An Authentication System Rooted In Privacy

Modern authentication is flawed

Authentication has eveloved a lot over this last half century. Many of these changes helped solve problems businesses faced but it often came at the expense of user privacy. Looking at the current state of online authentication can make it feel like this evolution was crafted by a bunch of evil businesses by normalizing some of these privacy compromising practices. However, if you look at it through the lens of the companies facing these problems, the solutions they came up with somewhat made sense. The bigger problem is that these solutions became mainstream, even for services that weren't facing these issues. This kinda locked us in these flawed solutions. And once businesses started collecting email addresses for account recovery, they realized those same addresses could also be used for marketing. Then profiles became richer. Then analytics improved. Eventually authentication wasn't just about logging in anymore but the foundation for collecting user data. None of these steps happened overnight. Each one made sense in isolation. Together they created the authentication systems we use today. and sharing identifying information with anyone and everyone became very normalized. Because of this, businesses started to try to fix this flawed solution instead of developing something better. This is very noticable nowadays with the rise of authenticator app. These apps improve security, but don't change the problem of privacy because it's an added mechanism instead of a replacement.

So, what is good about auth

Like I highlighted in yesterday's post, authentication is very important and is integral to the modern internet. So, let's identify what works well and what breaks down privacy. In a system it's very important to identify who did what. It's also important to different permission groups for more advanced systems. So, an identifying string is a must. Now, a common misconception is that this indentifying string needs to point to a human. While it does refer to one, the system shouldn't know. So, it's more for destinguishing be users and not about knowing who the human behind the identifying string is. This sis an important difference. So, knowing this, usernames are definetly here to stay. Next, Passwords are also very important. Passwords prove that you're the same person who created or controls the account. Since only the user who created the password should be the one with the permissions of the account. So, the basics of online auth are a must have. But there is one more thing I want to clarify about this. I'm not a big fan of the term "username". People always tend to get attached to names. And because of this attachment they tend to use the same username across all their services. This already makes it easier for companies to track you across platforms. So, a way around this is to have a system generated unique identifer. This prevends basic cross-platform tracking.

Managing many identities

Now, if you think about this system you might notice something very inconvinient. You will have a different username (and preferably also password) for every service. This sounds like too much of too much trouble for users to be on board with, and I agree. But no matter how you slice it, this would be the best way to preserve you identity online. Now, only if there was something that could keep track of all these online identities for you... Password managers are programs that help users with this exact problem. I like them a lot. it keeps track of which identity is used to connect to each service. It even takes care of generating and autofilling passwords. Amazing. The problem is though, all password managers out there are build ontop of the flawed modern auth systems. So, although, I'm in love with the they work (and I'll write a whole blog post about them later), they don't adress privacy. They just solve the security problems. By focussing on the passwords but still using emails and phone numbers as usernames, passwords managers miss the mark on privacy.

Taking back control

If every service had its own unique identifier and password, our privacy would improve dramatically. The problem is that this would be completely unmanageable for a normal person. That's why password managers became so popular. They solved the management problem. Unfortunately, they also inherited many of the assumptions of modern authentication instead of questioning them. That left me wondering: what would an identity manager look like if privacy was a first-class design goal? Similar to a password manager in the way that it helps with security and helps you manage different passwords for all you services. But better in the way that is also makes a unique username for all your services and makes sure emails and phone numbers will never be part of auth again. Now, you probably have a bunch of questions like, how is communication between the service and the user handles if an email is never shared, but this post is already getting quite long and the answer is very interesting. So, let's tackle that question tomorrow, shall we? Thanks again for reading! It's Sunday at the moment I'm writing this, meaning a new week is upon us soon. This comming week I'll be uploading my first walkthrough/tutorial of U-Net, and my blogs will include some more technical posts for my fellow developers. So, please look forward to it.