👽 at_work

Hey look, a guy working for Google invented a way to track us across Gemini servers. How unexpected.

1 year ago

Actions

👋 Join Station

29 Replies

👽 mathpunk

I think a lot of us on gemini are paranoid and avoidant of anything that might even look like tracking, and truth be told, I don't necessarily think that's a bad thing. That being said, I've re-read both of the proposals, and this doesn't exactly strike me as sinister or even remotely google-level spying. I'm actually pretty interested after reading the new proposal, this is something I'd probably try for myself. I think that as long as people implement it on an opt-in basis, there's not a lot of harm I can see in this. · 1 year ago

👽 morgan

@tm85 my apologies, it was not my intent to worry anyone.

I think if you look closely you will see there is nothing to worry about--either in the original post or the discussion or posts that followed.

There does not seem to be any possibility of breaking Gemini by adding tracking. That was, after all, one of its design goals. Discussion around the topic should show that it works as intended--and I think it does.

So, that's good :) · 1 year ago

👽 emilis

I've linked my Station and BBS identities without any fancy crypto: made the profile pages link to each other.

It's the same system that works for confirming profile links in Mastodon.

One note is that BBS allows for multiple links by accepting Gemtext inside profile text. Station escapes the text and allows only one link.

If you have more than two profiles, you could link to the primary one (preferably your capsule) and link all the others from there. · 1 year ago

👽 tm85

Disaster. This is exactly why I am trying to escape the web. This can't advance · 1 year ago

👽 morgan

New post with zero server proposal here:

gemini://circadian.gemlog.org/2023-06-11-identity-again-visual-hashing.gmi · 1 year ago

gemini://circadian.gemlog.org/2023-06-11-identity-again-visual-hashing.gmi

👽 morgan

@at_work

I think I said pretty clearly in my post that there isn't a problem yet. So, agreed.

Per my response to smokey, the simplest solution doesn't need a new server--it just needs existing servers to optionally show sha1s if/when each user wants to announce their "true identity". Fully opt-in and no central server.

The tech is either correct or not for privacy in the design itself, it doesn't care what I think or want. That's kind of the point :) so we can only benefit collectively by suggesting and evaluating potentially useful designs. Bad designs don't hurt anyone ;) we still learn from them.

Thanks. · 1 year ago

👽 at_work

@morgan So you do care about privacy. Yours, but not of others…

The whole “problem” about trolls and impersonation is ridiculous. I’ve been on Gemini for over 2 years, most of the time lurking daily. I have not seen a single manifestation of this problem.

I don’t believe Gemini userbase is growing. I think the data that Skyjake published recently confirms that. Therefore there is no potential risk.

So if you ignore the “problems” that don’t exist and look at what’s left - is there anything besides tracking users across servers? · 1 year ago

👽 morgan

Thanks smokey!

You are correct that if there is never a problem that the community thinks is worth fixing, there is never a need for anything in this space. That's fine. Not having problems is great ;)

The extra complexity needed to solve the problem minimally is very small; all that is actually needed is that servers give their users a way to opt in to having their client certificate sha1 displayed on their user page. Anything else on top of that is just for the sake of usability+convenience. · 1 year ago

👽 smokey

Also to answer morgans question of how to stop 'trolls'/impersonators, you don't. Intelligent and malicious assholes WILL find a way to poke holes into whatever fancy little system you happen to invent. Thats just the nature of human behavior. This kind of cutting edge technology space attracts developer/tinkerer/hacker types who are smart enough to exploit and break. Trying to tack extra things to the protocol just leaves it more open to possible vectors of attack. The solution isn't bloating the protcol to engage in an arms race with one or two jackasses. The solution is to grow a pair, accept sometimes people will do shitty things like impersonation, and touch some grass. · 1 year ago

👽 smokey

I don't really care about any of this. The life blood of any proposal is willingness to adopt by more than a few people. Its obvious that any proposal involving any kind of tracking/verification would be rejected on first glance by a majority of gemini users who are against such things to an almost fanatical extent. Its a miracle that client certificates even made it in. Not enough people want to adopt this for it to seriously make it in, end of story. · 1 year ago

👽 morgan

I do really, really like client certificates.

They are a much better mechanism than username+password, and a big strength of Gemini.

I also really, really like that single request per page and no scripting rules out pretty much all the nasty stuff on the web.

The point of Gemini is to be as simple as possible but not simpler. And it looks like a very nice balance. But human problems are very hard--the trolls are very hard to stop. Does Gemini support enough complexity, just enough complexity, to stop the trolls?

I hope so. Client certificates are simple, powerful, and I think they can do what we need, if/when we need it :) · 1 year ago

👽 morgan

Hi :)

I don't intend to confirm where I work, but it's easy enough to find if you go digging.

Now you are probably asking yourself--is this "morgan" the same one who wrote the post, or someone who created an account (the account is 5 mins old) just to mess with us?

There's no way to find out today. I don't think that matters today, either, because Gemini doesn't seem to have trolls yet. But if it grows, they will show up at some point.

I do hope Gemini grows, although I guess it will be slowly. So we should slowly be thinking about fighting the trolls. · 1 year ago

👽 akselmo

i thought it was just for identity verification, something like keyoxide. · 1 year ago

👽 danrl

nevertheless, the shitstorm in this thread is unjustified and i wonder how many people really read the proposal. of all possible tracking that could be done, this is the most obvious to the user and they can vote with their feet. we don’t know what tracking is already done behind the scene. this one would provide a useful service, even if it tracks, for those who want to be public. wouldn’t use it, but also don’t see why this shouldn’t be of value. · 1 year ago

👽 danrl

looks like a good idea for some use cases when a server doesn’t want to implement the whole user profile thing etc. i don’t think i would like to store my identity somewhere except my own capsule. · 1 year ago

👽 steve_dracula

Do not Google. · 1 year ago

👽 edanosborne

Excuse me, WHAT THE FUCK‽ · 1 year ago

👽 threkk

@at_work already?? · 1 year ago

👽 ruby_witch

It seems like this idea would result in some centralization of geminispace, at least for the identity verification server. I'm not so much in favor of that. · 1 year ago

👽 skyjake

You can check out the discussion on bbs.geminispace.org, but in any case the real problem here is that it's way too easy to impersonate prominent figures in Geminispace. @solderpunk, anyone? People probably wouldn't take such an account seriously without a corroborating gemlog post on circumlunar.space, but it would certainly cause confusion at least. · 1 year ago

👽 justyb

For those wondering, the post is here. gemini://circadian.gemlog.org/2023-06-08-gemini-identity.gmi

I would say it's absolutely not for me. It is pretty much a tracking cookie but with certs. with the Trade being that "MyUserName" would be that across sites that agree (sub/whatever) to accept identity that central location has on file.

So it may be for someone out there and Kudos to you. But hard pass from me. But it's cool that folks are forward thinking with Gemini and these kinds of things.👍 · 1 year ago

gemini://circadian.gemlog.org/2023-06-08-gemini-identity.gmi

👽 mozz

The personal attacks are super lame and uncalled for · 1 year ago

👽 moddedbear

Actually thinking about it more I could probably see myself using it. I'm already using the same fairly unique display name across everything. May as well verify myself.

I don't see tracking being a big issue either. For people like me using the same unique name everywhere, there's not really any additional information that could be collected if I understand correctly.

The bigger issue I see is the added complexity. Seems that a lot of people already struggle with the idea of using client certificates to authenticate. · 1 year ago

👽 moddedbear

I can see how someone could find value in the idea. Seems like a sort of way to automatically verify that you're the same person across different services. I don't think I'd use it and it's not for everyone, but I don't see any harm as long as it's opt-in. · 1 year ago

👽 eph

Not a fan. · 1 year ago

👽 mathpunk

I don't want to comment too much on things I don't fully understand. It seems to be opt-in? Which I guess is fine. Not something I would personally use. · 1 year ago

👽 userfxnet

wait, so morgan is a google employee? lol damn. usurpers are among us? that’s a damn shame. hard pass. · 1 year ago

👽 at_work

See the “Gemini Identity” proposal at bbs.geminispace.org . · 1 year ago

👽 mathpunk

Wait, what? How? · 1 year ago