Join the discussion
Write your take first — we'll ask for email only when you're ready to publish.
- Hacker News
- Why aren't the keys stored encrypted?by skywalqer
- Both nostr and atp sucks at key management imo. The Farcaster network does a good job here with their chain of trust model and a smart contract on etherium blockchain to recover identities in case of losing access to a private key. Ironically its also the blockchain aspect of Farcaster for which I never tried it.by opem
- AI fluffby noname120
- So annoying to read. Meanwhile, the key information ("backup key with higher priority") is mentioned in a sentence without any kind of elaboration or link to some follow-up/how-to.by Zopieux
- and what makes you say that?by opem
- I have also the online services and i don't know where to put the people feedback, the reddit banned my account, and also here , it says , wait until we allow you to post
- What's the evidence for this? I'd be very keen to understand. This looks Claude written which is fine but adds an extra layer of skepticism for me.by triyambakam
- You can just read the documentation: https://atproto.com/guides/overview#account-portability
“The signing key is entrusted to the PDS so that it can manage the user's data, but rotation keys can be controlled by the user, e.g. as a paper key. This makes it possible for the user to update their account to a new PDS without the original host's help.”
by kevinak - Is author new at the whole web thing? Yes, people trust remote web servers. Yes, if you link multiple apps to an identity server (be it atproto, google, or self-hosted OpenID server), and your identity server is compromised, attacker will be able to impersonate you or lock you out.
This is just how the web works, and there is no easy around it without losing features people care about. Sure, you can do client-side encryption and pretend serve can't see the plaintext, but it's just a theatre, see Hushmail incident for example.
And having people export uber-key by default is pretty terrible idea. Sure, allow advanced users (like post author) to do it. But for the common person, the exported key is just another way to get account compromised, via malware or backup provider hacking. Or if they are not backing up stuff, then the key will get lost next time they upgrade.
by theamk - > This is just how the web works, and there is no easy around it without losing features people care about [...]
Well, apart from using a separate email address for every single "provider"?
(Spoiler: there's no way I'm going to sign into your service with a shared email ... you get <youservice>@<me>.com)
by logifail - > Sure, you can do client-side encryption and pretend serve can't see the plaintext, but it's just a theatre,
Keeping a private keep on the client to sign your activity is a fundamental cryptography practice.
If you use a private key to sign your emails or git commits, it’s not security theater.
If you were to have to upload your private key to GitHub or your email provider, that would be severity theater.
> Is author new at the whole web thing?
Unnecessarily mean comment.
by Aurornis - Are you new to the whole p2p thing? This is a terrible standard to hold new technology to. The web is broken.by tarpitt
- Centralization is always a trap.
No idea why people have such a hard time joining and supporting the Fediverse.
by Noaidi - Higher friction and fragmentation are Fediverse features (not bugs) that give it a different grain. ATProto has different tradeoffs that lead to a different form of social media. I'm glad both exist, and bridging efforts are worth paying attention to for anyone frustrated with the distinctions.by webdevladder
- How is the fediverse different. Can't the owner of an instance post as you? Can they read all your data stored on their instance and pass it to anyone they want to?by iand
- Because there is no single "default instance that is always a good choice and wouldn't go down randomly because of lack of funding". That's both a strong and a weak side of fediby sheo
- So does a CA issuing my certificate, but there is some oversight in what they do.by Muromec
- That's different. While your CA can hand out new certificates, it doesn't know your keys (unless you messed up when uploading your CSRs).
CAs have to prove they're not faking certs through the certificate transparency logs, there's no such limitation on Bluesky.
A more apt comparison is a shared host that does certificate management for you. Those are also often considered less secure, of course.
by jeroenhd - Sure, somebody else holds your identity, but it's pretty easy to control it yourself. By its nature if you're using somebody to host your stuff, you're trusting them with it. I made Cirrus so you can self-host your PDS for free, but you still need to trust Cloudflare to run it.by ascorbic
- It’s great that tings like this exist but as long as this is how identities work on ATProto it’s unfortunately going to be a niche thing.by kevinak
- I think most people don’t need to worry about their host abusing its power to impersonate them, but the cool thing is, the people who do need to/want to worry (journalists, politicians, celebrities, activists, open source maintainers, etc etc etc) can self host a PDS and be a lot safer, and still interact with everyone else.by varun_ch
- One of the core features of AT is the ability to move your repo hosting provider (PDS) at any time. This is the "data portability" problem that ActivityPub never solved.
Bluesky Social, PBC runs a PDS service (bsky.social) for free, there are a number of free public alternatives, and thousands of users self-host.
Self-hosting your own PDS can be done with Raspberry Pi or $5/mo VM and requires very little work. It runs in a Docker container with SQLite.
by jacobgold - Except it isn't as straightforward as most people would think. The last time I checked this, I think there were some issues with Bluesky app view and it didn't show accounts from a self hosted PDSby opem
- Yes you can but the vast majority don’t, and that is what matters. When Bluesky goes rogue because of profitability issues or VC pressure, the vast vast majority of users lose their identities on the wider network. Users will choose the path of least resistance. It’s all about incentives.by kevinak
- You have the ability to move, as long as Bluesky Social PBC allows it.
They hold the keys for your DID. If they don't allow you to move to another PDS, you can't move. The original theory was that you'd hold the private keys, but that's something that would hugely limit adoption so they decided to hold the keys themselves.
In terms of moving your backlog of posts to a new server, part of the issue is liability (not merely legal liability, but reputational as well). When you have a user on your platform and they're posting stuff, you're moderating them in real time. If they turn out to be a horrible troll, you've get the reports. Let's say a horrible troll has been on EvilServer and EvilServer has been ignoring the reports against them. They now want to move to your GoodServer and bring all their post history with them. As an admin of GoodServer, you can't see that everyone has been reporting this troll for years. They're now moving over lots of horrible, inflammatory, potentially illegal posts to your server.
by mdasen - You can host it for free on Cloudflare using my Cirrus PDS: https://cirrus.earth/by ascorbic
- Who owns your domain name? Hint: it’s probably not you. Your hosting provider could take down your domain, or even steal traffic and direct it to their own IPsby rbren
- that is why you have did:plc in ATProto but that doesn't resolve the concerns raised in this article.by opem
- Can you move a DNS record AND make it look like I signed off on it?
The author's concern seems to be more focused on impersonation
by handoflixue - More importantly, ICANN can seize your domain if you don't comply with US law (e.g. if you call for a boycott of Israel) unless it's under another country's ccTLD.by pocksuppet