News for hackers. Stuff that matters.
Re:atproto and the ownership of identity by jazzyjackson on Saturday January 18, 2025 @04:33PM (#42751596)
It's really not a convincing pitch to me. It just raises the cost of bots to whatever I have to bribe a poor person to let me scan their documents, and it doesn't do anything to prevent me from putting an LLM in charge of my posts.

Maybe you could require biometric login, something that requires a Google, Apple, or Yubikey issued secure enclave that authenticates on physical touch / face ID, and require that touch for every post.

For me as a person participating in online communities, I'd rather just stay in my private group chats where I have met the people I'm interacting with.

Re:atproto and the ownership of identity by dom96 on Sunday January 19, 2025 @06:33AM (#42756150)
No solution is perfect unfortunately. Even biometric login is easily duped, you can just hire a bunch of workers to pass the biometric check. Certainly much cheaper than bribing poor people to scan passports, eventually you'll run out of passports and we have a chance of identifying those types of accounts based on the passport country and how they behave.
Re:atproto and the ownership of identity by lxgr on Sunday January 19, 2025 @02:16PM (#42760566)
"Proof of <x>hood" is explicitly a non-goal for FIDO authenticators, and implementors go to great lengths to make it impossible (primarily for privacy reasons); that's why they support anonymous attestation only, except in an enterprise context.

That's the thing about reusing existing services and protocols for "proof of x": Quite often, such proofs being possible are often adjacent to or explicitly an anti-goal.

Apple does indeed offer an API that allows uniquely identifying a given device in a privacy-preserving way, though: There's an API that allows apps to store two bits of information about a given device, such as "this device was involved in fraudulent activity on our platform" or "this device has already redeemed a free trial at one point". Not sure if Google has an equivalent.