Conceptually, there is an important distinction between "mechanism" and "policy." There are many, many mechanisms for handling legal/technical control/ownership/system of record/etc. This is a problem with solutions that date to the beginning of civilization. Whether mechanism is pieces of paper in a vault or replicated records in different jurisdictions or hashes on blockchain matters only on the margins.

Policy is the hard part. What happens when mechanism fails or when the parties relying on the mechanism have disagreements about the implications. When there is disagreement about which blockchain is authoritative. (Sometimes blockchain people call this "governance" and wish to solve it also with mechanism.)

Anyway, there are good reasons for human organizations to act in a policy/governance capacity. One may think of any particular organization as flawed, which is no doubt true. But in any context where people depend on the mechanism working "correctly" people are the only participants who can provide that assurance.

The most popular decentralised domain name system is ENS. While domains are not called NFTs (ENS predates the term) it functions more or less how you described.

https://ens.domains/

Of course it's not lol, like anything Blockchain it adds no value and makes everything it touches worse. If Apple loses their domain NFT should they what, just re-brand the business?

There's a reason we have a chain of trust and authority leading all the way up to the supreme court and not just "yolo, SFYL."

[edit] Like all the distributed identity plays, "not your keys, not your life" is such an asinine model to try and foist on people.

I've done published research in cryptocurrencies in its earlier days when I was in academia and I was very open-minded about it, but ultimately I came to the same conclusion: it's difficult to think of much that it does better than more straight-forward solutions and easy to think of downsides.

As I've gotten older and had to interact with various bureaucracies and paperwork, I've only become more convinced that lauded cryptocurrency features, such as (purported) immutability and decentralization, are a bug, not a feature. In my relatively short time on this mortal coil I've probably had to contravene some codified system four or five times by getting the right person in the loop so some rule, regulation, or contractual obligation can be lifted. No matter how hard we try, we can't anticipate everything. People will die, keys (and other vital paperwork) will be lost or destroyed, contracts will have mistakes, fraud will be perpetuated, money will be mistakenly transferred to the wrong parties, etc. All of these have happened to me and all were resolved by a sometimes annoying but ultimately effective system set up to handle such cases with some backstop authority empowered to fix things.

All of us will eventually get into some hell where we need a human to override the computer and just make the sensible thing happen. How often is it that we're on a support line just trying to get an exception to some stupid corner case into which we've gotten ourselves. It's always a relief when you can finally plead your case to the higher authority, whatever that may be, and get some damn relief. Why aren't more people concerned about a world where this isn't possible? It's an honest question. It totally baffles me.

Very good points. That's also my experience so far, and i think even the most dedicated ETH crowd will acknowledge they had to apply human authority to the source code when they found that "code is law" meant they would loose all their savings due to a bug.

However, i'm personally curious about mixed systems with crypto-identity and human-administered discovery. The best example i have in mind is the GNU Name System, where you can delegate specific names in your zone to someone else's public key, and each zone is administered by the associated public key. This way, you get technical reliability when addressing the public key directly, while still retaining user-controlled delegation of human-friendly names to build a global tree like DNS or a local friend-to-friend mapping (eg. `fatoumata.bob` to reach Fatoumata, whom you know is a friend of your well-known friend Bob advertised in his zone).

As someone who was involved in research in cryptocurrencies, what's your take on such developments?

I've never looked into the GNU name system in any detail, but it does seem to afford a reasonable degree of flexibility by allowing you to publish trust relationships and then delegate to different zones. If I'm interpreting things correctly, I can imagine people generally delegating names in their zone to ICANN in order to have something similar to existing DNS and its robust management, but additionally delegate to other entities for improved censorship resistance. For instance, dissidents could delegate to some private zone that likely offers fewer guarantees. Clients would need to be configurable and perform queries in some priority ordering.

Under this scenario, the ICANN zone could just refuse to publish an entry generated by a key that is deemed invalid (e.g., key is hacked, original private key lost, so revocation cannot by issued but authenticity verified in real life), so you'd probably end up in some situation where government blessed sources are canonical, but there's a reasonable fallback when official sources are not trusted. When these sources aren't trusted users would have to decide for themselves or do independent verification, which seems sensible to me.

I'd like to be able to have some indication that some private non-government controlled "root" zone and the canonical zone diverged so that I can then see if this is something I need to worry about.

Realistically, many buying a domain on something like godaddy would probably have their key managed by godaddy or perhaps tied to their credit card issuer, but more technical people would have the option of safeguarding their own keys.

There are other downsides to this approach in that a DHT is going to have different failure modes and scalability issues than DNS, but at least the obvious ones that occur to me are probably mostly solvable.

The iron law of blockchain is that if you think blockchain is a solution to a given problem, you don't know enough about the problem.

My takeaway from Web3 so far has been a mixed bag. On the one hand, having a wallet means you already have a pseudonymous account with payments for every dApp that has ever and will ever exist, and conversely the developers of said app reap the benefits of that fact for basically free. But this dynamic opens a whole can of worms in terms of risk.

There are plenty of ways to avoid 1:1 mapping between keys and access to/control of things on decentralised networks and blockchains, so really these are not arguments against blockchain just against a specific way you can choose to manage your keys.

Simple multisigs are a good start, as is key recovery via m of n (Shamir's secret sharing). More sophisticated systems have been built on top of this to allow, for instance, users to use their (singular) keys and to also allow a process, that remains decentralised, in which multiple [somewhat] trusted parties participate to recover access if they lose their keys or die.

These solutions are obviously more complex to build and interact with than a simple public/private keypair, hence why it has taken longer to develop them, audit then, and get to a point where they have a decent and intuitive UX (check out Argent, Gnosis Safe, among many). But if a big part of your argument against blockchain technology in 2021 is about lost keys, I'd highly recommend digging deeper into the state of the art before getting too stuck to a conclusion.

There was a time "I wouldn't use my credit card on a website because it's too insecure" made sense too, but HTTPS became the standard and we moved on. So it goes.

I'm well aware of the state of the art lol. But that's not a better system in any way. It's slower, less efficient and provides zero incremental value. And a ton of complexity and risk.

Is it possible to solve the problem? Maybe? Maybe not? I don't know. But so what if we do? In what concrete way is this better? It feels like at best we'll be right where we started.

It's a solution searching for a problem. A solution to a question nobody is asking.

[edit] personally I couldn't care less what database you choose to use to store DNS records - but it should probably be better than what we have now right?

"What if we could get everything we wanted where the root certificate isn't a nuclear weapon?"

There, I asked it.

> There's a reason we have a chain of trust and authority leading all the way up to the supreme court and not just "yolo, SFYL."

I partly agree with the argument, but i sincerely hope "your" supreme court will never be responsible for Internet governance. For what it's worth, i sincerely hope "my" constitutional council (France) will never be responsible for that either. Both are equally corrupt and reactionary entities, and i personally don't have any sort of faith in any Nation State whatsoever, as these entities were formed and architectured to oppress people and promote elites.

Well, I agree that we put our trust in technology an awful lot when we do this. But don't we put this trust into technology already?

One obstacle you described seems to be very much alive in the blockchain world today which is: what if you lose your key? Who can you turn to? Solving this (somehow) might help us to a more decentralized internet.

> But don't we put this trust into technology already?

No, that's why we have courts as the ultimate arbiters.

> One obstacle you described seems to be very much alive in the blockchain world today which is: what if you lose your key? Who can you turn to? Solving this (somehow) might help us to a more decentralized internet.

Anything short of "not your keys not your life" is a centralization risk and quickly, at the limit, approaches exactly what we have right now but less efficient.

The courts present a large problem though. Most digital crimes happen across borders. Courts are pretty much useless for ransomware, identity theft, and everything else online when the criminals are in an inconvenient jurisdiction.

Blockchain if anything shows the failure of our judicial system. Most of the cybercrimes are enabled by cryptocurrency and our justice system is hopeless to stop these payments.

Nah, they can just ban exchanging fiat for crypto and the problem goes away. It's a lack of political will, not means.

Who is “they”? What jurisdiction?

The country in which businesses are being targeted. Crypto is a payment implement for crime. If the US outlaws buying crypto, companies in the US can't pay their ransomware bills and so will no longer be targeted.

I don't think you can put this genie back in the bottle. The US is a corporation cooperative and the banks are already in crypto and only raising their holdings.

Even if the US bans it, it just moves the market more into the dark. Ransomware will still happen and still require crypto payment. The only difference is the hoops companies will do to acquire this crypto in a semi-legal way (probably by using multinational entities to route payments).

That would be a gift to every other country that doesn't follow suit.

That would be devastating to any country that doesn't follow suit. They would be the ones targeted by ransomware. So not only would they get all the ransomware attacks, they would also get all the negative value crypto creates. Since it doesn't create any positive value, that would be an excellent big brain move.

This is a pretty bad take. If you want a 100% trust less system, then sure. Go for it. But you can incorporate whatever logic you want into your smart contract. This can include giving a specific party the ability to revoke ownership.

Not a silly question, I think you've described Namecoin.

coinbase is to namebase

as bitcoin is to handshake