Hacker News new | past | comments | ask | show | jobs | submit login

I'd love a system that required accounts and login (for moderation purposes), but then either made users anonymous to one-another, or only exposed identity on a per-thread basis (e.g. each user would get an identicon attached to each post, but it would be generated from SHA1(uid + threadid + salt), so in each new thread, your icon would change.)



That is implemented on 4chan. Your IP is your identity for moderation purposes. Not ideal, but an explicit goal is to never ever require logins.

IDs are present on some boards. The /int/ board for instance puts a country flag next to your post, /b/ used to have IDs the way you describe, then it didn't, but now it has them again, I think. Some other boards also have per-thread IDs.

And should you chose to do so, you can always pick a tripcode. Basically you pick a password, type username#password in the name box and it comes out as username!hash, where the hash is the same each time you type the same password.


Right, I'm familiar with all the things the Yotsuba codebase does for "identity." I was trying to say that they suck.

Tripcodes are an abomination--when you use them and others don't, you get made fun of, and allowing them to persist between threads removes the point of anonymity. Country flags (or any real-world-attached property of yourself), meanwhile, encourage hate and trolling.

Probably, the most obvious system would involve taking tripcodes, forcing the arbitrary-input-string to a numeric value one can increment (i.e. increment on each post where a "Keep Identity" checkbox isn't enabled) so that everyone always has one but they can still change easily, and then adding the thread-ID to the hash so that they can't be kept forever. And then visualizing them with something colorful, because when every post has a tripcode they become a mess of very-hard-to-track text.

Or, you know, hashed thread+user identicons, like I said.

> Your IP is your identity for moderation purposes. Not ideal, but an explicit goal is to never ever require logins.

You don't need logins to have accounts. Use an http://samy.pl/evercookie/, and generate an account for someone when you haven't seen them before. Make unnamed accounts ephemeral (expire them after a year or so.) And make it so that if you enter just an email address, you get sent a link that--provided it's opened under the same evercookie--merges the account it was opened in and its history into a named account.

Thus, the login flow looks like this:

1. go to 4chan, browse around, make posts;

2. decide you want to keep these posts;

3. enter your email address in the "email" field while making a post; now all the posts you made on this computer are attached to your account (but that doesn't retroactively change the identicon they have in their threads) and you are logged into that account from then on.

4. somewhere else, using a new computer, repeat 1-3.

This makes it much simpler to ban miscreants, while still generally keeping things anonymous. The one problem with it is that you won't be able to "remove" a 4chan identity from a (possibly public!) computer--but this can be handled by making computer identities separate from user identities, and allowing the "user" to log out while still remembering who the computer is. (And by making a ban ban both your current user- and computer-identity, of course.)


That's the exact experience of the Secret app.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: