From a42f11d56f563d8b1e58c07aba62decab713d0e5 Mon Sep 17 00:00:00 2001 From: inference Date: Mon, 26 Jun 2023 02:18:41 +0100 Subject: [PATCH] Fix HTML link formatting. --- ...usted_the_issue_with_decentralisation.html | 35 +++++++------------ 1 file changed, 12 insertions(+), 23 deletions(-) diff --git a/blog/untrusted_the_issue_with_decentralisation.html b/blog/untrusted_the_issue_with_decentralisation.html index 1604d20..cf1ebfb 100644 --- a/blog/untrusted_the_issue_with_decentralisation.html +++ b/blog/untrusted_the_issue_with_decentralisation.html @@ -5,7 +5,7 @@ - + @@ -32,34 +32,25 @@

Posted: 2022-06-30 (UTC+00:00)

Updated: 2022-10-29 (UTC+00:00)

-

Table of Contents

+

Table of Contents

-

Introduction

+

Introduction

A recent trend is seeing people move towards decentralised services and platforms. While this is reasonable and I can understand why they are doing such a thing, they are seemingly doing it without thinking about the possible consequences of doing so. The issue with decentralisation is trust; there is no way to pin a key to a specific person, to ensure that you are communicating with the same person you are supposed to be communicating with. In this article, I will discuss some of the security issues with the decentralised model.

-

Examples

-

Messaging

+

Examples

+

Messaging

When it comes to messaging your contacts on a centralised platform, such as Twitter or Facebook, the keys are pinned to that user account, using the user's password as the method of identification. This approach makes it impossible to log in as a specific user without their password, should it be @@ -81,8 +72,7 @@ literally no way to know if the person you are communicating with is the real person or an imposter; there is no root of trust. This point is fatal; game over. The only way to establish trust again would be to physically meet and exchange keys.

-

Solution

+

Solution

I'll cut to the chase; there isn't a definitive solution. The best way to handle this situation is to design your threat model and think about your reasoning for avoiding centralised platforms. Is it lack of trust of a specific company? Is it the possibility of centralised platforms going @@ -116,8 +106,7 @@ currently available to me. While the domain name registrar or virtual private server host could tamper with my domain and data, they are the most trustworthy parties available. In its current form, decentralisation would make this impossible to implement in any form.

-

Conclusion

+

Conclusion

Do not demand anonymity; demand privacy and control of your own data. Complete anonymity makes it impossible to have a root of trust, and is typically never necessary. It is possible for someone else to hold your keys, without them taking control of them and dictating what you can and cannot do