Bisq 2 identity concept

[chimp1984]

For Bisq 2 there will be a more fine grained control for the users identity. I will lay out here the current ideas.

• An identity is a key pair associated with network addresses for the server[1] on the supported transport networks (e.g. hidden service address, I2P address). It can gets assigned to a "domain ID" which can be the offerID or a user defined tag
• By default the user creates a new identity for each interaction (e.g. each offer comes with its own identity - avoiding that multiple offers of the same maker can be linked by the pubKey or the onion address)
• The user can choose the level of privacy. E.g. the default option provides highest level of privacy but it does not permit that repeated interactions can be used to create reputation. Account age witness are such a sort of reputation or just to see how often one has traded with the same user. So there is a trade off to be made. It's in the hand of the user to make that decision. Defaults are for best privacy protection.
• The user could choose to use one identity for all fiat offers and another one for altcoin trades. Anything between the 2 poles is possible.
• There is a pool of servers started initially to be ready to be taken so when a user creates an offer they do not need to wait until the hidden service is published (which takes about 5 sec). This is a technical feature but helps to avoid UX drawbacks by the delay for the network server to be initialised.
• For the social trading aspect (e.g. chat channels) the user can create user name based accounts. They can use multiple and switch between them.
• The user name is chosen by the user but it will be extended by a short phrase and an icon generated from the pubkey hash. This should counter impersonating attempts. Reputation should be derived anyway not primarily from a user name but from other means like burned BSQ, feedback,...
• We could support also linking to external accounts (e.g. keybase, Github, Twitter,...) but I would leave that option out for the start as long it is not really needed. I think it causes more problems as it helps
• Identities can be exported and moved over to a newly setup Bisq instance or to other computers running Bisq. Though running 2 identities in parallel causes network reliability issues as its undefined which node a message would receive if both use the same onion address

Any feedback welcome!

[1] A network node consists of a server for accepting incoming connections and a socket for sending outbound messages. Bisq 2 use a default node for the gossip network (e.g. data distribution) and multiple nodes bound to identities. There can be a high number of such nodes (e.g. hidden services in case of Tor) so that even for power traders with 100s of offers it's possible to isolate each offer by a separate network address. All that is already implemented.

[pazza83]

This sounds great.

To avoid accidently doxxing oneself it would be good if payment accounts could be linked to a default identify, and identities could be given a tag that is visible to the local to the user only.

• Jim XMR Buying account
• XMR Seller XMR Selling account
• Bob EUR accounts
• Susan BSQ accounts
• BisqUser Social trades

[chimp1984]

Yes good points. I have not thought too much about the UX of it, but making it easy to manage and safe to not accidentally user wrong identities will be important.

[ripcurlx]

• There is a pool of servers started initially to be ready to be taken so when a user creates an offer they do not need to wait until the hidden service is published (which takes about 5 sec). This is a technical feature but helps to avoid UX drawbacks by the delay for the network server to be initialised.

What do you mean exactly with the pool of servers? Clearnet seednodes?

[chimp1984]

No, the users network server socket (for listening on new connections) like a hidden service in case of Tor.
We need to use other language in UI so users dont get confused with the term server. Atm I dont care too much about that but prefer to use the domain language.

[chimp1984]

Another Bisq contributor just recommended to integrate BIP-47 / PayNyms. And yes thats a perfect fit and there are existing implementations of a robot icon selection as well as a short text generation based on an address.

https://paynym.is/
https://github.com/e1ven/Robohash
https://robohash.org/
https://medium.com/samourai-wallet/wallet-update-0-99-96-introducing-soroban-adc9a36a7ddb

[andyDoucette]

Reputation based on number of trades is a broken concept. I can do 50 trades for $100 honestly and then enter a $100,000 trade and steal it all. I guess we could do reputation based on value traded honestly rather than number of transactions per account type. For each trade partner we'd show their reputation as (totalValueTradedHonestly)/(totalValueTraded+valueOfThisPossibleTransaction). This is basically the percentage of their value that they will have traded honestly IF they are dishonest in this next transaction. That last part is key. In the case of the 50 trades for $100 and then a $100,000 trade, their ratio would be 96% for a $200 trade and only 4.7% for that $100,000 trade. Thus, people need to start small and work their way up over time, gradually gaining more and more reputation that is proportional to how much temptation to cheat they've already resisted.

[chimp1984]

work their way up over time

I think that is a very important aspect. Time can be more valuable than money. Scammers are mostly not patient and they do not want to take risks by themself as they see the world full of scammers as they are usually surrounded by other scammers ;-).
So to put them into a situation that they need to risk somethings and invest some work/time is a good tool to keep them out.
No hard facts about that but something which got at least some support by the fact that the current Bisq protocol (security deposit) did never attract scammers (beside one incident with chargebacks from stolen bank accounts - which was the reason why we added the account age signing feature).

[andyDoucette]

But, I ask the question: Is there a way to design the system so we don't need a reputation system at all? Where it's never in your advantage to cheat the system? For example using payment methods that have a fixed time period where chargebacks are possible, and requiring that the trade take longer than that before it settles? Are there other attack surfaces besides chargebacks? The problem with reputation is that it necessarily ties different transactions together, meaning if any ONE of those transactions ends up getting tied to the person's identity, all of them are exposed. We lose privacy with reputation, so maybe we can go reputationless and just focus on technical ways we can reduce or eliminate risk? The other thing with reputation is everyone will start with 0 and it feels scary to trade with someone with 0 reputation - maybe this is going to be the time you'll get scammed. It's not a good user experience to be in fear all of the time, especially when you're new to something.

[chimp1984]

Those are all very valid and good points.
The ideas about reputation are limited to the social trading concept where certain constraints are in place. Like small trade amounts and that the BTC seller has BSQ burned which serves as a privacy-friendly reputation feature.
To add other sources for reputation like external links to social media platforms, number of trades or past trade volumes, feedback from other traders is optional and maybe not needed at all. Doing risk assessment is work and we want to lower that to the minimum.

Other trade protocols like atomic swaps will not require reputation at all.
The Bisq 2of2 Multisig protocol might require some for lowering chargeback risks, but there we likely stick with the account age signing concept which is more privacy-friendly. And it depends on the payment method.

For example using payment methods that have a fixed time period where chargebacks are possible, and requiring that the trade take longer than that before it settles?

Unfortunately thats difficult as up to 6 months chargeback is possible for most banks/payment processors. "Friendly chargeback" (where the user calls the bank to revert the transaction) are less of a problem as it cannot be repeated many times as the bank would flag such a client. So those scams do not scale up to become a critical problem for the platform itself. The main problems are chargebacks caused by stolen bank accounts, where additionally to the lost funds the user might get contacted by the police. But here 2FA has improved the situation over the past years at least in the EU. Security deposit and smalle trade amounts are other factors which tend to keep scammers off from Bisq.

In Bisq 2 we plan to be more flexible with payment methods and allow users to define whatever they want to use, including chargeback risky methods like PayPal. Traders will get a warning and have to take responsibility if they trade convenience against security here. This risk will also be reflected in the price so it might regulate itself.

It is a departure from the more protective attitude from current Bisq. There might be some people who get hurt by that like people who are clicking on phishing emails. But it also opens up flexibility and we push the edges where we do not have the resources and knowledge to make a decision if a payment method can be considered safe. Specially for emerging markets that should help and is a limiting factor now. Its very difficult to research and estimate risk for a payment method in some emerging markets country where a Bisq contributor cannot open an account for testing it out, so most of those options are left out in Bisq. By pushing the intelligence and responsibility to the edges we can server more of those people.