search

ryco117 / distort-server

A reference-implementation homeserver for the research anonymity protocol, DistoRt, with broadcasting over IPFS
https://ryco117.github.io/distort-server/
GNU General Public License v3.0
3 stars 1 forks source link

Social-media based peer discovery #10

Closed ryco117 closed 5 years ago

ryco117 commented 5 years ago

Right now communication with a peer (the human identity) is only secure under the assumption that you have the correct IPFS node ID for the intended peer. Since the average computer user may find it difficult to reliably associate a human with such an abstract online entity, it may be worthwhile to automate a process for linking the IPFS identity to (multiple) social media identities. Thus anyone confident in the intended recipient's social media account(s) can confidently derive the peer's IPFS identity and then continue DistoRt communication as normal.

init-js commented 5 years ago

Yes. Public identifiers might be friendlier to use. I find it interesting that the p2p layer can use a different set of keys than the application layer.

If the user's pub keys used in the application layer (distort) protocol were posted on social media, it doesn't immediately strike me as necessary that the distort certs need to be bound to the ipfs node id (network overlay) -- the crypto itself does the routing. Trusting the identities and certs on social media allows you to "cut-the-middleman", so to speak. In other words, if all you want is to write a distort message for "@bob", knowing bob's ipfs keys may not be necessary.

That said, if the certificate on social media were to include the ipfs nodeid (or cert), there might be a neat way to verify the association with a challenge-response sent over ipfs. This construction would allow sending messages to, e.g. "the ipfs nodeid owned by @ bob on twitter", or performing the opposite lookup (find the social media account attached to an ipfs node), which may be useful. Not 100% sure whether having the two ids bound has any implications on anonymity, but there's probably a careful way to do it.

ryco117 commented 5 years ago

Several commits ago I added working API for retrieving and routinely linking Twitter accounts to distort identities, in an expandable way to so that other platforms could potentially be used for higher assurance of the identity behind an account.

While this linking still requires that an IPFS-hash[:account-name] pair uniquely identify each user, this could potentially be a stepping stone in creating a protocol where each user (ie., each distort user's certificate) is identified by and verified as belonging to at least one platform:identity[:subidentities]* tuple, where IPFS would become just one such possible plaforms.