I have been thinking about how accounts and permissions are setup in Maidsafe.
It would be really nice to be able to have multiple identities, with different access rights all managed by a single account.
My idea is persona trees. When you first create an account on the network, you use a username and password to create a root persona or identity. From this root, you are able to create children persona, and children from those children. Each persona gets their own private keys, access rights, can have their own private and shared files, and has their own public ID.
A persona can impersonate any of it’s descendants and has full access to their private data, keys, and rights. In this way, you can login with a single username and password and have access to all your data and credentials.
For very sensitive data, you may encrypt a persona with a secondary password. For an ancestor to access this persona, the secondary password must be used as well as the parent credentials.
There is no publicly visible link between personas. No one can tell any two persona reside on the same tree, unless the owner provides that information out of band.
Some use cases:
Isolating data for different applications. Your banking information is stored in it’s own persona. Your facebook-like application cannot access it, unless you authorize it through the root persona. Even though data is isolated, you still have a single username and password to access all of the applications and all of the data. Because login and persona management is handled by the core application, you can be confident that potentially malicious apps cannot use your single sign on credentials to conduct privilege escalation type attacks.
You are able to login to my Maidsafe account once on my phone. The phone should retain private keys to access the network. You can isolate what it can access in this manner (allow IM and contact information, but not banking data for instance), then you must enter my password to gain temporary access to more sensitive information.
The private keys stored on your phone are unique to that device. If it is lost, you are able to revoke those keys individually without affecting the persona(s) it had access to directly.
On a social network, isolate relationships with your friends from your work relationships and your family relationships.