[zaachary]

I'm not going to rebut each mischaracterization, but I did work on Persona, so:

> the BrowserID/Persona thingy that happily continued the trend that makes your identity owned by a third party

Nah. You could happily choose any Identity Provider that implemented the protocol, including a self-hosted one.

[drdaeman]

Nope, that's a pretty common misconception though. You surely can own a server (I do) but you just can't own a domain. You're merely leasing one from a registrar.

You see, I strongly believe identity's an intrinsic property of a person, and if you need a provider for one there's something really wrong with the setup. I'm completely fine with asserting notaries, but not providers.

[xorcist]

> you just can't own a domain. You're merely leasing one from a registrar.

That is not true, in a very strict juridical sense.

[drdaeman]

I don't know about juridical sense and I'm not sure there's one applicable worldwide.

This is true in practice, though. "Your" domain can be seized, blocked or transferred to a third party, its lease terms can be changed to make it unaffordable - and generally there's nothing you can do to prevent this before this happen, since anything of this can happen without involving you at all. That is, because you never possessed this domain, it was merely provided to you. You may just seek the legal remedy after the fact.

On the contrary, identity is something you possess. It can't be revoked by anyone. Your passport (notary assertion) may be stolen, seized or revoked, but your friends won't stop recognizing you as a person. It's just that you won't be able to prove "I'm recognized as $legal_name by government" anymore.

You just won't wake up and see your password set is blocked so you can't login anywhere. Yeah, you can be forced to disclose your credentials, but it's a different story.

[xorcist]

> I don't know about juridical sense and I'm not sure there's one applicable worldwide.

The statement is even less true then. I would certainly guess that in every country that leasing is a term, it doesn't match your agreement with your registrar.

> "Your" domain can be seized, blocked or transferred to a third party,

That is trivially true with pretty much anything, in pretty much any country. The police will take back a stolen bicycle and return it to a third party, for example.

But it is a system governed by rules. And so is the domain name. It is yours to use, and will remain yours unless you break the rules. In most countries you can challenge any stolen or revoked domain in court.

[drdaeman]

> I would certainly guess that in every country that leasing is a term

I'm not talking about how it's called legally. I'm talking how it's actually working. You pay money, you're allowed to control the resource. That looks exactly like leasing to me. You can't buy a domain, so you can't own it. It's that simple

> That is trivially true with pretty much anything, in pretty much any country.

Wrong. It's impossible to make you disclose your private key without your presence, ability and willingness to do so (although you can be forced to disclose, but that's completely another matter). And, obviously, your identity cannot be revoked or seized even if you'd wish for so.

> But it is a system governed by rules. And so is the domain name.

And the rules are made by others and others may change it at any time.

> In most countries you can challenge any stolen or revoked domain in court.

But why do I have to do so in a first place?

Seriously, can you explain me why do I need to entrust my identity to some registrar and ask government to handle that? Or why do I have to pay for a right to posses my identity? I've used to live without those, but now everyone's (Google, Facebook and - what's important and what's the basis of my complaint - Mozilla's continuing the trend) trying to tie me to this third-party-is-necessary approach.

[pwnna]

Yes. Identity is an intrinsic property of a person. However, how would you design a system to check this property? It's a very difficult property to measure. Having someone vouching for it is a relatively safe and easy way to do this.

[drdaeman]

As usual, with credentials.

It's just that credential must be something you can handle by yourself and not require a third party to provide to you. A third party may assert some aspect of your identity by providing a statement that the person who's in possession of the certain credentials has been verified by this notary to indeed have certain properties. But if me and some website are starting to become acquainted why do we need any third party as a strong requirement? When I walk into some office I don't have to show my passport, I just introduce myself and we get to the business. And then, if there's a necessity (!), business owner may ask me to provide some assertions of my identity. I don't see any reason it shouldn't work in a same manner on the web. Like, for example, "Hey there, you may call me Aleksey and here's my, say, public key so you could authenticate me at a later time."

[wodenokoto]

Remembering your face is what a cookie can do for you. You log-in via a trusted 3rd party (that may be owned by you) and you receive a cook for use next time.

If you change your face the next time you walk in, like say you visit from your iPhone instead of you PC, they cant recognize you and will of course need strong verification, after which you may receive a cooking.

[drdaeman]

This is a workaround. A completely different topic.

My issue with Persona is about its very concepts, not some particular implementation issues.

[sroerick]

What about Namecoin?

[drdaeman]

I'm not really knowledgeable on the details but - if I got it right - from the overall image it seems good.

But it's not realistically useable for a time being. I'll be fine totally with Persona when the vast majority could type .bit (or whatever it would be called, I guess NameCoin will evolve somehow by that time) name I own (truly own, yay!) and it would resolve for them.