Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Thanks to the magic of cryptography, it's possible to prove your identity to someone else without enabling them to impersonate you.

For instance, the third party gives you a nonce, you sign it with your private key, and they verify it with your public key.



Then I can make one key per game.


Self-defeating, since part of the point is that your reputation is based on multiple games, so by only playing one game your account already looks suspicious.


What's suspicious about only playing one online game?


Nothing really, unless people are already suspicious that you're cheating, then having no other games on your account looks extra suspect. The system isn't meant for objective measurement, so if people think you're cheating and you don't have a reputation score to back up your claim that you aren't then you'll probably get banned pretty quickly.


Well, your public key is not exactly the same as your identity.

Presumably, there's a commonly-trusted authority that signed your public key, attesting that the key corresponds to some "identity".

If you're concerned about revealing your identity to the third party, there are other schemes. Check out https://datatracker.ietf.org/wg/privacypass/about/


This doesn't solve the issue of stolen accounts, or fraud.

Game companies won't accept a system that has a non-recoverable state like a deleted private key.

If you can assign a new key to your account, then the private keys don't improve trust, and remove the point in having them instead of just OAuth.

In games like Dota 2, there's already an industry for account selling.

It's pretty simple really,

Find some Boomer's ID, who barely does anything but browsers facebook (or better yet, buy an ID of one of the billion in the 3rd world).

Sign up to this service using their id, hire some poor kids in the 3rd world to level up the account without cheats to build rep, then sell the account to a hacker.

Private keys don't solve any of this.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: