We almost had decentralized logins with OpenID. I remember the push. It started seeing more widespread usage in the spaces I visited at the time, and even Google is/was an OpenID provider. Facebook and their “Login with Facebook” nonsense took things backwards when other vendors wanted to be a data tracker login provider, also.

With the ban evasion scenario you mentioned, having something like OpenID would give you an immutable ID number that can be used anywhere. Bans and blocks would go according to that ID, and evasion would require a new account. I think that would be a good middle ground for data privacy. It does make law enforcement’s job harder, though. Which does take us back to square one when it comes to removal of content, especially illegal content.

I am actually reaching the end of my knowledge on the subject in the following, so if anything after this is flat-out wrong with the technologies listed, I’d love some corrections.

If we go purely theoretical with existing tools, a blockchain would ideally assign those unique IDs. That’s a username and account creation date. GPG to sign each request (the second factor), and the entered password with the signature would decrypt an encrypted blob on IPFS with the requested information, similar to how Storj DCS stores data in encrypted buckets. Enter the wrong password, you get an empty bucket. Password recovery becomes an issue at that point, but one really should be using a password manager, passphrase, or hardware key these days, anyway.

Or use it as a feature and increase overall privacy by using a different password for each unique data blob shared with a service you’re authenticating with. It won’t matter, because your ID won’t change. For law enforcement, that does make things exponentially more difficult, maybe if you store the successful login attempts on the blockchain with the metadata that they claim to obtain from companies, it might work? There does have to be a balance between transparency and privacy.

Although you end up having new issues with trying to sync up the user accounts across the list, and username conflicts, never mind a small server possibly having to keep up with a big list of users. Lemmy already has issues where the registration process will silently fail if the name you’re trying to register isn’t available, with no more indication than a throbber that just sits there and spins forever.

Maybe something like how Lemmy does communities? A user can first register from a server, but the account gets shuffled around if they join another community.

I want to clarify my position before going into the rest of this - I like Kbin the most because it feels much nicer as an end-user.

There’s nothing wrong with Kbin and Cloudflare. The Cloudflare issues prevented Kbin.social from federating properly with Lemmy instances, harming its potential growth and community reach. Due to those federation issues (which only got resolved last night on .social it seems), I’ve had to make 3 more accounts on 3 different servers (fedia, lemmy.ml, and blahaj) in order to get the experience that I had a few days prior with only this account and a kbin.social account. That’s 4 server operators that have my information in order to access two services, instead of just the one. I’m kind of done with that.

There’s likely going to be another reddit migration in two weeks when the bigger third party apps officially shut down, which means I’ll have to juggle websites again when shit starts breaking under load. These issues in my opinion, are a deal-breaker for many people, including myself. I’m tolerating it for the time being because I spent almost 15 years on reddit, and they deserve their Digg moment.