Yarmo - identityBlog of an Open Source developerZola2020-07-12T16:23:31+00:00https://yarmo.eu/tags/identity/atom.xmlThe Future of Online Identity is Decentralized2020-07-12T16:23:31+00:002020-07-12T16:23:31+00:00
Unknown
https://yarmo.eu/blog/future-online-identity-decentralized/<h2 id="Online_identity">Online identity</h2>
<p><a href="https://en.wikipedia.org/wiki/Online_identity">Online identity</a> refers to the concept of "being" in the digital world. As an internet user, you exist. You create accounts on websites. You write on social media and blogs. You post photos. All this online activity has in common that one and the same person performed these actions; it defines your "online identity".</p>
<p>However, your "online identity" is not <em>per se</em> representative of your "social identity" in the physical world.</p>
<p>You may choose to use your own name or a pseudonym. You may choose to publish personally identifiable information or not. You may choose to remain truthful to your social identity or deceive. In short, you may choose for authenticity or for anonymity.</p>
<h2 id="Authenticity_versus_anonymity">Authenticity versus anonymity</h2>
<p>Authenticity and anonymity aren't mutually exclusive and that is the beauty of the internet. In the physical realm, you are (mostly) limited to a single social identity. In the digital space, there are no such restrictions. While you can't embody multiple persons in the offline world, you can have several identities online. In fact, you can even have multiple accounts on the same platform, opting for a different balance between authenticity and anonymity for each one of them.</p>
<p>The anonymity has its downsides, creating psychological artifacts like <a href="https://en.wikipedia.org/wiki/Online_disinhibition_effect">online disinhibition</a> and facilitating <a href="https://en.wikipedia.org/wiki/Cyberbullying">cyberharassment</a>. However, even though we are far from completely overcoming these challenges, the internet that allows us to remain anonymous is still the one we should want and fight for.</p>
<h2 id="Consolidation_of_identity_and_internet_corporations">Consolidation of identity and internet corporations</h2>
<p>Removing the possibility for anonymity could solve the problem of online toxicity. Large internet corporations like Google and Facebook allow all to create an account on condition that some personally identifiable information is revealed, usually a phone number.</p>
<p>The benefit is that it deters most from repeatably creating new accounts when older accounts have been flagged or banned due to improper behavior. These companies gain the function of "identity provider": they manage your online identity that can be used to login in different locations of the internet. We all know many websites that offer a "Google login" or "Facebook login".</p>
<p>But there is a problem: handling the entire online identity of a single person is too much responsibility for any corporation or organization, especially if it is in their interest to gain intimate individual knowledge and sell it (Google) or use it to manipulate moods and influence decision making (Facebook).</p>
<p>That phone number that was once used to prevent online toxicity is now the first of many pieces of personally identifiable information that these corporations will seek and use to figure out who you are.</p>
<p>"You have nothing to hide"? Great. The internet corporations will still make money hand over fist by selling your personality, your preferences, your buying patterns and your vote. And not just yours. That of entire populations.</p>
<p>Know that profits are just the tip of the iceberg. Governments all around the world are also interested in knowing what their citizens think, say and do for very different motives.</p>
<h2 id="Going_decentralized">Going decentralized</h2>
<p>The solution is relatively simple. When you create a new account and get to choose between "Google login", "Facebook login" and "Email login", pick "Email login".</p>
<p>The benefit of not giving away any more personal data and tracking possibilities outweigh the inconvenience of having to fill in your email address and a password, especially when using a password manager. As tempting as the alternative is, making these changes will improve your life and ultimately, when enough people join these efforts, that of the world population.</p>
<p>A different problem arises: how to prove online identity when decentralized?</p>
<h2 id="Decentralized_online_identity">Decentralized online identity</h2>
<p>When you are no longer relying on an identity provider to manage your entire online identity, you lose the one common thing all your accounts on different platforms had: if two accounts on different online platforms are created by the same Google or Facebook account, we can safely assume they belong to the same person.</p>
<p>But this "trust by proxy" is lost when the accounts on those platforms were created without identity provider. And whether authentic or anonymous, it can sometimes be extremely useful to know and trust that separate accounts on the internet belong to the same person, even when not knowing who this person is.</p>
<p>The username is not sufficient to identify accounts across platforms. If you are "Alice" on one website, chances are you might need to be "Alice123" on the next one. And what if someone close to you is contacted by an "Aliss" requesting an amount of money to be transferred because they believe you to be in some sort of trouble? A poor attempt at impersonation, I know… Don't worry, a real bad actor will put in more effort and make a much more convincing act.</p>
<h2 id="Proving_decentralized_online_identity">Proving decentralized online identity</h2>
<p>What if not only your online identity is decentralized, but also the tool to prove said online identity? This would mean that you wouldn't need to depend on a single company or entity to prove your identity across platforms. Decentralized identity, decentralized proofs!</p>
<p>Such solutions are already being deployed in industry, for example by firms like <a href="https://indicio.tech/">Indicio.tech</a> which focus on blockchain technology.</p>
<p>Built for individuals, I recently launched <a href="https://keyoxide.org">Keyoxide</a> which uses cryptographic keypairs to accomplish decentralized identity verification. While it doesn't (and shouldn't!) link an account to a person in the physical realm, it links accounts across platforms.</p>
<p>If you trust an account on one platform, you can trust any other account on any other platform as long as they are both verified by "identity proofs" stored in the same keypair. Whether you choose authenticity or anonymity, decentralized identity proofs allow you to build a cross-platform online identity.</p>
<p>Here's my <a href="https://keyoxide.org/9f0048ac0b23301e1f77e994909f6bd6f80f485d">Keyoxide profile</a>. In this case, I link to several "authentic" accounts but I could easily generate a new keypair void of personal data that links to several anonymous accounts. The accounts don't need to be authentic to create an online persona.</p>
<p>All the accounts listed in the link above belong to me. No one else could claim these accounts. Here's how.</p>
<h2 id="Identity_proofs">Identity proofs</h2>
<p>An "identity proof" is nothing more than a link to an account A on some platform P stored inside your keypair K. If a "proof verification tool" such as Keyoxide follows this link and discovers some piece of data linking back to keypair K (which is only possible if keypair K and account A on platform P belong to the same person), the account is verified. If this proof verification is done for several accounts on different platforms, it is beyond reasonable doubt that the same person owns said accounts.</p>
<p>No bad actor could claim one of your accounts: the piece of data that links back is specific to your keypair, not the bad actor's keypair. And the bad actor also couldn't insert a proof inside your keypair as long as your keypair isn't compromised. Only you, the owner of the keypair, can add new proofs. But the entire world can read and verify them.</p>
<p>These identity proofs are decentralized because Keyoxide doesn't store them, your cryptographic keypair does. Keyoxide simply reads the keys and verifies the proofs. When you remove a proof from your keypair, Keyoxide will no longer have access to it. You own your proofs and your online identity.</p>
<p>In fact, the proofs are readable by everyone and are not specifically designed for Keyoxide. Anyone can use any tool or create new ones to verify these proofs and developers are encouraged to enrich this field with additional tools and services. Let's build a decentralized identity ecosystem we can all trust.</p>
<h2 id="Online_identity_beyond_today's_internet">Online identity beyond today's internet</h2>
<p>Initiatives like <a href="https://inrupt.com/solid">Solid</a> by <a href="https://en.wikipedia.org/wiki/Tim_Berners-Lee">Sir Tim Berners-Lee</a> are paving the way for a new internet where all data is owned by the user and shared with platforms with consent and restrictions. This would solve the online identity problem: you get the benefits of a "pseudo centralized" account while maintaining full ownership over all account-related data stored on a decentralized platform. Social media would be allowed to see some data, messaging platforms some other data. But there would still be one single account to rule all the platforms.</p>
<p>On today's internet, the best we can do is make fully separated accounts, link them using technologies like decentralized online identity proofs and create our own online personas, with our own open tools that ensure we maintain ownership over them.</p>
Launching Keyoxide.org2020-07-01T12:00:00+00:002020-07-01T12:00:00+00:00
Unknown
https://yarmo.eu/blog/keyoxide/<p>Today, I'm excited to launch <a href="https://keyoxide.org">Keyoxide.org</a>, the lightweight and FOSS solution to make basic cryptography operations accessible to regular humans.</p>
<h2 id="What_is_Keyoxide.org?">What is Keyoxide.org?</h2>
<p><a href="https://keyoxide.org">Keyoxide.org</a> offers easy encryption, signature verification and decentralized identity proof verification based on PGP keys while demanding little in-depth knowledge about the underlying encryption program from its users.</p>
<p>This project aims to offer comparable functionality as services like <a href="https://keybase.io">Keybase</a> while reducing friction and being more open.</p>
<p>The project is MIT licensed, uses <a href="https://github.com/openpgpjs/openpgpjs">openpgpjs</a> and is hosted on <a href="https://codeberg.org/yarmo/keyoxide">Codeberg</a>.</p>
<h2 id="Why_only_encryption_and_signature_verification?">Why only encryption and signature verification?</h2>
<p>These are the operations that are available when only having access to public keys instead of private keys. If you wish to decrypt messages and sign them, you need a keypair. If you have a keypair, you probably have the knowledge to use dedicated tools like the CLI or Kleopatra. And if you do, you probably won't be using <a href="https://keyoxide.org">Keyoxide.org</a> directly yourself.</p>
<p>Indeed, if you possess a PGP keypair, <a href="https://keyoxide.org">Keyoxide.org</a> is the tool you send to others to interact with your public key more easily. Allow them to encrypt a message for you, to verify one of your signatures, to verify your online identities using decentralized proofs.</p>
<h2 id="What_are_those_decentralized_identity_proofs_you_keep_mentioning?">What are those decentralized identity proofs you keep mentioning?</h2>
<p>You know how Keybase allows you to prove you have control over accounts on certain websites and services? A great function! Fortunately for you, this function can be even better and more secure by using <a href="https://keyoxide.org/guides/openpgp-proofs">decentralized OpenPGP identity proofs</a>. <a href="https://keyoxide.org">Keyoxide.org</a> will prove your identity on multiple platforms at the same time and yet, you are not required to make an account to use this function. How is that possible?</p>
<p>Well, it's called <em>decentralized</em> for a reason: <a href="https://keyoxide.org">Keyoxide.org</a> doesn't hold your proofs, your key does! Any software that can access your public key can verify these proofs for anyone. When better tooling comes around, you could verify those proofs using a mobile app, using a command-line utility, you name it. No single service holds your proof, only you do, stored inside your keypair.</p>
<p>I have written a <a href="https://keyoxide.org/guides">guide</a> on how to add a proof for every platform currently supported by this website: <a href="https://keyoxide.org/guides/dns">domains</a>, <a href="https://keyoxide.org/guides/lobsters">Lobste.rs</a>, <a href="https://keyoxide.org/guides/twitter">Twitter</a>, <a href="https://keyoxide.org/guides/github">Github</a>, a <a href="https://keyoxide.org/guides">bunch more</a> and work is in progress to support even more still. Is your beloved service not in the list? <a href="https://codeberg.org/yarmo/keyoxide">Open an issue or make a PR</a>! Free open-source software FTW!</p>
<p>Oh, that reminds me, any <a href="https://keyoxide.org/guides/mastodon">Mastodon</a> instance can be used to prove your identity. Yes, <a href="https://github.com/keybase/keybase-issues/issues/3385">any</a>.</p>
<h2 id="So_how_does_it_compare_to_Keybase?">So how does it compare to Keybase?</h2>
<p>There's a more complete <a href="https://keyoxide.org/guides/feature-comparison-keybase">guide on the Keyoxide website</a>, but in a nutshell:</p>
<ul>
<li>more privacy-friendly by not forcing you to create an account and handing over data</li>
<li>more secure by not asking you to trust the service with your private keys</li>
<li>open-source servers (<a href="https://github.com/keybase/client/issues/24105">a must</a>)</li>
<li>encrypt/verify with every public key accessible on the internet, not just those that have been uploaded to a proprietary server</li>
<li>almost all processing is done in the browser, no data is sent to servers*</li>
<li>no vendor lock-in</li>
<li>selfhostable</li>
</ul>
<p>* Only exception is decentralized identity proof verification: some service providers do not have the correct CORS headers (like Reddit) or require APIs (like Twitter). In these rare cases, simple PHP scripts (also open-source) run the proof verification instead.</p>
<h2 id="Can_I_get_an_account?">Can I get an account?</h2>
<p>No. <a href="https://keyoxide.org">Keyoxide.org</a> doesn't need your data on its servers. There are already several ways of exposing public keys on the internet, including <a href="https://keyoxide.org/guides/web-key-directory">web key directory</a> (WKD) and dedicated servers like <a href="https://keys.openpgp.org">keys.openpgp.org</a>. Let's use those instead of making yet another service where you need to upload your keys to.</p>
<h2 id="Can_I_get_a_profile_page_then?">Can I get a profile page then?</h2>
<p>Yes! Append your PGP fingerprint or WKD id to the URL and there it is!</p>
<p>Want an example? Here's my profile at<br />
<a href="https://keyoxide.org/9f0048ac0b23301e1f77e994909f6bd6f80f485d">https://keyoxide.org/9f0048ac0b23301e1f77e994909f6bd6f80f485d</a>.</p>
<p>Now you know what accounts on various services are mine, where to follow me if you wish to get updates on the project and if you wish to send me an encrypted message, that's also just two clicks away.</p>
<h2 id="What_about_my_private_keys?">What about my private keys?</h2>
<p>Don't upload your private keys to the internet, period. If a service wants your private keys on their (proprietary) servers, say no.</p>
<h2 id="You_said_selfhostable?">You said selfhostable?</h2>
<p>Well, yes! It's not a fully supported use case just yet, but the browser does all the processing, the server is mostly just there to deliver the files to the user to perform the operations. <a href="https://codeberg.org/yarmo/keyoxide">Grab the code</a> and put it on your own PHP server!</p>
<h2 id="Any_closing_words?">Any closing words?</h2>
<p>I built this to provide better tooling around modern-day encryption programs and reduce the friction for less tech-savvy people when interacting with public keys.</p>
<p>For those who wish to use encryption programs beyond OpenPGP, <a href="https://codeberg.org/yarmo/keyoxide/issues">let's talk about this</a>. Keyoxide doesn't have any reference to PGP in its name for a reason: it could serve as a platform for easy interaction with any public key, no matter the underlying encryption program.</p>
<p>And above all, I hope you see the same benefit and potential in <a href="https://keyoxide.org">Keyoxide.org</a> as I do and would like to see it grow as an open and accessible platform to push forward the democratization of online privacy and security.</p>
<p>Privacy is not a luxury.</p>
<p>Many thanks to <a href="https://metacode.biz/@wiktor">Wiktor</a> for helping with the decentralized identity proofs.</p>