Harald Eilertsen

Sat, 16 Jan 2021 10:19:52 +0100

Interesting post from Bruce Schneier: https://www.schneier.com/blog/archives/2021/01/cell-phone-location-privacy.html

We all know that our cell phones constantly give our location away to our mobile network operators; that’s how they work. A group of researchers has figured out a way to fix that. “Pretty Good Phone Privacy” (PGPP) protects both user identity and user location using the existing cellular networks. It protects users from fake cell phone towers (IMSI-catchers) and surveillance by cell providers.

#privacy #phone #imsi

David

Sat, 16 Jan 2021 18:04:52 +0100 from Diaspora

Basically, the idea is to use VOIP services.

Harald Eilertsen

Sat, 16 Jan 2021 20:47:48 +0100

@David It's quite a bit more involved than that, but that's part of it.

GDPRHub

Harald Eilertsen

Sat, 10 Oct 2020 18:46:34 +0200

Stumbled into this rabbit hole this evening: https://gdprhub.eu

A wiki dedicated to GDPR and anything related. Run by the people at https://noyb.eu, it seems. Loads of information, everything from commentary on how to interpret the GDPR, contact info to the different data protection agencies, relevant court decisions etc.

#gdpr #eu #privacy #noyb

First Beta Release of Briar GTK

Harald Eilertsen

Sun, 13 Sep 2020 21:39:29 +0200

First Beta Release of Briar GTK

Briar GTK is a prototype to bring Briar to desktop devices. It's not affiliated with the official Briar team. However, it strives to bring all the great features and mindsets from Android to the wider world.

This looks pretty cool!

#briar #messaging #tor #privacy #p2p

Tanja

Mon, 14 Sep 2020 08:17:06 +0200

Didn't know this existed. Interesting. Now if somebody could just port it to iOS, it might actually become a viable alternative.

Harald Eilertsen

Mon, 14 Sep 2020 10:15:37 +0200

@Tanja No didn't know about it myself either before coming across this post. As you say, it gives hope that clients for more platforms will come. My experience with the android version is very good so far.

Tanja

Mon, 14 Sep 2020 10:43:37 +0200

@Harald Eilertsen Yes, it certainly seems to be fairly stable, although I can't say I really used it very much - nobody to use it with to begin with. But I'm watching. I like the idea of p2p messaging; it certainly seems the most private and secure solution.

Bahrain, Kuwait and Norway contact tracing apps among most dangerous for privacy

Harald Eilertsen

Tue, 16 Jun 2020 11:17:34 +0200

Amnesty International has had a look at contact tracing apps introduced in the wake of COVID-19:

Bahrain, Kuwait and Norway have run roughshod over people’s privacy, with highly invasive surveillance tools which go far beyond what is justified in efforts to tackle COVID-19. Privacy must not be another casualty as governments rush to roll out apps.

Bahrain, Kuwait and Norway contact tracing apps a danger for privacy

Don't say we didn't warn you.

#norway #bahrain #kuwait #covid-19 #contact-tracing #privacy #surveillace

Privacy

show all 9 comments

Esteban Manchado Velázquez

Tue, 16 Jun 2020 11:19:56 +0200 from ActivityPub

@harald I haven't read the article yet (had it open in another tab), but :yikes:

Harald Eilertsen

Tue, 16 Jun 2020 11:23:35 +0200

@Esteban Manchado Velázquez No surprises, just the same stuff we've been trying to tell them since the app was announced. But it's good to have the weight of Amnesty International on the record too. Even norwegian politicians may take notice for once.

Esteban Manchado Velázquez

Tue, 16 Jun 2020 11:25:30 +0200 from ActivityPub

@harald Actually I haven't been following details, so although I know people were complaining about privacy and other things, I never really understand the implications well.

Harald Eilertsen

Tue, 16 Jun 2020 11:42:03 +0200

@Esteban Manchado Velázquez Well it's essentially three issues:

Tracking precise location in realtime using GPS data
Using permanent identifiers for the bluetooth beacons, and having these connected with a phone number required for registering.
Storing the above data in a centralised storage location. (And using a foreign cloud provider for that storage.)

In addition it is the desicion to use a closed source development model for the app (for "security reasons", which is bullshit given how easy it is to decompile the app) and that the app has multiple purposes (contact tracing/notifications and collecting data for research) that are not separated, and you can not select which part you want to contribute to.

Pilum::🌞

Tue, 16 Jun 2020 11:55:37 +0200 from ActivityPub

@harald @estebanm Sums up nicely why I didn't install it.

Esteban Manchado Velázquez

Tue, 16 Jun 2020 12:58:55 +0200 from ActivityPub

@harald From the AI article: "On Monday, the Norwegian government announced it would press pause on using its contact tracing app. The decision came [...] after [Amnesty] shared its findings with the Norwegian authorities"

Harald Eilertsen

Tue, 16 Jun 2020 13:03:35 +0200

@Esteban Manchado Velázquez Yeah, and after Datatilsynet notified them about recommending a preliminary ban on handling personal data through the app: https://www.datatilsynet.no/aktuelt/aktuelle-nyheter-2020/midlertidig-stans-av-appen-smittestopp/. There's no surprise that multiple organizations are working in parallel on this.

linus

Fri, 26 Jun 2020 21:13:42 +0200

Just copy & translate the app of Germany or Austria. ;) Its open source but requires Google Play Services / Apple.

Harald Eilertsen

Fri, 26 Jun 2020 21:46:14 +0200

@linus They could have done any number of things, and few of them would be as bad as the path they chose. Somehow I'm not surprised though...

Harald Eilertsen

Thu, 23 Apr 2020 14:11:33 +0200

We bake cookies in your browser for a better experience. Using this site means that you consent.

Cute, but no. It does not mean I consent. Also by not giving me an option to consent or not, or to withdraw my concent if I should have given it, you're violating GDPR.

#gdpr #noconsent #tracking #privacy

Privacy

Harald Eilertsen

Mon, 30 Mar 2020 16:30:08 +0200

Privacy vs. Surveillance in the Age of COVID-19 https://www.schneier.com/blog/archives/2020/03/privacy_vs_surv.html

#privacy #covid-19

'The goal is to automate us': welcome to the age of surveillance capitalism

Harald Eilertsen

Sun, 20 Jan 2019 21:54:07 +0100

This is by far the best and most informative piece I've read about surveillance capitalism, how it affects us, and why we should care. Starts off as a review of Shoshana Zuboff's latest book – The Age of Surveillance Capital, but the interview with Shoshana Zuboff at the end is also absolutely worth reading!

https://www.theguardian.com/technology/2019/jan/20/shoshana-zuboff-age-of-surveillance-capitalism-google-facebook

I haven't read the book yet, but this is one I'll definitely have to read!

#surveillancecapitalism #internet #privacy

Privacy Politics Internet

show all 11 comments

ghose [D*]

Mon, 21 Jan 2019 08:22:37 +0100 from Diaspora

Viewed from this perspective [capitalism evolution], the behaviour of the digital giants looks rather different from the roseate hallucinations of Wired magazine. What one sees instead is a colonising ruthlessness of which John D Rockefeller would have been proud. First of all there was the arrogant appropriation of users’ behavioural data – viewed as a free resource, there for the taking. Then the use of patented methods to extract or infer data even when users had explicitly denied permission, followed by the use of technologies that were opaque by design and fostered user ignorance.

Thanks for sharing. Long reading, but enlighting

ghose [D*]

Mon, 21 Jan 2019 08:30:24 +0100 from Diaspora

The first surveillance capitalists also conquered by declaration. They simply declared our private experience to be theirs for the taking, for translation into data for their private ownership and their proprietary knowledge.

Harald Eilertsen

Mon, 21 Jan 2019 08:48:41 +0100

@Xose M You're welcome! My thoughts exactly, this opened perspectives I hadn't thought about before.

ghose [D*]

Mon, 21 Jan 2019 09:19:15 +0100 from Diaspora

yes, It's hard to put into words that gut feeling we most of us here have.

This (quote) is exactly what I tell people on real world but I find dificult to explain in terms they understand

For example, the idea of “data ownership” is often championed as a solution. But what is the point of owning data that should not exist in the first place?

There's hope while there are people writting this things and other people having access to read it.

Jakobu

Mon, 21 Jan 2019 09:37:27 +0100 from Diaspora

Somehow I have been thinking along these lines for a while. The data collection is a refinement of the statistical machine behind commercials, but the PR-business is really just a continued commercial version of the propaganda techniques of the early twentieth century. I have seen this as a threat against western democracy for a long time. "Fake News" is really just propaganda, and the fact that we have invented a new word for something that was there all along shows how naive and dull we are.

Meanwhile both the political left and the political right is on twitter trying to limit the freedom of speech that is what makes a place like this possible.

Harald Eilertsen

Mon, 21 Jan 2019 14:12:26 +0100

"Fake News" is really just propaganda, and the fact that we have invented a new word for something that was there all along shows how naive and dull we are.

This is actually spot on! I despise the term "Fake news," as it hides the real intent and meaning that's behind it. Disinformation and propaganda are far better and more accurate terms.

Beni Grind

Mon, 21 Jan 2019 20:36:41 +0100

Thanks for sharing. I just ordered the book in my local book store. I felt that this book is a great opportunity to start supporting my LBS again....

Harald Eilertsen

Mon, 21 Jan 2019 20:44:01 +0100

@Beni Grind I've done the same :) I prefer buying from a local store when possible, and usually it is.

Beni Grind

Mon, 21 Jan 2019 20:58:45 +0100

@Harald Eilertsen Honestly, for some reason it didn't occur to me that I could just email an order to them and then pick it up when they notify me that it arrived... I don't mind paying a premium for this service.

hEARt PhoniX

Tue, 22 Jan 2019 11:58:17 +0100

Harald Eilertsen

Tue, 22 Jan 2019 13:12:00 +0100

@Tobias Yes, there were so many quoteworthy passages in the piece I ended up not quoting anything. But it really does put things into perspective. Can't wait to read the book.

The Watchdogs That Didn’t Bark

Harald Eilertsen

Sat, 19 Jan 2019 15:46:38 +0100

It’s also hard to overlook the fact that a lot of privacy advocacy groups in the U.S. get funding from the same tech companies that would ostensibly be affected by government regulation of consumer data collection. EFF, for example, took in about $822,000 from Google, including donations from employees that are matched by the company, in fiscal 2017. CDT collected about $590,000 in donations and support from Google in 2016 and received $250,000 from Facebook last year. As for OTI, Google’s former CEO Eric Schmidt co-founded and has been a significant donor to New America for years. He and his wife’s philanthropic foundation committed to $4 million in funding New America from 2016 to 2021. All of these groups maintain complete independence from their donors.

https://web.archive.org/web/20180921123410/https://slate.com/technology/2018/04/why-arent-privacy-groups-fighting-to-regulate-facebook.html

#politics #internet #privacy

Politics Internet Privacy

show all 7 comments

tomgrz

Sun, 20 Jan 2019 03:25:01 +0100 from Diaspora

The best way to tame an oversight institution is to give it food. Feed it enough treats and it will beg for more.

tomgrz

Sun, 20 Jan 2019 03:26:22 +0100 from Diaspora

The Green Party US understands this, deeply. They do not take money from Corporate-linked PACs.

tomgrz

Sun, 20 Jan 2019 03:26:52 +0100 from Diaspora

The Green Party US understands this, deeply. They do not take money from Corporate-linked PACs or Foundations.

Sensitive Data Exposure via WiFi Broadcasts in Android OS [CVE-2018-9489]

Harald Eilertsen

Mon, 03 Sep 2018 10:40:05 +0200

System broadcasts by Android OS expose information about the user’s device to all applications running on the device. This includes the WiFi network name, BSSID, local IP addresses, DNS server information and the MAC address. Some of this information (MAC address) is no longer available via APIs on Android 6 and higher, and extra permissions are normally required to access the rest of this information. However, by listening to these broadcasts, any application on the device can capture this information thus bypassing any permission checks and existing mitigations.

https://wwws.nightwatchcybersecurity.com/2018/08/29/sensitive-data-exposure-via-wifi-broadcasts-in-android-os-cve-2018-9489/

#android #vulnerability #security #privacy

Security

The "Sign-in with Facebook" problem and the open source solution

Harald Eilertsen

Mon, 27 Aug 2018 12:57:45 +0200

Björn Schießle wrote the following post Mon, 27 Aug 2018 08:00:06 +0200

scottnesbitt wrote: The "Sign-in with Facebook" problem and the #opensource solution https://www.itproportal.com/features/the-sign-in-with-facebook-problem-and-the-open-source-solution/

A convenient option has been gaining ground: Internet-wide single sign-on services run by the big OTTs. There is such a need for a simple solution that almost all websites quickly started to let you “login with Google” or “login with Facebook”. Or with Twitter. Or with all of them: just pick one of a list of ten providers and use their credentials.

This is a step forward, since you only need to remember the passwords to your social network accounts, and use them everywhere else. However, it poses a huge risk to your privacy: do you really want an monopolistic conglomerate whose business is based on monetising user information to know all the places where you log into, track you as you move among these services, and exchange information on you with them?

#id4me #privacy #identitymanagement

show all 31 comments

M. Dent

Mon, 27 Aug 2018 13:20:00 +0200

Except for ID4me, no other public, open, federated, privacy-friendly, user-centred Identity Management Standard exists.

Lies!

Harald Eilertsen

Mon, 27 Aug 2018 13:26:40 +0200

Or ignorance... but either way, it's an interesting approach.

M. Dent

Mon, 27 Aug 2018 13:33:58 +0200

@Mario Vavti - I'm working on a note to the editor of the publication indicating that basically this assertion is misleading and that Hubzilla can offer this today... But I think the case could be stronger if the OpenID connect stuff was in Master rather than just Dev. You know the codebase better than me, how much work would it take to merge those commits to master?

Mario Vavti

Mon, 27 Aug 2018 13:53:06 +0200

I think its about 4 or 5 commits we would need to port. I could do that in a minor release if the code is tested and reported working...

Beni Grind

Mon, 27 Aug 2018 13:55:07 +0200

OpenID, Mozilla Persona, Hubzilla. They really should do some research....

Darren Drapkin

Mon, 27 Aug 2018 13:56:57 +0200 from Diaspora

how does it compare with #openauth ?

M. Dent

Mon, 27 Aug 2018 14:14:37 +0200

Yeah, we need to have several people validate it first. There are things that need to be added, but a basic working system is sufficient.

I've got the dev code working with an instance of WordPress through openID connect (the plugin for WP needs some work, but it functions)... It'd be good if we knew it worked with others.

@muppeth and @poVoq - I think one or both of you were looking at the open-id-connect connect stuff - are you running an instance of the dev code with the ability to test it anywhere?

Harald Eilertsen

Mon, 27 Aug 2018 14:17:22 +0200

@Beni Grind ID4me is built on top of OpenID Connect.

I have to admit that my first reaction when I first saw ID4me mentioned also was "again...?" But I think the way they tie this in with DNS and their drive to standardise it looks promising. If we can do the same with hubzilla's openconnect implementation that's awesome, but a standard that works also for people not on hubzilla is preferable. With the rest in place, having hubzilla be an ID4me provider should be a trivial next step.

But yeah, others have tried and failed earlier, so only time will tell if this will fare any better. I hope it does, since something like this is desperately needed on the web!

Harald Eilertsen

Mon, 27 Aug 2018 14:25:05 +0200

@Darren Drapkin Not sure, do you have a link for OpenAuth?

M. Dent

Mon, 27 Aug 2018 14:31:36 +0200

The thing is, THIS is in the wheelhouse of Zot/Hubzilla. Even with all the things we know Hubzilla can do better, this is locked in. The fact that the NEXT iteration is already in the offing with ZotVI sternghens the case, "Hubzilla has been doing THIS exact thing for YEARS"

The only other thing that would make it a complete lock would be some sort of SDK for OWA/webfinger - even if it was only in PHP. If we could just get the authentication bit down to the bare essentials and package it up as a reference SDK, that would even further strengthen the proposition.

As usual, this is a call to action for those not in active development to shake the trees and find people who would be excited by this prospect and ask them to get involved with a mature project and help out. This isn't a suggestion that those in active development 'drop everything' (or anything for that matter) to make this happen.

The community needs to grow. This is a place where the path is pretty clear already and people with a little know-how, ingenuity, and some time can contribute to something great.

The very fact of this article and thought these companies are trying to recreate the wheel which Mike has already created, balanced and started rolling proves there is a desire for what we already have. We need to capitalize on that.

And not just devs! If you write, we need "rebuttal articles" to the misinformation being spread about how 'new' and 'innovative' these upstarts are. Even if you just follow tech -- make sure to comment on articles like these when you run across them and point people to Hibzilla and Zot. The @Hubzilla Advocacy channel can be used to share info on stories and coordinate efforts. A bunch of us doing a little can go a long way!

Brad Koehn ☑️

Mon, 27 Aug 2018 14:37:44 +0200 from Diaspora

Persona is dead, OpenID is pretty worthless since nobody actually wants it. ID4me addresses some of OpenID’s issues, but doesn’t actually exist yet. It would be nice if the various services in The Federation supported some kind of federated identity standard.

M. Dent

Mon, 27 Aug 2018 14:44:19 +0200

ID4me's tie to DNS is it's Achillies heel. Courts and corporate actors can still muck with your identity by getting your DNS revoked. Ultimately, ID4me's system IS still centralized. It is just LESS centralized. But it is not fully DEcentralized (Hubzilla is) ID4me's claim to decentralization are only "true enough" not to be completely lies.

Zot's nomadic identity is truly decentralized and not permanently tied to anything. You can maintain your identity on multiple domain names.

There is nothing for Hubzilla to "chase after" here. Zot/nomadic identity is already better. If we can validate the OpenID connect stuff, the only technical issue is documenting how to get open-id-connect to parse the webfinger address in order to address the correct hub. (THAT part is tied to DNS, but your actual identity is not in Hubzilla/Zot) - as long as your identity is on one hub that has valid DNS resolution, your identity is available to be used.

Harald Eilertsen

Mon, 27 Aug 2018 14:44:49 +0200

@M. Dent I'm really not sure what you're objecting to. ID4me isn't an upstart, it's a proposed standard. It's not about lock in, it's about getting identities back into the control of the users. It's not an implementation, others should do that. There's no reason why this can not be implemented by Hubzilla, as well as diaspora, and other players on the social web. You find more information on their website including their draft RFCs and more.

If the currently implemented id management functionality in Hubzilla is better, then standardize it. Write up the RFCs and promote it. I'll support that too!

Harald Eilertsen

Mon, 27 Aug 2018 14:51:24 +0200

@M. Dent:

ID4me's system IS still centralized. It is just LESS centralized.

How?

There is nothing for Hubzilla to "chase after" here. Zot/nomadic identity is already better.

Not asking you to chase after anything, and not disputing that the nomadic identities provided by zot/hubzilla is better. Still I have not seen any thoughts about how to use this outside of a hubzilla/zot universe. That's the part missing.

Also, one does not rule out the other. Perhaps even the nomadic identity specs could be contributed as part of the id4me initiative?

M. Dent

Mon, 27 Aug 2018 14:51:52 +0200

The Fediverse could have such a standard - if it looked at Hubzilla and Zot for what they really are and didn't try to shoe-horn it into the paradigm of 'just another social media platform'. It probably wouldn't even be a ton of work to do it!

M. Dent

Mon, 27 Aug 2018 15:09:23 +0200

@Harald Eilertsen

It is still centralized because DNS is inherently centralized. They tie your identity to your DNS address. If your DNS address goes bye-bye, your identity does too.

Your Zot/Hubzilla identity is not permanenetly tied to your DNS address. It only uses DNS as a bridge - that is the essence of nomadic identity. It goes where you go. If you change servers and are on a different domain, it is still YOU. Each of your clones is on a different DNS address - and they are completely interchangeable.

M. Dent

Mon, 27 Aug 2018 15:16:33 +0200 last edited: Mon, 27 Aug 2018 15:24:20 +0200

Using g your Zot/Hubzilla address outside of the Zot/Hubzilla universe is accomplished the same way ID4me seems to propose - through open-id-connect (at least at this stage). Dev already has open-id-connect working. We need some others to test and validate so we can push to master.

Note "OpenID" is not the same as OpenID-Connect. They are very different.

All it would take for an OpenID-Connect client to be able to validate your Hubzilla identity and get user info would be to parse your webfinger address and get the hostname and username both from that rather than getting the hostname from a static setting. Then, if your Hubzilla Hub had the OpenID-Connect module installed, you'd be able to use your Zot/Hubzilla identity as your single-signon identity.

Harald Eilertsen

Mon, 27 Aug 2018 15:28:28 +0200

@M. Dent

It is still centralized because DNS is inherently centralized.

Which is to say that the Internet is inherently centralised. So we have already lost.
At least if that was the case, which it luckily is not.

I know how the Hubzilla nomadic identities work, and it's bloody brilliant! Still, I've never seen anyone do the work and propose it as an internet standard to be used universally. It's that last part which makes id4me interesting, not necessarily it's technicalities.

Harald Eilertsen

Mon, 27 Aug 2018 15:31:21 +0200

@M. Dent:

All it would take for an OpenID-Connect client to be able to validate your Hubzilla identity and get user info would be to parse your webfinger address and get the hostname and username both from that rather than getting the hostname from a static setting.

Great! Now that's the part you need to standardise then. Go for it!

M. Dent

Mon, 27 Aug 2018 15:39:39 +0200

It's so fun when complete strangers presume to tell you what "you need to" do. Lol. (I find they are frequently the same who complain that "you think you're running a one-man-show!"Lol)

Harald Eilertsen

Mon, 27 Aug 2018 15:52:34 +0200

@M. Dent I'm not telling you to do anything at all. And please tell me when I've said anything about you running a one man show.

M. Dent

Mon, 27 Aug 2018 16:37:36 +0200

You have not. I also did not say you did. But before this gets any further down the rabbit hole of defensiveness and derails an otherwise very helpful and productive thread it may be helpful to realize that we are not the only participants in this conversation.

So with that in mind, I'll share some advice a company owner once gave me when I expressed concern that his pointed but general comments did not properly apply to everyone in the room though it was know they applied to some when they were made. "If it doesn't apply to you, you can safely ignore it. If it does, consider changing your behavior accordingly."

As to publishing a standard. I'm not the guy. It sounds like you may be, or at least may be interested in seeing that happen. Maybe you are or know somebody who could help organize such an effort. I don't know. But I agree that it would be great if someone rolled up their sleeves and made it happen. I think it's a great idea! I do know it would take me far too long to gain competence in writing standards to be that person and I can contribute more to the project in other ways. At the same time, I'm as sure as I can be that anyone who would take up the task would find ready assistance with the appropriate pieces. From what I've seen, the devs here love to talk about the nitty gritty details with those who show an interest and ask the relevant questions.

Harald Eilertsen

Mon, 27 Aug 2018 18:25:31 +0200

I'm afraid I'm not the person to drive a standardization process either. At least not at this time. But it would be awesome to see it happen, thus the attempted (but failed) encouragement in the earlier reply :)

M. Dent

Mon, 27 Aug 2018 19:09:55 +0200

:)

Well, if circumstances change - or if you know someone up to the task, I think everyone would be grateful for the help!

worblux@diaspora.koehn.com

Mon, 27 Aug 2018 20:30:34 +0200 from Diaspora

@Harald Eilertsen

@M. Dent

It is still centralized because DNS is inherently centralized.

Which is to say that the Internet is inherently centralised. So we have already lost. At least if that was the case, which it luckily is not.

Names and Identities are hard, and not system is perfect. Central authorities let you avoid name space collision, and deal with change and revocation efficiently. That being said there's not reason ID4me couldn't work on top of the .onion name service or namecoin with some small modifications.

M. Dent

Mon, 27 Aug 2018 20:47:16 +0200

Perhaps not. But the point remains that there is already a system that doesn't rely on DNS and provides nomadic identity and all of their aims seem to be satisfied by a system that has been around for years - with the exception of the OIDConnect piece which has been resolved (more could be done, but it is functional) and is pretty much just awaiting testing and validation before it can be fully released.

M. Dent

Mon, 27 Aug 2018 20:59:41 +0200

*by "doesn't rely on DNS,' I mean the identity is not permanently tied to a specific domain name.

Brad Koehn ☑️

Mon, 27 Aug 2018 22:12:04 +0200 from Diaspora

DNS is inherently centralized.

I've never understood this myth. DNS is not inherently centralized. You are free to set up your own peer DNS using existing servers, simply by re-configuring the root zone file. Boom! You have your own DNS that is completely under your control. Nobody else can read it without also being so configured, but that's no different than the system we have today.

Identity (which is the problem DNS solves) is inherently a trust-based system. If you don't like the system currently in use, you can easily establish your own. Good luck getting the rest of the internet to trust yours, though.

M. Dent

Mon, 27 Aug 2018 23:32:45 +0200

Ok, a technicality. DNS as it is currently implemented on the Internet is essentially though not inherently a centralized system. (better?)

Identity is not really the problem which DNS solves. The registration of DNS records with "authoritative" root servers requires those root servers to do due diligence and attempt to assure identity, but even this is not entirely reliable. The problems of accepting DNS as an Identity system are numerous. As you mention, someone else can set up a different root server and if they happen to trick various end-users into using their DNS root servers - identity is stolen. Also, if the centralized authority with control over the root servers ceases to delegate DNS zones to a server under your control, or if they delegate DNS zones to a server under someone else's control (say, someone who happens to notice that your domain has expired and nabs it before you reregister it....) then your identity system based on DNS is unreliable.

Since the trust-based DNS system currently implemented relies on a centralization of DNS root servers and a centralized (though shared) system for updating them - and the "owner" of record does not, in fact, have complete control over their identity records, for all intents and purposes, an identity system that is tied to DNS as ID4me appears to be, is defacto centralized (even if the underlying technology does not absolutely require it to be). You yourself point out that treating DNS as untrustworthy and rejecting the centralized control makes any identity system build on top of it centralized as well. At the very least, those who have responsibility for updating the DNS Root servers ultimately control your identity - so any system that inextricably ties identity to DNS, is not truly federated system that gives individuals CONTROL over their identity (which is the claim made of ID4me in the article).

As far as trust in identity - there is no essential requirement that it be centralized. In fact, most human trust systems are not centralized. SOME centralized systems have arisen, but even those are not universally trusted by all - and with good reason. Trust should be earned and gained by common consent and agreement. It can not be forced (and anyone who forces it is usually untrustworthy because they must use force to make you trust them).

Anyway - all this is to say that to build an identity system using DNS as an integral component the system is not ultimately reliable or truly federated because of the centralization of control which, though shared, is still consolidated in the hands of a few that are beholden to certain contractual or other legal requirements that may lead to a loss of control of a users identity and therefore fails to achieve the ultimate aim that ID4me seems to be trying to aim for.

ZOT and Nomadic Identity are divorced from a reliance upon DNS. Indeed, DNS is integral to the transport and ability to check and validate identity - but a failure of the DNS system or a rerouting of requests by corruption of DNS will simply result in a failure to verify the identity or, possibly, result in a case of mistaken identity. But it will not result in theft of identity as a system inextricably tied to DNS would.

And I think that is the whole point - this conglomerate of mostly large scale ISP's who make a mint off of DNS registrations would LOVE to tie your identity to DNS... then they'll set up extra levels of DNS validation and set themselves up as those who are trustworthy and extract whatever they wish in fees... essentially doing an end run around Facebook, but still accomplishing the same thing that Facebook does - making money off your identity.

worblux@diaspora.koehn.com

Tue, 28 Aug 2018 00:20:55 +0200 from Diaspora

I’ve never understood this myth. DNS is not inherently centralized. You are free to set up your own peer DNS using existing servers, simply by re-configuring the root zone file.

All you've done there is change your center, you haven't de-centralized/federated DNS by any means. While I and many people override/provide a few entries in a hostfile for personal use/naming these won't/don't work when you move to a different network or machine. If you mess with your DNS too much all of a sudden you aren't working with a global name-space.

M. Dent

Wed, 29 Aug 2018 23:23:43 +0200

@Harald Eilertsen

After a little research - perhaps there is absolutely no need to do any sort of standardization ---- it's already baked in!

https://openid.net/specs/openid-connect-discovery-1_0-21.html#IssuerDiscovery
https://tools.ietf.org/html/rfc7033

We just need to make sure our implementation is compliant.

@Mike Macgirvin - do you know off hand if we are - or could easily be compliant with section 3 of rfc7033?

Harald Eilertsen

harald@hub.volse.no