Similarly, unless the plan is to tell people that one mistake or hardware failure means they irrecoverably lose their identity, the same process which allows replacing an old key with a new one can be used to replace you.

Finally, there appears to be either no benefit or a big privacy impact mapping keys to profiles on sites. If I go to a website and see “J. Random User” I have to trust that the owner of that site verified their identity against the expected source; if I see something like a signature against a particular key, there's a privacy issue from making it so easy to link you across sites and other activity (yes, people can use ), and if you don't trust the site operator you still have the problem of them showing a different ID when they're doing something dodgy.

I thought, this is one of the main points we want to avoid here, so why are you phrasing it as something so unimportant?

The larger point here is that there's no benefit to the user if the experience is replacing “Login with Google” with “Login with <large exchange>”, which is what it would be for the vast majority of users. If it's saying “Login with your private key”, it would be important to think about why OpenID/Persona didn't catch on or the already-supported x509 key support which has been available for decades.

Why did SIM chips take off? Why did credit cards with smart chips take off? These both embed private keys. Even desktop computers are now embedding private keys in their motherboards.

Clearly, something is missing from your analysis.

- for one-off payments it doesn't matter anyway, you just start using the new card and that's it

- and for recurring payments all businesses already need to allow for updating your credit card details because credit cards regularly expire anyway, so having to possibly manually update all your recurring payments might be a bit tedious and annoying, but it's certainly no impossible, out-of-the-ordinary task

And yet you are unable to say what or offer relevant examples. Do you login in to websites using the key on your phone's SIM or your credit card? Both of those are amusing because they're bot not only irrelevant to the scenario in question but also something people use because that's what they were given, not something they sought out.

> what part of that says “here's a benefit to you which is worth paying $$$ for!” to a normal person?

You get to keep your contacts even if you get booted off the platform (or your contacts do).

And it doesn't cost anything.

* Cancel your account for suspected fraud

* Fall for a password recovery or other attack on your credentials

* Cancel the entire service

* Introduce fees for the service

* Disconnect the identity service from the site where you authenticate

* A blockchain could increase the fees for service. Wait, that happens on a daily basis and you have no control over it.

* A blockchain user could fall for an attack. Unlike the Google scenario, there's no way to regain control of your account – time to setup a new one and convince everyone you work with to update.

* The site you're actually trying to use could switch to a different blockchain (which is more likely than only offering login with Google or that being canceled).

* The site you're using could check a list of addresses and ban yours because it's suspected to be associated with fraud

This is why I suggested taking off your salesguy hat and thinking about what this is like for normal people. Switching to a system which has mandatory upfront inconvenience and expense needs to have a big win to be worth it for people. If it's all “you'll find something to do with it later” you'll get adoption like GPG did.

In this case, I think the key thing to consider is why people use Gmail. It's not like you can't run your own email server, but most people don't want to be responsible for something that important.

A blockchain can be used to tie additional information to the public key.

> The site you're actually trying to use could switch to a different blockchain (which is more likely than only offering login with Google or that being canceled).

I hope they don't use any blockchain at all.

> Unlike the Google scenario, there's no way to regain control of your account

Recovery mechanisms for private key based identities have been designed and implemented.

That is not how blockchain works. Once someone has your private key they can make any transactions that they want, you cannot undo those changes once they are on the blockchain.