mutate faster than the underlying blockchain).
Matrix looks like a really cool system! I'd love to add support for it. We anticipate that many Blockstack applications will need a generic multicast notification mechanism (e.g. "You have mail", "a new forum post was added", "a new tweet arrive"), and we plan to add a driver model for using existing messaging systems to transport notifications. I was planning on using IRC at first, but if Matrix is more stable and more resilient to network partitions, we can go with Matrix instead :)
Reacted by Patrick Stanley, Odin Hørthe-Omdal Urdland and Marcos Marado
Hopefully Matrix surpasses IRC in pretty much every way, being an open global decentralised network providing free-form JSON pubsub & persistence, signed into merkle dags, and end-to-end encryption via https://matrix.org/git/olm. Admittedly we're still late beta, but in practice there a few thousand servers out there, >1M users, >200K rooms, and generally things work pretty well. The biggest issue right now is that latency & throughput isn't quite as good as something simple like IRC, but we're getting there :)
Ignoring the question of tracking the reputation of centralised ID brokers (e.g. if a 2FA MSISDN vendor can be trusted or not), I'm unclear why nobody has set up email verification servers publishing proofs into blockstack based on DKIM or similar to try to prove the authenticity of emails claims. For that matter, I'm unclear as to why keybase doesn't do email proofs either.
Surely someone's doing this already? And if not, why not?
Reacted by Patrick Stanley and Odin Hørthe-Omdal Urdland
A truly decentralized chat/messaging service is the dream.
I think that as a first step, just allowing human-readable names in a namespace tied to public-keys can be really helpful. Imagine signing into Matrix without passwords and with a username/identity that you own. (That's less load on your servers and no need to maintain user information.)
Identity proofs are the next step i.e., linking your Twitter, Github, domain etc. Email is more complex but we can brainstorm more about it.
We're planning to fork Discourse (which we use on http://forum.blockstack.org) and enable logging in with Blockstack.
Can we try to do something similar with Matrix? It'd be a great concrete thing to hack on. We have around 2,500 members on our Slack (http://chat.blockstack.org/) and we're open to transitioning to a decentralized chat that supports logging in with Blockstack.
Reacted by Patrick Stanley, Valentin Sundermann and Odin Hørthe-Omdal Urdland
Activity
vsund commentedon Feb 28, 2017
I think this would be easier if you do this as integration (I think Matrix matches perfectly).
With Blockstack's capabilities Matrix could retrieve their handles and device keys from a given Blockstack ID and then do their chats as usual. With Blockstack's storage provider you could even store your own chat history in your profile.
pstan26 commentedon Feb 28, 2017
@vsund thats sounds neat. Do you know what the scope of building something basic is?
vsund commentedon Feb 28, 2017
I talked with @ara4n some days ago and he said that they search a decentralized identity system but have a few requirements:
With these things done, one could start the integration. But all in all I think the guys at Matrix are interested in realising this too :)
pstan26 commentedon Feb 28, 2017
Yep, that's completely fair, would be interesting to realize. Would love to hear @jcnelson or @ara4n's thoughts are on this.
ara4n commentedon Mar 1, 2017
So: on the Matrix side we're very much (still) looking for a decentralised identity system that could help users discover each other based on existing identifiers when starting a conversation. The requirements are:
From speaking to @muneeb-ali at DWS last year, I got the impression that the identity verifying services are assumed to be trusted - and blockstack concerns itself with maintaining the ledger of the claims, rather than tracking the reliability of the verifiers. I also got the impression that whilst blockstack was currently subsidising the cost of adding records, this was a temporary bootstrapping measure in the grand scheme of things.
Matrix should be a good fit for a blockstack-powered messaging system, assuming that blockstack could solve the identity piece!
jcnelson commentedon Mar 1, 2017
Hey @ara4n, good to hear from you!
Blockstack gives users the ability to associate arbitrary off-chain data with their on-chain name and public key. This could easily include both a DKIM signature as well as any additional 3rd party attestations. The integration software could be written to query these attestations as part of the authentication process.
This is true. The user (or application) decides which claims are meaningful. We believe that determining the trustworthiness of a particular verifier is beyond the scope of an identity system, since it's fundamentally a social problem.
Yes, this is the case. Even if names had no cost of their own and didn't expire (both of which are supported in Blockstack), someone would still need to pay the transaction fee. We rely on this to both reduce spam and to rate-limit writes to the system (i.e. a node's local state cannot grow or mutate faster than the underlying blockchain).
Matrix looks like a really cool system! I'd love to add support for it. We anticipate that many Blockstack applications will need a generic multicast notification mechanism (e.g. "You have mail", "a new forum post was added", "a new tweet arrive"), and we plan to add a driver model for using existing messaging systems to transport notifications. I was planning on using IRC at first, but if Matrix is more stable and more resilient to network partitions, we can go with Matrix instead :)
ara4n commentedon Mar 1, 2017
Hopefully Matrix surpasses IRC in pretty much every way, being an open global decentralised network providing free-form JSON pubsub & persistence, signed into merkle dags, and end-to-end encryption via https://matrix.org/git/olm. Admittedly we're still late beta, but in practice there a few thousand servers out there, >1M users, >200K rooms, and generally things work pretty well. The biggest issue right now is that latency & throughput isn't quite as good as something simple like IRC, but we're getting there :)
Ignoring the question of tracking the reputation of centralised ID brokers (e.g. if a 2FA MSISDN vendor can be trusted or not), I'm unclear why nobody has set up email verification servers publishing proofs into blockstack based on DKIM or similar to try to prove the authenticity of emails claims. For that matter, I'm unclear as to why keybase doesn't do email proofs either.
Surely someone's doing this already? And if not, why not?
muneeb-ali commentedon Mar 2, 2017
@ara4n Great to see this discussion!
A truly decentralized chat/messaging service is the dream.
I think that as a first step, just allowing human-readable names in a namespace tied to public-keys can be really helpful. Imagine signing into Matrix without passwords and with a username/identity that you own. (That's less load on your servers and no need to maintain user information.)
Identity proofs are the next step i.e., linking your Twitter, Github, domain etc. Email is more complex but we can brainstorm more about it.
We're planning to fork Discourse (which we use on http://forum.blockstack.org) and enable logging in with Blockstack.
Can we try to do something similar with Matrix? It'd be a great concrete thing to hack on. We have around 2,500 members on our Slack (http://chat.blockstack.org/) and we're open to transitioning to a decentralized chat that supports logging in with Blockstack.
muneeb-ali commentedon May 2, 2017
@i1o thanks for reaching out! Tagging @pstan26 as well.