Who owns your ATProto identity?

https://kevinak.se/blog/who-actually-owns-your-atproto-identity-hint-its-probably-not-you

by kevinak • 1 month ago

171 152 1 month ago

verdverm7• 1 month ago

Probably doesn't matter for the "40M+ users", most of them have churned at this point and growth is negative. This is good critique for the next iteration of open social protocols, but fundamentally atproto did not fail because of technical reasons. The next iteration should make privacy the default and core to protocol, and be very mindful of how the leadership / social dynamics played out.

singpolyma3• 1 month ago

Based on all the traffic and development activity I'm not sure on what basis one would say "failed"

ftfish6• 1 month ago

Source?

What I see here doesn't look good.

https://bluefacts.app/bluesky-user-growth

Never mind the pivot to reddit.

https://www.cnbc.com/2026/06/04/bluesky-twitter-rival-reddit...

pessimizer• 1 month ago

https://bsky.jazco.dev/stats

verdverm7• 1 month ago

They had a vision and goal to change social media, to get people away from Big Social. They haven't failed in the technical sense of closing, there are less than 1.5M daily (the stats trackers are starting to shut down), but they will also never fulfill on the promises. In the startup world, this is called a zombie company.

One way they failed hard is that they talked about how they were against the investors and VC incentives, then they took $100M from Bain Capital (PE) just after peak user count, but didn't tell us for almost a year. They could have put up a simple $5/month to support the cause, but they took investor money instead. This is why I left.

jacobgold14• 1 month ago

Bluesky / AT is the most successful open social network in history and the only one to become culturally significant. It has been adopted by presidents, celebrities, journalists, and mainstream users.

Bluesky has ~50M registered users and has sustained ~5M monthly active users for long while. There's no reason to believe it will fall substantially below this level.

It is also in the process of adding (decentralized) subcommunities, which I expect to be really cool and have a large impact on growth.

tptacek4• 1 month ago

"Registered users" is a meaningless statistic. Daily active users has consistently declined.

scyclow• 1 month ago

This is where non-financial use of blockchain could really shine, IMO. Self-sovereign identity management with a smart contract-based process for recovering ids if keys get lost or hacked. Blockchains are pretty out of favor these days, but I really don't see a better solution for decentralized identity management.

AndrewStephens2• 1 month ago

What is the incentive for an individual to participate in a non-financial blockchain?

Bitcoin-style blockchains “work” because everyone gets the possibility of a little reward for all the hassle and non-negligible CPU time of being a node.

vid• 1 month ago

What's the incentive for people to participate in file sharing networks? To some degree it's access to a world of free media (same as access to a world of decentralized identities), but to a large degree it's an interesting hobby/excuse to be interested in tech. Some people have racks of hard drives dedicated to hobbies like this, just because it's interesting and is worthy.

majorchord• 1 month ago

For me the incentive is being able to own an identity that nobody can take away from me. And the assumption is that services will support this type of identity, so I don't have to make accounts on other systems that people can take away and now I've lost all access to any data I had.

tarpitt6• 1 month ago

Good question, this made me think.

You get a reward for being a mining node, not just any node. Even then, do miners have much incentive to share blocks, other than the ones they mine?

I think the incentive is mutual for most nodes (aside from the mining aspect). People will set up a node to accept transactions in an automated manner, or to have higher confidence in the state of their accounts.

It's like being on the floor of the stock market. People participating want to be where all the information is (for their own benefit), and there is incentive to bring others in and share information (because it increases the amount of information you have).

I suppose you could be a "selfish" node. The bitcoin-equivalent of someone who leeches and never seeds. But the advantage is low relative to the amount of money moving around. Most people don't care about the bandwidth of running a bitcoin node, they care about latency. Unlike bittorrent, there isn't a de-facto finished version of the file being synced: it's a constantly-updating list that everyone wants to have the latest version of. I can't find the words, but this seems to be the fundamental difference.

SkiFire132• 1 month ago

smart contract-based process for recovering ids if keys get lost or hacked

How would that even work?

TheDong• 1 month ago

If someone's account gets lost or hacked, the person with the most incentive to own that account is usually the original owner, so just give it to whoever is willing to pay the most, problem solved. We can call it "proof of stake", where you always stake a certain amount to keep owning your account, and when contested, whoever stakes the most gets it.

Poor people don't deserve rights on the blockchain anyway, it's not like they can afford the transaction fees, if they didn't want their account stolen they should have tried being rich, or buying into nearer the top of the pyramid.

Don't worry about people who pass away or lose internet for an extended period, we'll deal with that in v2, when we get "proof of death" and "proof of internet disconnectivity" on the blockchain somehow.

/s if it's necessary

tarpitt6• 1 month ago

Perhaps some sort of namecoin or ENS-like petname system with multisig or some type of scripting that enables different recovery methods.

For example, you could set your petname up so it can be controlled by a single keypair, which can be overridden after a certain time by a ring signature based on keypairs held by friends, family, peers, and trusted computing devices you leave in a safe deposit box.

Or maybe you could trust your identity with some centralized entity, but only as part of a 2-of-3 multisig with yourself and another trusted entity.

Basicially namecoin with bitcoin-like scripting controls.

triyambakam• 1 month ago

What's the evidence for this? I'd be very keen to understand. This looks Claude written which is fine but adds an extra layer of skepticism for me.

kevinak8• 1 month ago

You can just read the documentation: https://atproto.com/guides/overview#account-portability

“The signing key is entrusted to the PDS so that it can manage the user's data, but rotation keys can be controlled by the user, e.g. as a paper key. This makes it possible for the user to update their account to a new PDS without the original host's help.”

Noaidi• 1 month ago

Centralization is always a trap.

No idea why people have such a hard time joining and supporting the Fediverse.

sheo• 1 month ago

Because there is no single "default instance that is always a good choice and wouldn't go down randomly because of lack of funding". That's both a strong and a weak side of fedi

ftfish6• 1 month ago

mastodon.social has been around for a decade now, seems stable enough.

webdevladder• 1 month ago

Higher friction and fragmentation are Fediverse features (not bugs) that give it a different grain. ATProto has different tradeoffs that lead to a different form of social media. I'm glad both exist, and bridging efforts are worth paying attention to for anyone frustrated with the distinctions.

kevinak8• 1 month ago

Yes - the trade off is centralisation.

iand• 1 month ago

How is the fediverse different. Can't the owner of an instance post as you? Can they read all your data stored on their instance and pass it to anyone they want to?

skybrian4• 1 month ago

Most people don’t worry about it for the same reason they don’t worry about GitHub abusing their GitHub account and are even willing to use “login with GitHub” to access their other accounts. Account takeover by a third party is a bigger risk. If you’re concerned about supply chain risks, there are more important concerns than “what if GitHub itself is a bad actor.”

It’s solvable if you’re willing to self-host your PDS.

But I’m skeptical of the attempts to make a PDS an “everything account.” Why should you use the same PDS for your social media posts and your git repos and your blog posts? Seems like we need to get better at locking things down in practice before that kind of centralization?

NetOpWibby3• 1 month ago

This "social coding" thing Tangled has going on is cool but I don't want it. I hear they're figuring out private repos but for me, I don't want the same account I use for social for my code.

I'm probably in the minority though.

rafterydj• 1 month ago

Personally I think it should be optional, but meaningfully optional in a way that's technically sound and easier than it is now. I kind of feel like long term I'd want "professional/public" code I'd put my name on, and separate code I'd work on under a pseudonym/handle.

satvikpendem• 1 month ago

Check out https://radicle.dev then.

packetlost• 1 month ago

I don't want the same account I use for social for my code

Then create separate accounts?

OneDeuxTriSeiGo3• 1 month ago

Note that you don't have to have a social account. And there's work on the semi-distant horizon for creating sub-accounts which are independent but all under a common top level account kinda like how GPG conceptualizes subkeys or cryptocurrencies handle derivation keys.

For the current moment though you can just create an atproto account without creating a bluesky account. Tangled for example supports this on their site by creating one for their PDS and you can always move to another PDS in the future.

The over-arching idea isn't that your code is tied to your socials but rather that you can have a bunch of disparate services that you can interlink over a common identity layer and that those services are only loosely tied to the people/orgs hosting them but could be trivially hosted by anyone else.

pocksuppet5• 1 month ago

Social coding feels like the tiktokification of coding. It's already a thing on GitHub. In the old RMS days of free software, people wrote software and they released it. GitHub tries to make the process more about the issue tracking and stars than about the actual software.

Aurornis4• 1 month ago

Most people don’t worry about it for the same reason they don’t worry about GitHub abusing their GitHub account

Even with GitHub we don’t hand over our private keys to the GitHub server, though.

When I commit to my repos the commits are still signed by the private key that lives on my computer. Someone could take over my GitHub account and they wouldn’t be able to sign commits with the private key on my PC.

They could technically add a new public key and sign new commits with that key, but I could cryptographically point to the change and show that the key changed at time of takeover and disavow it.

throawayonthe• 1 month ago

right but that's possible with tangled too, that's a git specific thing

skybrian4• 1 month ago

Good point, but how many projects require people to sign their git commits? it's not something I've had to do at all.

If you're not signing them then hosting on GitHub gives GitHub the ability to do arbitrary commits in your name. The repo's HEAD is whatever GitHub says it is.

pocksuppet5• 1 month ago

The whole claimed point of ATProto is to avoid stuff like this. If centralization isn't a problem, just use GitHub, or X, because platforms that don't try to decentralize work better.

skybrian4• 1 month ago

If you assume that Bluesky won't suddenly turn hostile (we'll get some warning) then being able to migrate your PDS is better than what X gives you and about the same as being able to move your git repo off of GitHub.

quasigod5• 1 month ago

Atproto gives users choice for where their data is hosted as well as the ability to migrate their data to a new host. Users who dont want to put trust in a provider can host it themselves. How is that not an improvement over being locked in to a single centralized provider?

kevinak8• 1 month ago

Correct, but it’s not decentralized in any meaningful way, which is what a lot of ATProto proponents want you to believe.

No one (not literally of course) self hosts their PDS. Like 99.9%, if not more, are using the Bluesky PDSes.

jacobgold14• 1 month ago

One of the core features of AT is the ability to move your repo hosting provider (PDS) at any time. This is the "data portability" problem that ActivityPub never solved.

Bluesky Social, PBC runs a PDS service (bsky.social) for free, there are a number of free public alternatives, and thousands of users self-host.

Self-hosting your own PDS can be done with Raspberry Pi or $5/mo VM and requires very little work. It runs in a Docker container with SQLite.

https://github.com/bluesky-social/pds

opem4• 1 month ago

Except it isn't as straightforward as most people would think. The last time I checked this, I think there were some issues with Bluesky app view and it didn't show accounts from a self hosted PDS

jacobgold14• 1 month ago

You may have seen a temporary bug.

It's completely straightforward and it works. Tens of thousands of users are doing it successfully.

https://blue.mackuba.eu/stats/

quasigod5• 1 month ago

When was the last time you checked that? That is definitely not currently true and hasnt been for as long as I've used Bluesky.

mdasen• 1 month ago

You have the ability to move, as long as Bluesky Social PBC allows it.

They hold the keys for your DID. If they don't allow you to move to another PDS, you can't move. The original theory was that you'd hold the private keys, but that's something that would hugely limit adoption so they decided to hold the keys themselves.

In terms of moving your backlog of posts to a new server, part of the issue is liability (not merely legal liability, but reputational as well). When you have a user on your platform and they're posting stuff, you're moderating them in real time. If they turn out to be a horrible troll, you've get the reports. Let's say a horrible troll has been on EvilServer and EvilServer has been ignoring the reports against them. They now want to move to your GoodServer and bring all their post history with them. As an admin of GoodServer, you can't see that everyone has been reporting this troll for years. They're now moving over lots of horrible, inflammatory, potentially illegal posts to your server.

chuckadams2• 1 month ago

You can add your own keys to your DID, and IIRC you can even remove bsky's keys within a given timeframe (days).

quasigod5• 1 month ago

You can register a recovery key which allows overriding the signing key. This allows users to move from an adversarial PDS. I do think Bluesky should push for more users to add a recovery key, but I also understand why they haven't.

Moderation tools arent limited to specific PDS's, labels are public. If an account has received many reports it will have been labelled by Bluesky's moderation account and other independent labellers. A PDS can check against these before allowing an account to migrate if they choose to. I'm not sure any are currently doing this, but this is something that can absolutely be improved in current implementations, not an inherent limitation of the architecture.

ascorbic4• 1 month ago

You can host it for free on Cloudflare using my Cirrus PDS: https://cirrus.earth/

CharlesW• 1 month ago

Brilliant, so happy to learn about this!

skybrian4• 1 month ago

For anyone curious about the issues discussed in this topic, see:

Identity and your signing key https://cirrus.earth/concepts/identity/

Cloudflare secrets are write-only: once set, they cannot be retrieved through the dashboard or the API. This is good for security and bad for recovery. The wizard prints the key exactly once during pds init. Save it then.

Also:

Back up your signing key https://cirrus.earth/guides/back-up-signing-key/

kevinak8• 1 month ago

Yes you can but the vast majority don’t, and that is what matters. When Bluesky goes rogue because of profitability issues or VC pressure, the vast vast majority of users lose their identities on the wider network. Users will choose the path of least resistance. It’s all about incentives.

rbren• 1 month ago

Who owns your domain name? Hint: it’s probably not you. Your hosting provider could take down your domain, or even steal traffic and direct it to their own IPs

PunchyHamster2• 1 month ago

But without private keys they can't pretend to be the same you. There is a very big difference here.

chuckadams2• 1 month ago

Right, if Bluesky ever does do something hinky with your PDS, the operation will be signed with their key and persisted in the operation log which they're unable to touch. You can outright remove Bluesky's key if you want, though I think that only works within some number of days of creating it.

opem4• 1 month ago

that is why you have did:plc in ATProto but that doesn't resolve the concerns raised in this article.

handoflixue• 1 month ago

Can you move a DNS record AND make it look like I signed off on it?

The author's concern seems to be more focused on impersonation

Zambyte• 1 month ago

Do you use your own CA? Would you expect users to even notice if the certs were suddenly issued by LetsEncrypt? Or are you signing traffic using something other than TLS, where the domain name doesn't really matter anyway?

EGreg4• 1 month ago

Yes you do own your domain, as much as you can own your house. Your hosting provider can only take down your hosting, not your domain. Seizing domain names isn't very common. And by the way, with Web3 domains, you have full ownership via your own private key, with no need to pay rent. Is it possible to lose your house that you own? Yes. It's far more rare to lose a domain you own, by it being seized.

DNSSec is used to prevent unauthorized stealing of domains. Furthermore, if someone does steal one domain you own, they don't steal all your accounts across all domains. If they take over your hosting, that's a fixable problem -- you just repoint the domain.

Now, having said that, I designed the Safebox exactly to prevent these scenarios from happening, and create an actually solid foundation for decentralized social networking, AI workloads, etc. If anyone is interested, probably the best link to begin reading about it is: https://safebots.ai/about (If you do, I'd love to hear your thoughts)

tptacek4• 1 month ago

In addition to the fact that almost nobody uses DNSSEC, it solves none of the problems indicated by this article.

ranger_danger4• 1 month ago

Seizing domains is a lot more common than it used to be though, enough that it's a real concern for me personally, and I'm not sure there is a viable solution at the moment. There is also the concern of countries/governments or specific ISPs simply blocking access to one's domain in various ways... and the number of authoritarian regimes that have been blocking large portions of the Internet has only grown with time.

And regarding DNSSEC... if your domain is taken by the registrar (court order, ToS violation, etc.) or a government that can command the parent TLD to act, they can just revoke your old key and transfer the domain to someone else (or setup a placeholder under their own DNS) and now your protection and all concept of ownership is completely gone without your consent. This happened a few years ago with Epik seizing the soyjakparty and kiwifarms domains, including their hosting from a subsidiary company Terrahost... and KF has never even lost a lawsuit, but there are some specific people that really don't like them, and have gotten adept at claiming ToS violations via every possible company that touches them in order to try to make them go away.

nekusar3• 1 month ago

Yes you do own your domain, as much as you can own your house

Uh, no.

I can legally shoot and kill intruders due to castle doctrine and stand your ground laws in my physical home. And legal invasions require being in front of a judge and a search warrant.

A domain can be seized for 'terms of service' (aka kangaroo court) reasons. Stand your ground nor castle doctrine doesn't apply to your digital house.

Aurornis4• 1 month ago

This cheap criticism of the headline doesn’t actually apply to the problems brought up in the article:

Your PDS operator can post as you, like things as you, follow people as you, and it would be cryptographically indistinguishable from your real activity. The signatures are valid.

Your domain name owner or DNS provider cannot redirect your domain name to a different server and cryptographically impersonate you.

jacobgold14• 1 month ago

Your DNS provider can obtain a TLS certificate for your domain and cryptographically impersonate https://yourdomain.tld

It's not exactly the same thing but it's close.

OneDeuxTriSeiGo3• 1 month ago

Kind of. Your PDS can impersonate you but you can have higher ranked "recovery keys" that can undo/recover all the damage.

Socially whether you can explain off that your PDS acted maliciously or that it was hacked or whatever is a different story but if you keep recovery keys for your DID you can take back control and undo everything your PDS did that you didn't authorise pretty trivially. The UX for it needs to be improved but technically the process is super simple/straight forward.

And those recovery keys provide a mechanism for declaring "hey i didn't do this I was hacked" on top of specific events but nothing for taking advantage of that cryptographic opportunity has been built out yet.

nekusar3• 1 month ago

If its an Onion (Tor) hostname, you absolutely do own it. Sure, its not memorable being a 128 bit hash. And nobody else can impersonate nor take.

And for lower bandwidth tasks, Tor Onions can't be beat. Just make sure to use 2fa on services you offer to keep the trash out. Things like fail2ban don't work the way you intend.

pocksuppet5• 1 month ago

Let me just require a phone number for my totally anonymous drug-market service

drdexebtjl4• 1 month ago

I do. I registered it directly with my ccTLD’s registry, which is a government agency. It’s tied to my national ID number, or to my company’s tax ID.

If my DNS provider messes up, I revoke their DNSSEC keys and point my domain to a different provider.

Domain registration should be national public infrastructure.

pocksuppet5• 1 month ago

More importantly, ICANN can seize your domain if you don't comply with US law (e.g. if you call for a boycott of Israel) unless it's under another country's ccTLD.

jimmydoe2• 1 month ago

It seems most ppl who dislike X has already settled, a small amount moved to DeSo like atp or ap, most just stayed or went offline. Unless China GFW magically collapsed, there seems no reason ATProto user base will continue to grow. So, when will the monetization/enshitification phase begin?

I'm asking this not bc I like enshitification, but the app view design seems such a perfect fit for user data mining/targeting, that it's hard to believe it was not part of design consideration in day one.

kevinak8• 1 month ago

Atproto is not decentralised, it’s faux decentralised. You can technically be sovereign, but incentives and the way things have been done results in massive centralisation - 99.9% of users are on a Bluesky PDS and have not registered a higher priority rotation key. And they won’t, ever, because that’s how humans work.

The day Bluesky decides to enshittify there’s a very real possibility that they might also just stop allowing people to extract their keys and splinter off the network. The enshitification begins when VCs turn upp the heat it they start getting low on cash.

jimmydoe2• 1 month ago

ATP is more decentralized than X at least. Decentralized as a term is almost as loaded as Democratic. :)

Anyway I think we can agree on enshitification is coming soon. I'm just looking for signs of that's actually happening (or a counter theory that it would not happen)

theamk3• 1 month ago

Is author new at the whole web thing? Yes, people trust remote web servers. Yes, if you link multiple apps to an identity server (be it atproto, google, or self-hosted OpenID server), and your identity server is compromised, attacker will be able to impersonate you or lock you out.

This is just how the web works, and there is no easy around it without losing features people care about. Sure, you can do client-side encryption and pretend serve can't see the plaintext, but it's just a theatre, see Hushmail incident for example.

And having people export uber-key by default is pretty terrible idea. Sure, allow advanced users (like post author) to do it. But for the common person, the exported key is just another way to get account compromised, via malware or backup provider hacking. Or if they are not backing up stuff, then the key will get lost next time they upgrade.

logifail• 1 month ago

This is just how the web works, and there is no easy around it without losing features people care about [...]

Well, apart from using a separate email address for every single "provider"?

(Spoiler: there's no way I'm going to sign into your service with a shared email ... you get <youservice>@<me>.com)

ranger_danger4• 1 month ago

Some services only allow signups from the big free providers like gmail/outlook/etc. because those providers are doing more consistent KYC and anti-spam measures than anyone else by far, and unfortunately it does cut down on the amount of spam by a lot. For most people nowadays you cannot even create a new gmail account without directly linking it to a mobile phone.

Aurornis4• 1 month ago

Sure, you can do client-side encryption and pretend serve can't see the plaintext, but it's just a theatre,

Keeping a private keep on the client to sign your activity is a fundamental cryptography practice.

If you use a private key to sign your emails or git commits, it’s not security theater.

If you were to have to upload your private key to GitHub or your email provider, that would be severity theater.

Is author new at the whole web thing?

Unnecessarily mean comment.

theamk3• 1 month ago

The key word is "web", and all associated ecosystem - the place where local devices are transient, and everything is in the cloud.

I personally have multiple regular PCs, sync the files around, do encrypted backups, and so on. I still have my files from 20 years ago, and I manage my personal keys.

But when I talk to other people, most people aren't like that! They don't do regular backups, they lose files all the time (phone broke -> files are gone), and when they transfer files, they do it via 3rd party, by emailing, dropboxing or uploading to Google Drive.

So how would they handle "private key"?

Most of then will never download the app, and will only use the website. I guess you can use browser web storage to store the key, but next time they run out of space and clear internet files, it would be gone. Or if their phone breaks. Or if the computer starts to behave strangely, so they wipe it all (not exaggerating, I've seen people do that). So keeping the key only in the browser is a terrible idea.

You can force them to download private key, but then what? Most people will simply forget it (after all, "I am just trying out this thing, no need to both with all the complex backups"), and the key will sit in Download folder until the PC/phone breaks. If you got lucky, they'll upload this to Google Drive/iCloud, so that megacrop will have a private key.

But the worst of all, even if you somehow magically get them to preserve the private key, it's useless. Remember, we are talking rogue operator here, and those are very likely the same people who are serving you the webpage and javascript blob that will obtain the key from local storage and decrypt. They will do the same thing hushmail did, which is to modify the webpage so it exfiltrates the private key.

(And yes, all of this can be worked around if you don't use web, and run the stuff locally. But this severely restricts users, and will kill the adoption)

tarpitt6• 1 month ago

Are you new to the whole p2p thing? This is a terrible standard to hold new technology to. The web is broken.

https://secushare.org/broken-internet

theamk3• 1 month ago

Yes, I am familiar with multiple solution that want to replace the web. They can solve all sorts of interesting problems, except one: how to get adoption.

I have nothing against people exploring alternative networking systems, but let's be clear: the only reason to run GNUnet (or Nostr, or SSB) is if you are interested in GNUnet/Nostr/SSB itself, or if you want to add exclusivity and wall your garden away from random visitors.

But many people have the opposite goal - they want their content to be accessible, and they want everyone to be able to participate, even if they are a high school student with 10 year old iPhone. And this means web.

So let's talk about how we can actually reach people, and this means figuring out how to get this web thing to work.

noname120• 1 month ago

AI fluff

opem4• 1 month ago

and what makes you say that?

Zopieux2• 1 month ago

It has all the tells. There are websites which list them, please search "LLM tropes".

drdexebtjl4• 1 month ago

It's not the data, it's the keys

is a heading

edit:

On ATProto, your PDS doesn't just store your Bluesky posts. It stores everything.
Not just your Bluesky account. Your ability to post, commit, publish, or interact across every ATProto app.
The repo data itself isn't the issue. It's all public anyway,
An attacker, a state actor with a warrant, or a rogue employee doesn't just get read access. They get the signing keys

Zopieux2• 1 month ago

So annoying to read. Meanwhile, the key information ("backup key with higher priority") is mentioned in a sentence without any kind of elaboration or link to some follow-up/how-to.

Stmz_Kinetics• 26 days ago

I have also the online services and i don't know where to put the people feedback, the reddit banned my account, and also here , it says , wait until we allow you to post

opem4• 1 month ago

Both nostr and atp sucks at key management imo. The Farcaster network does a good job here with their chain of trust model and a smart contract on etherium blockchain to recover identities in case of losing access to a private key. Ironically its also the blockchain aspect of Farcaster for which I never tried it.

Muromec• 1 month ago

So does a CA issuing my certificate, but there is some oversight in what they do.

jeroenhd• 1 month ago

That's different. While your CA can hand out new certificates, it doesn't know your keys (unless you messed up when uploading your CSRs).

CAs have to prove they're not faking certs through the certificate transparency logs, there's no such limitation on Bluesky.

A more apt comparison is a shared host that does certificate management for you. Those are also often considered less secure, of course.

skywalqer• 1 month ago

Why aren't the keys stored encrypted?

varun_ch• 1 month ago

I think most people don’t need to worry about their host abusing its power to impersonate them, but the cool thing is, the people who do need to/want to worry (journalists, politicians, celebrities, activists, open source maintainers, etc etc etc) can self host a PDS and be a lot safer, and still interact with everyone else.

tengada13• 1 month ago

Wait what?! For a protocol that incorporates the DID spec this is disappointing to discover. Unless I'm mistaken the DID spec allows provable hierarchical relationships between DID identities – why can't a child DID be created from our master signing identity that has the authority to CRUD on our behalf but still be provably distinct from our root identity?

Not even sure why the PDS would require our signing key that just seems very sloppy to me. As you can tell I know very little about atProto, and I did participate in the development of the DID standard and I am dismayed to see such an inelegant solution in such a promising protocol.

tengada13• 1 month ago

Oops upon closer reading of the article and the comments here i see that the atproto standard does apparently allow for the above, at least to some degree. If there is indeed hierarchical support for the DIDs then you should be able to disavow any child identity from a master identity and leave no public uncertainty (ie the true owner of the key hereby disavows the following sub keys)

So if the worst case scenario presented in this article took place where a PDS was falsifying information and pretending to be you, you could presumably somehow revoke the child key that you provided to the PDS. I'll have to look more closely at this

You could even publish a signed selective retraction (delete the fake posts or mark them as fake) with proof that you control the key 1 level above the key that posted them

kevinak8• 1 month ago

The point of the article is that 99.9% of users will not take custodial control of their identity - not that they can’t.

ascorbic4• 1 month ago

Sure, somebody else holds your identity, but it's pretty easy to control it yourself. By its nature if you're using somebody to host your stuff, you're trusting them with it. I made Cirrus so you can self-host your PDS for free, but you still need to trust Cloudflare to run it.

kevinak8• 1 month ago

It’s great that tings like this exist but as long as this is how identities work on ATProto it’s unfortunately going to be a niche thing.

ascorbic4• 1 month ago

The easy way is to create an account on Bluesky. That's as simple as creating an account on any other social network. The important bit though is that you can then, if you want, migrate to a different host and take your identity with you, or if you're brave you can self-host. This is by its nature something for power users, but regular users can use Bluesky accounts without ever knowing or caring about PDSs, DIDs or signing keys etc.

Who owns your ATProto identity?

Related Stories