Using Namecoin for Identity

published

2014-12-28

On the internet, it can be a challenge to know if you are connecting with who you think you are and not some impostor. Many websites don't care who they are talking to in particular, as long as one person can't masquerade as another person, so they ask each user to choose a password and knowledge of the password is sufficient to establish their identity for the purposes of the site. But sometimes you need to make sure you are communicating with the right person.

The "right" person is the person you want to connect with, which you must know through some other connection. For example, you might know them by name, their face, and their city of residence. Or maybe you only met them through Twitter and you don't know anything else about them besides their Twitter username. Whatever the nature of the connection you have with this person, it provides a type of identification (or combination of types). The challenge is essentially to securely link all the various types of identification a person has so that others can connect to them through other channels besides the one that they originally established a connection through.

For example, I may have received several helpful pull requests from a user on Github over a period of time and I want to send them some Bitcoin to thank them. I could send them a message and ask for their Bitcoin address, but this solution isn't perfect. First of all, it requires additional effort for both parties, but also from a security standpoint, there is a risk that someone working at Github could swap the Bitcoin address for one that they own and I might end up sending the bitcoins to the wrong person. That might sound a bit paranoid, but this is a very general problem and isn't limited to such casual interactions. It would be nice to have a highly secure solution.

Now I don't care who exactly this Github user is. It doesn't matter where they live or what their real name is; all that matters is that my bitcoin payment goes to the same person who gave me the pull requests. Namecoin provides a great solution to this.

Suppose that the Github user has a Namecoin ID with all of their identities listed in the record. The record contains a link to their Github account, their Bitcoin address, their email address, their PGP public key, their Twitter username, their Facebook username, a link to their homepage, etc. And also suppose that they put their Namecoin ID in their profile on all of these sites.

Now it's easy for me to lookup their Namecoin ID in the Namecoin blockchain and find their Bitcoin address. An attacker at Github could still substitute the Namecoin ID in the user's profile and create a fake Namecoin record with a different Bitcoin address though. To mitigate this attack, I could use special Namecoin identity software that scans all Namecoin records for duplicate links. If it detects two records that both link to the same Github username, I can postpone the payment until I figure out which one is correct. If the user had not yet made a Namecoin account and the Github employee attacker made it look like they did, then I could still be tricked, but that attack becomes obsolete if everyone uses the system.

Even in this early adoption phase where spoofing is possible, it would be much more difficult because an attacker would have to spoof multiple channels at the same time (an identity would not be considered secure if it only had one or two links in the Namecoin record). For example, lets say the Github employee attacker changed the user's profile to show a fake Namecoin ID and made the correspond Namecoin record with a link back to the user's profile. In addition, the record shows a Twitter username. If it is the user's real Twitter account, then it won't contain a backlink to this Namecoin ID, so it won't be considered valid by the identity software, which checks backlinks automatically. If they use a fake Twitter account, then the identity software might detect that the account was created recently or has very little activity or looks suspicious or has been flagged by other users. Even if the fake Twitter account passes the automatic filters, I could check it myself to be careful and potentially notice that it doesn't correspond to the user that I was looking for. Again, this attack would be automatically thwarted if the user was already using this system.

This is also useful for things like PGP key exchange because typically people have some long-lasting online relationship with their acquaintances, such as through Facebook and email, which would be very hard for an attacker to fake.