Replying to @aalexis1234 and @BobSummerwill
I plan to be there & the builders day before.
RT @KamesCG: Decentralized identity is a lot of things to a lot of people. For some it’s simply a technical challenge. Others it’s a chance…
RT @KamesCG: Establishing networks of trust is woven into Mankind’s DNA. We are a species of community and coordination. We navigate this r…
Identity barriers for on/off ramps to Bitcoin are getting quite annoying. Not accepting AUS passport & US greencard seems extreme, but I presume it is a NY bitlicense requirement or a conservative interpretation of it. Unfortunately, by ignoring identity we become hostage to it. https://twitter.com/skycorridors/status/1014205763647082498
I’ve been saying for years that a number of older cryptographic systems like Chaumian e-Cash & Brandian/uProve Blinded Signatures should be revisited given existence of blockchain tech. It’s started given future Schnorr! Slides from @n1ckler #BuildingOnBtc https://nickler.ninja/slides/2018-bob.pdf
Transcript of @n1ckler’s presentation at #BuildingOnBitcoin by @kanzure on Blind Signatures & Scriptless Scripts http://diyhpl.us/wiki/transcripts/building-on-bitcoin/2018/blind-signatures-and-scriptless-scripts/
I have joined the Advisory Board of Veres One, a browser-centric, fit-for-purpose, self-sovereign identity focused blockchain. Also a different business model: No token, no ICO — all services are paid for by the users in fiat, with percentages of revenue dedicated to open source. https://twitter.com/manusporny/status/1014304464461881350
Our biggest fans this week: @pierre_rochard, @giacomozucco, @bitstein. Thank you! via https://sumall.com/thankyou?utm_source=twitter&utm_medium=publishing&utm_campaign=thank_you_tweet&utm_content=text_and_media&utm_term=d0ab6b00ad990b36d99f7a0b
The intent of Open Banking in the EU is to increase competition for customers by allowing portability. However, apparently the administrative hurdles are so high that users are not taking advantage of it. A new competitive case study of barriers to exit? Like moving domains are. https://twitter.com/chris_skinner/status/1014397660323831808
👍Insightful graphic by @VladZamfir that explores a model for the intersection & edges of game theory, markets, mechanism design, distributed systems, incentive design & blockchains. Needs some exploring by experts in each of these knowledge domains to see if missing some edges. https://twitter.com/vladzamfir/status/1014882947781087233
RT @VladZamfir: @ChristopherA I can already feel dist sys ppl chiming in about how incentives don’t matter or don’t exist or aren’t compute…
RT @AnnaLysyanskaya: @gregoryneven @ChristopherA @n1ckler Yup – both on the let’s revisit Chaumian stuff, and on let’s not use blind Schno…
RT @trbouma: @boscolochris Thanks for this! In Canada, we’re starting to think how we can relate #digitalidentity to Section 6 of the Chart…
RT @_shaunconway: Impact Tokens tell the story… @ixo_impact https://t.co/AxU1rsWvAd
The video presentation at #OffTheChain by @pedrorechez on the paper on Lightning Network “Multi-hop Locks” is now available. Their approach & proof for a “Scriptless ECDSA” shoud very useful until Bitcoin gets Schnorr. Great work! 👍 https://www.youtube.com/watch?v=sUxh6wO_Z00&feature=youtu.be&t=9m10s
RT @ChristopherA: The video presentation at #OffTheChain by @pedrorechez on the paper on Lightning Network “Multi-hop Locks” is now availab…
👍👏I’ve been looking forward to @pwuille’s formalization of Schnorr Signatures using bitcoin’s secp256k1 curve for a LONG time. 64 bytes! A lot of work is behind this to ensure security for musig & other interesting constructions possible in the future: https://github.com/sipa/bips/blob/bip-schnorr/bip-schnorr.mediawiki
Replying to @KyleSamani
The Schnorr patent didn’t expire until February 2008. In the meantime the NSA designed ECDSA had been available, implemented & studied for over 10 years under a royalty-free license. Satoshi was wise to not use immature Schnorr code in 2009. Ten years later it is now time!!
RT @ChristopherA: @KyleSamani The Schnorr patent didn’t expire until February 2008. In the meantime the NSA designed ECDSA had been availab…
👍More important than you think—our brains guess Gaussian, but Networks have Big Tails: “In Mediocristan, no observation can really change the statistical properties. In Extremistan, the tails (the rare events) play a disproportionately large role in determining the properties” https://twitter.com/nntaleb/status/1015050372329680898
RT @notgrubles: When you forget Ethereum couldn’t implement multisignature storage correctly: https://twitter.com/KyleSamani/status/1015386893393985536
One of the challenges of Schnorr is that it is so incredibly powerful & elegant that it appears to be simple—this leads naive implementations with severe consequences. In addition, early implementations were focused on single sig use cases & today’s are multisig. Hard problems! https://twitter.com/bitcoinerrorlog/status/1015327043536523269
Replying to @aalexis1234
I’m fairly confident given how conservative @pwuille is that this formalization is pretty solid. But we need more non-bitcoin members of the cryptographic community to give a look to see if something still missing. Next, sidechannel-resistant code needs coding & security reviews.
RT @Drabiv: Till now only kings and nations where sovereign. The king was a sovereign, others were subjects. Now #SovereigntyEnablingTechno…
RT @Drabiv: …it opens a way to create an “Organization of United Humans” based on Self-Sovereign Identities that uniquely represent huma…
Replying to @aalexis1234, @pwuille, @el33th4xor and @Cornell
In some ways @el33th4xor is still probably too close to bitcoin community for good review — I wouldn’t be surprised if he saw early versions. I’d like to see review of this Schnorr from many different domains @hashbreaker @JanCamenisch @AnnaLysyanskaya @Bryanosaurus @timdierks
RT @ChristopherA: @aalexis1234 @pwuille @el33th4xor @Cornell In some ways @el33th4xor is still probably too close to bitcoin community for…
Should not go that broad for review of Schnorr — it is fairly specific knowledge required for review of this. I don’t feel qualified myself, more that I have a good understanding of why it isn’t easy. Unfortunately, leading edge cryptographers are doing quantum resistance work.
RT @pwuille: @pbarreto @Snyke We’ve since updated our MuSig paper whose proof was broken by that paper, replacing it with a 3-round scheme.…
There is a line where too many people without sufficient knowledge can lead to bikeshedding. You want the correct “requisite variety” (a cybernetic term) with both amplification AND attenuation. Otherwise feedback systems can fail to deliver good results. A designer’s fine line.
RT @DarioTepoTec: @pwuille, of 🇧🇪, proposes a standard for 64-byte Schnorr signatures over the elliptic curve secp256k1.
Belgium 🇧🇪 beats…
Replying to @michaelfolkson, @kanzure and @KyleSamani
Schnorr has been implemented elsewhere, in particular in combination @hashbreaker’s 25519 curve. However, these implementations are focused on single-signature use cases. @pwuille’s formalization is focused on fast verification In multisig use cases & address multisig attacks.
RT @ChristopherA: @michaelfolkson @kanzure @KyleSamani Schnorr has been implemented elsewhere, in particular in combination @hashbreaker’s…
Replying to @cryptodoger, @kanzure and @KyleSamani
Bitcoin does not use the standard NIST defined ECDSA curve’s “random” constant which is widely questioned as being created by NSA. Instead, Satashi chose a variation called secp256k1 which has a prime constant considered safer. https://bitcointalk.org/index.php?topic=289795.msg3183975#msg3183975
RT @ChristopherA: @cryptodoger @kanzure @KyleSamani Bitcoin does not use the standard NIST defined ECDSA curve’s “random” constant which is…
Replying to @johnny10MD, @Fiskantes and @KyleSamani
https://twitter.com/christophera/status/1015401476846280705?s=21
RT @kimdhamilton: I’m very excited to announce that next W3C CCG meeting will focus on uPort DID/VC Protocols, Libraries & Solutions. Join…
👍🗝💬“I have overvalued reasoning in myself and others and undervalued pride, fear and the need to belong. I’ve been operating like an economist, in other words — an economist from the 1960s.” https://thewholestory.solutionsjournalism.org/complicating-the-narratives-b91ea06ddf63
👍🗝💬“The idea is to revive complexity in a time of false simplicity…reporters do the opposite…we look for coherence, which is tidy — and natural. The problem is that, in a time of high conflict, coherence is bad journalism, bordering on malpractice.” https://thewholestory.solutionsjournalism.org/complicating-the-narratives-b91ea06ddf63
RT @ChristopherA: 👍🗝💬“The idea is to revive complexity in a time of false simplicity…reporters do the opposite…we look for coherence, which…
👍🗝💬“What is oversimplified about this issue? How has this conflict affected your life? What do you think the other side wants? What’s the question nobody is asking? What do you…need to learn about the other side in order to understand them better?” https://thewholestory.solutionsjournalism.org/complicating-the-narratives-b91ea06ddf63
RT @ChristopherA: 👍🗝💬“What is oversimplified about this issue? How has this conflict affected your life? What do you think the other side w…
RT @theyblinked: Five Questions For Credential Issuing Systems
“When the blockchain is properly used as a decentralized verification netwo…
Though it is a cool security UI idea (color changing keyboard to reflect security) without a trusted interface between computer and display it is likely to be hacked along with the primary hack. I do, however, like the idea of a keyboard with an HSM/TPM. https://twitter.com/drwhax/status/1016290493297242112
Replying to @DanielSolis
If you want advice and insider jokes, let me know.
RT @rdonoghue: Whelp, HBO had a good run. I do not look forward to watching its hollowed out corpse shamble around.
“To act jointly, we journey from disparate places to a coherent, collective sense of what is real, what we desire & what we will do to accomplish it. Group alignment emerges through conversations that generate shared stories, understandings & decisions.” http://groupworksdeck.org/patterns/Moving_toward_Alignment
Latest #RebootingWebOfTrust Design Shop white paper (the 35th!!) has gone now to Final Draft “Open Badges are Verifiable Credentials” led by @ottonomy & @kimdhamilton—from here we take it to the W3C Credentials CG for further discussion towards a standard. https://github.com/WebOfTrustInfo/rebooting-the-web-of-trust-spring2018/blob/master/final-documents/open-badges-are-verifiable-credentials.md
RT @patestevao: My presentation at @build_on_btc about building ⚡️Lightning Network interfaces that avoid breaking the Bitcoin user’s menta…
RT @kate_sills: Thread on the difference between transactions and contracts:
My long-time co-author @Appelcline & I have turned in our manuscript for “Meeples Together” on design & theory of collaborative tabletop games, to be published by @GamePlayWright. Hopefully first in series. Here is a photo from our early re-design of Arkham Horror 15+ years ago!
Tomorrow’s W3C Credentials CG call (IRC & VoIP) Tuesday at 12p ET (9am PT) will be focused on report out by one the teams implementing DIDs (Decentralized Identifiers) & Verifiable Credentials—@Consensys @uport_me using the Ethereum blockchain & EIP 1056 https://lists.w3.org/Archives/Public/public-credentials/2018Jul/0013.html
RT @kimdhamilton: “Open Badges are Verifiable Credentials” by @ottonomy and me describes combining the rich vocab, expressiveness, ecosyste…
You can get updates about our upcoming Kickstarter & release of the book “Meeples Together” via our new Twitter account @MeeplesTogether or Facebook https://www.facebook.com/MeeplesTogether/ — @Appelcline & I also have plans for a blog with cooperative game reviews that didn’t make it into book.
RT @ChristopherA: You can get updates about our upcoming Kickstarter & release of the book “Meeples Together” via our new Twitter account @…
RT @JoeAndrieu: @kimdhamilton @BryceWeiner With those working on the standard, it’s well understood that the best practice for maximum priv…
RT @windley: In a study by Omidyar 1.2 million people denied access to rations because of Aadhaar-related issues. Identity problems can cau…
Replying to @windley and @Subhashish30
Link to study?
RT @JeremyRubin: Adapter signatures: a swapped pair of tweaked signatures which are both damaged by the same tweak. Revealing one non tweak…
#qotd (quote of the day): “Start a stone rolling so in three centuries you’ll have an avalanche.” — @tithenai quoted by @katarinahit via @maxgladstone. I hope I’ve started some stones rolling that will not take quite so long.
RT @MeeplesTogether: So what’s @MeeplesTogether ? Co-author @Appelcline wrote a long journal entry today about the evolution of this book o…
RT @Appelcline: I’ve got an unsightly 6-7 books in progress right now. Fortunately one more went to the publisher today: @MeeplesTogether,…
RT @jefftidball: Meeples Together (@MeeplesTogether) will be a @Gameplaywright release! We’re thrilled to be publishing this great manuscri…
“Consciously decide to give more attention to where we agree than where we don’t. By tuning in to what we share, we find the way to make progress together.” #GroupWorks https://groupworksdeck.org/patterns/Common_Ground
RT @FutureCitiesPGH: Few innovations could have as far-reaching impacts on city life. The best part? Superblocks are virtually free. Let’s…
RT @kimdhamilton: Today’s Credential CG meeting was especially epic: @uport_me, DIDs, and … smooth jazz? You’ll have to listen https://t.…
Is anyone working on HSM/TPMs under the RISC-V architecture? We need open source/open patent solutions in this space as proprietary Intel & ARM solutions are scary. https://twitter.com/radhakrshn11/status/1016763480706252801
Replying to @floatfloatboat
But is it being implemented by anyone? Any silicon commitments?
Replying to @PindarWong, @risc_v and @SiFiveInc
I have a @SiFiveInc developer board & am waiting for the companion “Unleashed” expansion board before playing around more. Trying to identify folk interested in TPM/HSM architectures using RISC-V, but I don’t come from a hardware background so still have a lot to learn.
Replying to @hrdwrknvrstps
uPort is only one of many DIDs being currently deployed. Both @SovrinID & @VeresOneID are fairly far along, there is BTC-based DID hackathon starting Monday, and many more unannounced ones on way.
RT @ChristopherA: @hrdwrknvrstps uPort is only one of many DIDs being currently deployed. Both @SovrinID & @VeresOneID are fairly far along…
This constant-time verifiable sort is mostly useful for securing lattice-based cryptography, which is one of a number of possible post-quantum cryptography solutions. But I suspect there may be other uses. @pwuille? @tdierks? @moxie? @JanCamenisch? Is Paul Kocher on Twitter? https://twitter.com/hashbreaker/status/1016821281998721025
Our biggest fans this week: @theonevortex, @pierre_rochard, @giacomozucco. Thank you! via https://sumall.com/thankyou?utm_source=twitter&utm_medium=publishing&utm_campaign=thank_you_tweet&utm_content=text_and_media&utm_term=d0ab6b00ad990b36d99f7a0b
RT @sciphijournal: Why the Culture Wins: An Appreciation of Iain M. Banks http://sciphijournal.org/why-the-culture-wins-an-appreciation-of-iain-m-banks/
RT @smdiehl: Open sourced a new Haskell bulletproofs library for constructing short non-interactive zero-knowledge proofs that require no t…
Replying to @twshelton, @hrdwrknvrstps, @SovrinID and @VeresOneID
Details on next week’s BTCR DID Virtual Hackathon are at https://w3c-ccg.github.io/announcements/
Replying to @jdegoes and @prezcannady
I’ve been successful with that strategy in past. SSL/TLS was built by team at 80% salary 20% time off during peak of dotcom boom. Trying again: https://twitter.com/christophera/status/995413235451875328
“Shepherding a group discussion includes discerning when the group needs a wider view vs. when to sink down into the details. Zoom out to see vision, patterns, and overall trends; zoom in for examples, specific data, and other particulars.” https://groupworksdeck.org/patterns/Seeing_the_Forest_Seeing_the_Trees #GroupWorks
Some interesting thoughts here about leveraging zksnarks—it can prove that a leaf is a member of a merkel tree without reavealing which leaf it is or the leaf pre-image. It needs quite a bit of review & I’d like to see it generic & an academic-style paper with some formal proofs. https://twitter.com/barrywhitehat/status/1017438443373096965
RT @alexbosworth: Routing/Swaps is only 1 type of paid service that a LN node operator could provide
Others:
- Watch for channel breaches…
Replying to @prezcannady and @jdegoes
Choices were 1-day off a week, arrive late or leave early, or 10 weeks vacation (max 4 weeks at a time). We had several people with families use the first alternatives, others preferred the vacation time. More recently I had 1-day off a week with Blockstream to do dentity work.
Replying to @prezcannady and @jdegoes
Our CFO at Consensus Development was @CastroLang, who took day off a week as he was an ordained minister to a local struggling church. Several people had kids they took home from school. @tdierks & I took long breaks to refresh.
Replying to @tdierks, @prezcannady, @jdegoes and @Castrolang
I remember your month long vacation post shipping SSL-Plus where we struggled to answer some customer questions. 😊 In actuality it ended being a good thing as it forced the rest of the team to be able to answer them.
Replying to @tdierks, @prezcannady, @jdegoes and @Castrolang
It wasn’t a perfect system. I vaguely remember that for those who took off one day a week we eventually tried to have a policy of “any day EXCEPT Wednesday” so we could consistently schedule meetings . But I think it key thing was to express the intent it was important value.
This is why we need to move to transparent open source & open patent solutions like RISC-V 👇 https://twitter.com/iohk_charles/status/948923810618671104
RT @NickSzabo4: No. We already have several words for that: “program.” Also “software”. Or “dApp” if it’s distributed. You need not and sh…
Replying to @fp_robo
We are in the process as a community to revise the 10 self-sovereign identity principles. We probably should not have started with “#1 Existence” as it is the hardest, but will be staring on “#2 Control” on 7/23. See lively discussion of #1 at https://github.com/WebOfTrustInfo/self-sovereign-identity/issues/6 — join us!!
RT @ChristopherA: @fp_robo We are in the process as a community to revise the 10 self-sovereign identity principles. We probably should not…
RT @fp_robo: A small preview of FPR’s forthcoming paper on self-sovereign digital identity
Here is a beginning of a discussion on revising self-sovereign identity principle #2 “Control. Users must control their identities.” Goal is to revise this principle by end of month, and all 20 principals by October. https://github.com/WebOfTrustInfo/self-sovereign-identity/issues/8
Replying to @fp_robo
https://twitter.com/christophera/status/1017889460598419456?s=21
Amira 1.00 from #RebootingWebOfTrust is final! “In our scenario, Amira is a successful programmer working in Boston at a prestigious multi-national bank. Outside of working hours, Amira wants to give back to her community by writing software that matters.” https://github.com/WebOfTrustInfo/rebooting-the-web-of-trust-fall2017/blob/master/final-documents/amira.md
Many thanks to @JoeAndrieu for taking leadership on this document! The topic is very important to me as it reflects the original vision (almost 3 years ago!) of what I hoped #RebootingWebOfTrust might be able to accomplish! Also a thank you to the many other contributors…
A shout out & thank you to the other co-authors of #RebootingWebOfTrust Amira 1.0.0 including @Appelcline, @CaptainCalliope, @tonilanec, Tim Chen, @davetfields, Micheal Haley, @digitalsista, @heathervescent & @IdentityWoman — also contributors Patrick McBennett, Raghav Chawla.
Replying to @AnnaLysyanskaya, @gregoryneven, @n1ckler and @FBaldimtsi
For full reference “Anonymous Credentials Light” by Foteini Baldimtsi, Anna Lysyanskaya “We define and propose an efficient and provably secure construction of blind signatures with attributes.” https://eprint.iacr.org/2012/298.pdf
RT @ChristopherA: @AnnaLysyanskaya @gregoryneven @n1ckler @FBaldimtsi For full reference “Anonymous Credentials Light” by Foteini Baldimtsi…
Replying to @AnnaLysyanskaya, @gregoryneven, @n1ckler and @FBaldimtsi
I’d love to see a #SmartSignature predicate language (NOT a consensus script) that could directly support Schnorr operations such as scriptless scripts operations, as well as operations to support these BL anonymous blind signatures & attributes.
RT @ChristopherA: @AnnaLysyanskaya @gregoryneven @n1ckler @FBaldimtsi I’d love to see a #SmartSignature predicate language (NOT a consensus…
RT @ericasadun: [http://self.be(Best.self)
](http://self.be(Best.self)) (shamelessly stolen from@IanKay)
On Monday at 9am PT, the W3C Credentials CG is hosting a 5-day virtual hackathon on making some ideas behind this Amira user story possible by implementing a proof-of-concept using Bitcoin-based DIDs (Decentralized Identifiers) & Verifiable Credentials: https://w3c-ccg.github.io/announcements/
RT @ChristopherA: On Monday at 9am PT, the W3C Credentials CG is hosting a 5-day virtual hackathon on making some ideas behind this Amira u…
On the side I’m a collaborative tabletop & story game designer, and I really appreciate elegant simple games. Just ran across this very topical party game “Elon Musk’s iPod Submarine” that I quite admire: https://twitter.com/tinstargames/status/1017660844048506880
Here is a blast from the past. I’ve posted my old free one-page “Monster Smash” tabletop monster battle game from 1994-2001. All you need is some PlayDoh! At one point you could not go to a Bay Area game conv without smelling PlayDoh in the morning 😎 https://github.com/ChristopherA/MonsterSmashGame2001
Inspired by this simple game from @tinstargames I’ve found my once popular 1-page Play-Doh monster game “Monster Smash” and have posted it on my github https://twitter.com/ChristopherA/status/1017996401651793921
Some of my favorite photos of “Monster Smash” games circa 2001.
Replying to @lopp
I personally like the coldti — I don’t use the screws, and you’ve shown me another reason to avoid them.
RT @darrello: Allowing ME to own MY digital identity means that you can focus on our relationship. (not being hacked, losing my account inf…
RT @kimdhamilton: I’ll be speaking about Decentralized Identifiers and Verifiable Credentials at a webinar July 24 with a great lineup of s…
RT @MeeplesTogether: A #FridayQuestion — what was you first co-op board game and what did you think of it?
Replying to @Appelcline and @MeeplesTogether
My first co-op tabletop game was the old first edition of #ArkhamHorror. I’d just moved to California & fell into a crowd of Call of Cthulhu RPGer’s that played it when the GM was busy. I loved the way the players competed against the board rather than each other.
Replying to @clifton_r and @hasufl
I thought that was called Lamarkian Poker. https://boardgamegeek.com/boardgame/3270/lamarckian-poker
Replying to @tim_bansemer
Definitely a topic I have some expertise with. However, I’ve found many people from blockchain communities have simplistic or naive knowledge. In particular when I hear words “voting” or “majority” it often means they don’t truly understand 25+ century history of democracy.
Replying to @tim_bansemer
At this point I focus on conferences that are more interactive such as design workshops, open space, socratic roundtables, etc. rather than “sage on stage” events. I will speak at other conferences, but only at minimum if expenses covered.
Replying to @2357_is_prime and @brian_trollz
I call it poor man’s secret sharing. Not as secure, but doesn’t require a computer to deconstruct or construct.
Replying to @midmagic, @CryptoPietje, @KBryanW and @brian_trollz
There is a lot of research that that multiple-party secret sharing splits are not very resilient as psychologically the other parties don’t take the care for their other’s shares like they do with their own. But for a single person secret sharing splits can increase resilience.
Replying to @matthew_d_green, @oerdnj and @julian24
This is definitely one of the sub-goals of #RebootingWebOfTrust.
RT @isislovecruft: really enjoy that the boringSSL puts x509 in the “decrepit” directory along with RSA, DES, and RC4 https://t.co/A5MPYF22…
Replying to @datarade
Too hot, too humid.
RT @kanzure: “Decentralized certificate authorities” https://arxiv.org/pdf/1706.03370.pdf
I’m somewhat skeptical about Harberger taxes—likely too simplistic, but what’s important is chance to try it out “Perhaps it is just another naive theory that doesn’t work in practice. Opting in to these experiments on blockchains will allow us to study and understand it better.” https://twitter.com/simondlr/status/1018434802498916353
Replying to @FrayJoker and @tinstargames
A testimonial!
There is still some interest in at least a one-day salon on sidechains if not quite critical mass a full design workshop — for the latter we need to seek sponsorships.
This podcast from “The Hidden Brain” called “The Edge Effect” explains many of my life choices. I like living, working & collaborating on the edges between ecosystems, businesses, cultures & disciplines. I find it empowers me to be wiser & more creative. https://itunes.apple.com/us/podcast/hidden-brain/id1028908750?mt=2&i=1000415111324
Great slides on the privacy challenges to prevent correlation in the publication of large datasets. #anonymity #deanonymity. https://twitter.com/SarahJamieLewis/status/1007396185156431872
Our biggest fans this week: @skinnylatte, @Steven_McKie, @BobSummerwill. Thank you! via https://sumall.com/thankyou?utm_source=twitter&utm_medium=publishing&utm_campaign=thank_you_tweet&utm_content=text_and_media&utm_term=d0ab6b00ad990b36d99f7a0b
RT @Drabiv: @ChristopherA Interesting concept. I think it can be used in narrow settings - auctions to rent radio waves specters or somethi…
RT @NickThaGreek: Here is my article on Self Sovereign Identity (SSID) looking at the need for it, and some projects tackling this problem,…
Replying to @NickThaGreek and @el33th4xor
We are also in the process of having the community review and update my original principles (now a little over two years old) to be hopefully released this fall after the next #RebootingWebOfTrust. Currently in review of principal #2 “Control”. https://github.com/WebOfTrustInfo/self-sovereign-identity/issues
RT @ChristopherA: @NickThaGreek @el33th4xor We are also in the process of having the community review and update my original principles (no…
RT @mattblaze: @KimZetter I’ve said it before, I’ll say it again. In the more than quarter century I’ve been doing computer security, I’ve…
RT @dksf: 5/ HODLers and miners each contribute varying amounts of value to the network, but we remain with an underprovision of developer…
RT @dksf: 6/ It’s so acute that many people who might have the talent and energy to contribute to Bitcoin development have chosen to 1) lau…
Replying to @rawtxapp, @mejoshuaphilips, @naval, @real_vijay and @dksf
The lesson of HeartBleed. I was co-author of TLS in 90s. By 2014 #1 security protocol protecting trillions of commerce, with one open source implementation used by 60% of the Internet. Being supported by one engineer 1/4 time, leading to critical security bug from 2012 not found.
Replying to @pierre_rochard, @Bill_Cherman, @saifedean, @mejoshuaphilips, @naval, @real_vijay, @dksf and @bitstein
One area I’m working on to support #BlockchainCommons is to ask (or get customers to demand) that qualified custodians to demonstrate support for internet & blockchain infrastructure. If 10+ basis points are for fiduciary protection, 1 basis can be for infrastructure.
RT @ChristopherA: @rawtxapp @mejoshuaphilips @naval @real_vijay @dksf The lesson of HeartBleed. I was co-author of TLS in 90s. By 2014 #1 s…
RT @ChristopherA: @pierre_rochard @Bill_Cherman @saifedean @mejoshuaphilips @naval @real_vijay @dksf @bitstein One area I’m working on to s…
Replying to @pierre_rochard, @Bill_Cherman, @saifedean, @mejoshuaphilips, @naval, @real_vijay, @dksf and @bitstein
https://twitter.com/christophera/status/988867015535456256?s=21
Replying to @pierre_rochard, @Bill_Cherman, @saifedean, @mejoshuaphilips, @naval, @real_vijay, @dksf and @bitstein
https://twitter.com/christophera/status/988856246349508609?s=21
Replying to @pierre_rochard, @Bill_Cherman, @saifedean, @mejoshuaphilips, @naval, @real_vijay, @dksf and @bitstein
https://twitter.com/markfriedenbach/status/988880753504092160?s=21
Replying to @pierre_rochard, @Bill_Cherman, @saifedean, @mejoshuaphilips, @naval, @real_vijay, @dksf and @bitstein
https://twitter.com/waynevaughan/status/988896811753455616?s=21
RT @notgrubles: This is incredibly comprehensive and very cool.
@ChristopherA and @Appelcline’s “Learning Bitcoin From The Command Line”…
Replying to @notgrubles and @Appelcline
Have some plans for a number of updates including teaching how to configure for Blockstream satellite, more Scripts, wallet primitives from libwally-core https://github.com/ElementsProject/libwally-core, and c-lightning https://github.com/ElementsProject/lightning. Right now mostly C & C++ oriented, but may add more Python.
RT @kimdhamilton: In which our DID heroes discuss the perils of a perfectly correct roadmap, being burned as witches. Outtakes to follow ht…
Cantillon Effect: “the first ones to receive the newly created money see their incomes rise whereas the last ones to receive the newly created money see their purchasing power decline” I believed this for a while but did not have a name for it. #inequality https://mises.org/library/how-central-banking-increased-inequality
Replying to @saifedean
I think a great place to start in learning about Austrian Economics, if you don’t have a lot of background, is the CC-BY textbook “Lessons for a Young Economist”. Very accessible, with a solid pedagogy, and also the separate teacher’s guide is very good. https://mises.org/library/lessons-young-economist
RT @ChristopherA: @saifedean I think a great place to start in learning about Austrian Economics, if you don’t have a lot of background, is…
RT @SFBitcoinDevs: Video from @pwuille’s talk on Taproot, Schnorr and SIGHASH_NOINPUT is now available https://youtu.be/YSUVRj8iznU
RT @alexbosworth: An aspect of paying miner fees is that your fees may go to miners you don’t like. With LN wallets, you could voluntarily…
Replying to @DTFinegood, @yaneerbaryam and @ricardo_hausman
Any link to the slides?
🗝💬“The city supports those who are different, because you’re anonymous…facial recognition will be in support of more conformist behavior. It will be harder to be different, unless you…really, really embraces diversity and difference.” https://medium.com/s/futurehuman/how-facial-recognition-tech-could-tear-us-apart-c4486c1ee9c4?source=email-63ba9be92e8f–mktgemail.human
Unfortunately facial recognition & biometrics are here to stay. As a culture we must resist associating it with data. Instead it should only be used as one of many factors for authentication of cryptographic identifiers, which people then can choose to consent to release data.
Apple comes closest to having this right with the fingerprint reader on the iPhone 6-8. The device never shares the biometric, only unlocks keys under the users control, after the implied consent of the use of the correct finger. Use wrong finger 3 times & password is required.
The iPhone X is not quite as good, as someone else holding the iPhone to your face will authenticate unlocking the of the keys. Ability to force requiring a password by holding either volume button & the side button is insufficient as the phone may be coerced away from you.
In both cases I would personally prefer Apple enable multifactor (both biometric AND password) if the iPhone has moved since the last time it was authenticated, or only in places marked as “safe” like your home. Other recent history can be used as additional factors.
A solution for services such as Facebook that have large number of stored images are much harder. They need to firewall the facial identifier from the data about individuals. This requires more than “can correlate photos of faces with data” consent by their users.
In a self-sovereign architecture a future competitor to Facebook would lock the face correlated data behind keys they don’t control, but are under control of their users, that must be consented to for each unique use, not a blanket permission.
I don’t know of any way to prevent misuse of facial, voice & other biometric information—other than as a culture we must demand it not be abused. China’s use of facial recognition to control against dissent is precisely the anti-pattern we need to avoid.
RT @apowers313: This is one of the reasons that @FIDOAlliance established Privacy Principles early – to make sure biometrics never leave a…
Replying to @rabbyte
👍👏
RT @ixo_impact: “Global Single Sign-on!” by @CedricFranz https://medium.com/ixo-blog/global-single-sign-on-a25e14c38740
In this blog Cedric talks about #RebootingWebOfTrust and…
RT @MeeplesTogether: Meeples Together isn’t just about game design, but also COOPERATIVE design. One of the foundations of that was @Christ…
Replying to @xpost1
Absolutely possible, given a variety of trustless decentralized services that can act as your agent when you are offline. You’d likely use a decentralized data store like IPFS, something like lightning network’s idea of “watchtowers” & other related services.
RT @GuyZys: Great read on privacy-preserving computations paradigms such as MPC, TEEs and Zero-Knowledge Proofs “Privacy and secrecy: a gen…
Replying to @GuyZys and @AAAinsley
Nice article. I tend not to use the word privacy like you do, due to the problems I raise in The Four Kinds of Privacy http://www.lifewithalacrity.com/2015/04/the-four-kinds-of-privacy.html — instead I use the word confidentiality.
Replying to @eordano
There are interesting data minimization & selective disclosure technologies emerging to help (zkp, blinding & confidential credential/attribute, etc) Here is a draft of an overview on these from #RebootingWebOfTrust now moving onward to W3C Credentials CG https://github.com/w3c-ccg/data-minimization/blob/master/README.md
Good overview of some approaches to confidentiality via zkp, etc. Agree 👍“Second, and more important: there is no silver bullet. Allow me to repeat that. There is no silver bullet. No one answer, no one technique, completely solves the privacy problem.” https://medium.com/@leor.fishman/privacy-and-secrecy-a-general-analysis-f39dcd6a709f
This satirical page is actually useful as a list of anti-patterns to avoid in writing secure code. I’d love to see added to it anti-patterns about writing code that is vulnerable to side-channel attacks. https://www.owasp.org/index.php/How_to_write_insecure_code @pwuille #sfbitcoindevs @hashbreaker @ASayakkara
In our W3C Credentials CG https://w3c-ccg.github.io VoIP/IRC meeting tomorrow at 9am PT 12ET https://lists.w3.org/Archives/Public/public-credentials/2018Jul/0047.html we will be discussing the “Amira 1.0.0 User Story: A Self-Sovereign Web of Trust Engagement Model of an Immigrant Software Engineer” Join us! https://github.com/WebOfTrustInfo/rebooting-the-web-of-trust-fall2017/blob/master/final-documents/amira.md
Thinking about security properties of an iPad Mini WiFi-only with iTouch, vs a Ledger. Both can be air-gapped, iPad has camera & display but Ledger requires USB to communicate. Both have hardware randomness. Both have to release a key from HSM for transaction to be signed. …
Both have some tamper resistance w/ hardware assurance of OS. Both require signed apps to be loaded. Both are not open source HSM. Unfortunately iPad’s iTouch biometric is not useful in this case as password is required first to enable it. Ledger fits better in safe-deposit box.
iPad Touch has similar properties and fits in safe deposit box, but I’m not sure if it has true HSM like the iTouch iPad.
Replying to @kragen
Ledger requires a laptop which like the iPad has a wide variety of attack surface complications.
Replying to @boscolochris
A ledger without a laptop is useless. Both have a lot of code in involved.
Replying to @Leon_Vandenberg
I can store things into the Secure Enclave of a iPad using the keychain API. And if it is air-gapped with Wi-Fi off in a bank vault it may be pretty close in actual security. It is just a thought exercise.
Replying to @rm0rf and @Leon_Vandenberg
Just as a thought experiment isn’t any management engine effectively off if air-gapped in a bank vault? And there is no baseband on a Wi-Fi only iPad. I don’t trust baseband chips but I do feel like I can turn off Wi-Fi, or even disable antenna.
In this thought experiment I would load up transaction input on my iPhone, go to vault, use QR code to send unsigned transaction to iPad (or iPod Touch), it would QR code signed transaction back, which I would leave bank vault with my iPhone to send once outside.
Replying to @kragen
No NFC in iPad. Why disable speaker?
Replying to @rm0rf and @Leon_Vandenberg
I’m more concerned about the management engine of every modern laptop today over the custom chip Apple uses.
Replying to @kragen
I agree — I’d love to have a cheap RISC-V device with camera & small screen with open boot and the simplest HSM or even better an HSM that can sign secp256k1 on enclave. All open source and open patent. Critical path is costs of production of that chip.
Replying to @kragen
Perfection is the enemy of the good. I am presuming that the iPad and software was secure when put into the bank vault. I mainly don’t want it to be corrupted once it is in there. I doubts the efficacy of attacking a previously secure device using audio.
I would likely have to leave a charger in the bank vault with the iPad because otherwise bringing in a power source to recharge the battery from outside might be an avenue for compromise.
Replying to @Leon_Vandenberg and @rm0rf
If that is true than likely the Ledger is insecure too. The chip is a made state sponsored (France-EU) chip company. Worthy to consider nationstate adversaries, however it is impractical to do anything about it until we have our own RISC-V fabs.
Replying to @BitcoinAlley
My original thought was iPod Touch because it could fit in safe-deposit box, but there was a significant upgrade to hardware security module (HSM) in the biometric devices like iPad with iTouch. But I suspect HSM even in iPod Touch may be better than Ledger’s HSM.
Replying to @kragen
Possibly but I’m unclear on firmware upgrade architecture. https://www.st.com/content/ccc/resource/technical/document/user_manual/34/1a/20/75/7f/84/45/cb/CD00208802.pdf/files/CD00208802.pdf/jcr:content/translations/en.CD00208802.pdf
Replying to @kragen
Interestingly, there may be some secp256k1 support. I don’t think it is on spec sheet. https://github.com/mogorman/microecdsa
RT @trbouma: Note to self: Ensure these requirements and considerations are in all #digitalidentity #POC and #RFP (thx to @kimdhamilton ) h…
Replying to @MadBitcoins and @BitcoinAlley
It is somewhat harder to pown a Mac. Changing Apple password and resetting all devices should be enough. Here is a helpful page: https://support.apple.com/en-ca/HT204145
RT @trevortimm: ACLU took Amazon’s facial recognition tech—which Amazon is aggressively selling to police—and loaded it with 25,000 mugshot…
RT @rusty_twit: My new workspace is ready! Thanks @phneep !
🤷🏻♂️“Funny how we talk about link rot when it appears we now also have tld rot” https://blog.benjojo.co.uk/post/the-death-of-a-tld
RT @MicroSFF: “Dad, there’s a monster under my bed!”
“Yes, the bed they used to live under has been razed.”
“But it’s a monster!”
“Maybe, b…
RT @trbouma: This is a great resource.
With that, I revise my long-standing saying: ‘ If you truly want to understand something, you have…
Replying to @BitcoinAlley and @MadBitcoins
It feels doubtful that they could attack his Droid’s firmware remotely but I’m less knowledgeable here. Should be good enough to reset to factory.
Replying to @Drabiv
Self-Sovereign Identity doesn’t mean that you are in complete control (for instance an ancient King has total sovereignty). But it does define the borders within which you (the self) can make sole decisions and outside of which you negotiate with others (other selves), as peers.
RT @GETJolocom: Locking the Web open! discussing #identity at #DWebSummit w/ @csuwildcat @kimdhamilton @IdentityWoman @peacekeeper @rh7 @Ch…
Replying to @Drabiv
Exactly — self-sovereign identity is bounded. BTW, I’m hoping to get some dialogue going on this topic in our upcoming update to the 10 Principals of Self-Sovereign Identify — Principal #2 “Control”: https://github.com/WebOfTrustInfo/self-sovereign-identity/issues
RT @Drabiv: Self-Sovereign Identity is self-controlled, but bounded by other “selfes-“ - peers in relationships. https://twitter.com/ChristopherA/status/1022908310016552960
Replying to @Drabiv and @NZN
This is close to heart of Self-Sovereign Identity Principal #1 “Existence: Existence. Users must have an independent existence” — however the issue discussion on this is more complex. Is it a fundamental human right/dignity or one of property/ownership? https://github.com/WebOfTrustInfo/self-sovereign-identity/issues/6
Replying to @NZN, @Drabiv and @NZN
I would appreciate some discussion of this in issue #6 as we somewhat reached an impass moving forward on update of Principle #1 of Self-Sovereign Identity. Some reconciliation might help @NSmolenski get back involved. https://github.com/WebOfTrustInfo/self-sovereign-identity/issues/6 @JoeAndrieu
🗝💬“Going private is a way of proving you can win without catering to the masses. It means you have a highly engaged, highly specific audience, and you can make niche content just for them”. This closed/open group dynamic seems to switch every few years. https://www.wired.com/story/is-a-meme-born-in-a-private-account-still-a-meme
👍👏“I strongly advise against using one of these devices. While Bitfi is perhaps not an outright scam, the design is inferior to that of hardware wallets where the device really is needed (or the backup of the seed) along with the passphrase in order to spend the coins.” https://twitter.com/ryancdotorg/status/1022870589973848066
Replying to @Dwyndal
As cryptocurrency hardware wallets Trezor & Ledger both have different security tradeoffs. I lean in direction of Ledger, but there are good arguments the other way. Both are good. Once @Coinkite is out I may change my mind.
Replying to @RawMaterialNYC and @Bitfi6
I respectfully disagree. With 30+ years of cryptographic experience & as co-author TLS, brainwallets will always be inferior as cryptographic seeds as they all have insufficient randomness. You may be able to temporarily mitigate through some obscurity in code, until POOF!
Replying to @Dwyndal and @Coinkite
Opendime isn’t a wallet, it is a bearer instrument. Different security requirements. Once funded it is equivalent to a paper wallet in a lockbox—both with possession can be stolen easily. Good Opendime scenarios are that you can give someone a lockbox before putting money in it.
👍 Great thread on Information Theory from the fundamentals of Shannon’s Law to limits on human & cultural management of complexity. Thought he was going to lead to PoW & blockchain as a form of pocket against entropy, but still relevant to our community. https://twitter.com/Kpaxs/status/947516453691052034
#Privacy “different browsers understand…consent around WebRTC differently https://ntblk.github.io/webrtc-privacy/.…when you deny or give permission on Chrome, Firefox or Safari. You’ll notice…Safari will not display your private IP address if you do not give consent” https://www.article19.org/resources/privacy-and-consent-in-the-age-of-browsers-the-question-of-webrtc/
RT @ACLU: Here’s what happened when we tested @Amazon’s facial recognition tool on members of Congress. (Spoiler alert: it didn’t go well)…
A walk through of details of how India’s #Aadhaar digital identity system is so flawed. The key problem is identifiers and the proof of their authenticity MUST be kept separate from authorization. The W3C DID architecture does this in a non-centralized way under user control. https://twitter.com/nileshtrivedi/status/1023196004911263744
Some key quotes from the thread: https://twitter.com/nileshtrivedi/status/1023203478494052352
Another key quote: https://twitter.com/nileshtrivedi/status/1023203009201762304
RT @nic__carter: The latest from @hasufl and myself: Visions of Bitcoin
https://medium.com/@nic__carter/visions-of-bitcoin-4b7b7cbcd24c
Text by @CassSunstein, a leader on “nudge” behavioral economics. In particular I find it a beginning of a model for thinking about ethics of intervention when seduced by cognitive bias. One issue of concern to me is question at end “Best…if choice architects cannot be trusted” https://twitter.com/CassSunstein/status/1023702974965706752
When I taught “Using the Social Web for Social Change” in a sustainable MBA program we also talked about the ethics of using behavioral economics “nudge” interventions. I didn’t realize then but see now that untrustworthy “choice architects” are actively attacking our systems.
Replying to @ChrisDiehl and @CassSunstein
I see it the struggle in the Final Words section “When people lack antecedent preferences or when those preferences are not firm, and when an intervention constructs or alters their preferences, the ‘as judged by themselves’
standard is more difficult to operationalize”.
Replying to @ChrisDiehl and @CassSunstein
What we needed in this discipline are more frank discussions about identifying, challenging & overcoming bad actor “choice architects”. I think the concept of “trustless” and other mechanism design approaches are a start, but they too have risks if they assume rational actors.
RT @ChrisDiehl: @ChristopherA @CassSunstein More recently I struggle to support nudging when that, in my mind, cedes power to a centralized…
RT @asglidden: There’s probably a bunch about the mechanics of this I haven’t really thought through - it’s a very rough idea. But it’s an…
RT @el33th4xor: This should be periodic reading for anyone working on open source software. https://twitter.com/esesci/status/1023765396879364096
RT @agkrellenstein: SgxPectre Attacks: Stealing @Intel Secrets from #SGX Enclaves via Speculative Execution
RT @o0ragman0o: @fs0c131y This was my talk contrasting #Aadhaar with #SelfSovereignIdentity given in India (at what turned out to be an Acc…
I think it is important for us to examine “Game Theory (+behavioral economics, memetic engineering, etc) as a Dark Art” as these practices are emerging and risk the good that is possible with these approaches. https://twitter.com/RhysLindmark/status/1023657025648119808
Replying to @JAlanHenning, @Appelcline and @MeeplesTogether
Shannon has many more books in the hopper, but together we are about 1/3rd through a book on the patterns of cooperative play, which includes RPGs, improv, jazz, children’s play, etc. Some of it was in first draft of Meeples Together but pulled out as it was less focused.
Replying to @_PoTeaD, @trbouma and @konklone
When I wrapped up my work on TLS 1.0 nineteen years ago I would have never guessed it would take so long to upgrade. Personally I’d prefer to move to a no-legacy TLS 1.3.
Our 7th(!) #RebootingWebOfTrust Design Workshop will be in Toronto on September 26-28th. Over 37 whitepapers, specs and POCs collaboratively created at previous events. Join us to create the future of human-rights decentralized & self-sovereign identity! http://rwot7.eventbrite.com
RT @Appelcline: I’ve been the editor-in-chief for #RebootingWebofTrust for almost three years now. That’s a lot of intriguing papers on int…
RT @jmartinez_43: In my latest post, I discuss how losing a twitter beef against @francispouliot_ led me to question what decentralization…