Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Decentralized Identifiers (DIDs) v1.0 (W3C draft)

w3.org

Post reply on HN
Print view View original

61–70 of 89 posts

Re: Decentralized Identifiers (DIDs) v1.0 (W3C draft)

#61

Post by nine_k »

dwaite wrote: post #45
ghoshbishakh wrote: post #42

Earlier quoted context omitted.

Well DID spec doesn't tell us to put identity or related keys in public. DIDs coupled with the VC model ( https://www.w3.org/TR/vc-data-model/ ) allows identity credentials issued by any "trusted" issuer to be validated. Here trusted means whoever the user trusts, be it government or big tech or anything else.

The issue is not other identity information in the DID, it is the identifier mandate itself is antithetical to privacy. Having a global identifier as you go about the internet means that parties can correlate and share information about you. Trying to solve that by isolation (using a DID per party you want to interact with) negative affects their usability and privacy properties with verifiable credentials.

Then there ought to be a way tp cheaply produce verified but ephemeral identities, which may be discarded after a particular transaction.

User: I want to use this site.

Site: we need your trusted identity.

User: Trusted Third Party, please make an anonymous identity for me.

TTP: I know you, user; here's your new identity.

User: Site, look here, TTP which you trust says I'm legit.

Site: OK, transaction completed. '

User: (destroys the identity's private key.)

It's not very different from TLS certificates, or OAuth tokens, or even ephemeral credit card numbers. The thing is to have a common Trusted Third Party, and somehow keep the number of such parties large enough.

Re: Decentralized Identifiers (DIDs) v1.0 (W3C draft)

#62

Post by abzfd »

dwaite wrote: post #45
ghoshbishakh wrote: post #42

Earlier quoted context omitted.

Well DID spec doesn't tell us to put identity or related keys in public. DIDs coupled with the VC model ( https://www.w3.org/TR/vc-data-model/ ) allows identity credentials issued by any "trusted" issuer to be validated. Here trusted means whoever the user trusts, be it government or big tech or anything else.

The issue is not other identity information in the DID, it is the identifier mandate itself is antithetical to privacy. Having a global identifier as you go about the internet means that parties can correlate and share information about you. Trying to solve that by isolation (using a DID per party you want to interact with) negative affects their usability and privacy properties with verifiable credentials.

Where did you get the idea 'global' from? Have you seen Peer DIDs? Most specifications advise you to create limited purpose identities. Use a widely known one when it suits you, like a LinkedIn profile, or Twitter page.

Re: Decentralized Identifiers (DIDs) v1.0 (W3C draft)

#63

Post by infominer »

dwaite wrote: post #45
ghoshbishakh wrote: post #42

Earlier quoted context omitted.

Well DID spec doesn't tell us to put identity or related keys in public. DIDs coupled with the VC model ( https://www.w3.org/TR/vc-data-model/ ) allows identity credentials issued by any "trusted" issuer to be validated. Here trusted means whoever the user trusts, be it government or big tech or anything else.

The issue is not other identity information in the DID, it is the identifier mandate itself is antithetical to privacy. Having a global identifier as you go about the internet means that parties can correlate and share information about you. Trying to solve that by isolation (using a DID per party you want to interact with) negative affects their usability and privacy properties with verifiable credentials.

That's incorrect. DID make use of pubkey cryptography to create a new identifier for every entity one operates with... this argument is based on imagination

Re: Decentralized Identifiers (DIDs) v1.0 (W3C draft)

#64

Post by tetrisgm »

cel wrote: post #48
csense wrote: post #17

Earlier quoted context omitted.

It sounds like you understand enough about DID's to start incorporating them into an actual product. You'll have a bunch of users, and you want to give each of your users a DID. Congratulations! I certainly wasn't able to get that level of understanding from the document. In Section 1.1, it says the DID "did:example:123456789abcdefghijk" resolves to a DID document. Would you then be running some software with all you…

Great questions, csense. It is preferable that users bring their own DIDs, rather than you assigning them DIDs as a service provider, to ensure user autonomy. However, you can create DIDs via websites as you are suggesting, using did:web [1]. DIDs are structured or namespaced by DID Methods: the part after "did:" is called the DID Method name, and each Method has its own specification and implementations. There is a…

Thanks so much for taking the time to write a detailed answer. I was going to do this after work, but you’ve completely outdone what I would have said.

What project are you working on?

Re: Decentralized Identifiers (DIDs) v1.0 (W3C draft)

#65

Post by tetrisgm »

hanniabu wrote: post #30
tetrisgm wrote: post #2

Great to see some progress with the standard. We’ve been working on generating DIDs for our upcoming users. We’re using IDX + Ceramic as our backend. For our use case (making web3 profiles like https://shokunin.dns.xyz ), it’s cool to have a DID as a chain agnostic ID. I’m curious what people here have been using DIDs for besides that.

Idk, maybe it's just because I've already gotten used to ENS addresses, but I'd rather not have something that works become fragmented because w3 who's been asleep at the wheel on this feels left out and wants to remain relevant. How would DNS work with this? If it's chain agnostic then it doesn't seem possible to register names like you can now with them on Ethereum.

They’re different things. We generate the DID when the user creates an account. We use wallets to create that DID.

The issue of ENS is a side one. We do happen to have domains (and issue subdomains) on ENS, but that’s to have a pretty URL to resolve the DID. They’re not interdependent.

Re: Decentralized Identifiers (DIDs) v1.0 (W3C draft)

#66

Post by gary_0 »

nine_k wrote: post #61
dwaite wrote: post #45

Earlier quoted context omitted.

The issue is not other identity information in the DID, it is the identifier mandate itself is antithetical to privacy. Having a global identifier as you go about the internet means that parties can correlate and share information about you. Trying to solve that by isolation (using a DID per party you want to interact with) negative affects their usability and privacy properties with verifiable credentials.

Then there ought to be a way tp cheaply produce verified but ephemeral identities, which may be discarded after a particular transaction. User: I want to use this site. Site: we need your trusted identity. User: Trusted Third Party, please make an anonymous identity for me. TTP: I know you, user; here's your new identity. User: Site, look here, TTP which you trust says I'm legit. Site: OK, transaction completed. ' Us…

> The thing is to have a common Trusted Third Party, and somehow keep the number of such parties large enough.

Aye, there's the rub. What's to stop most sites from only allowing Google/Facebook as the Trusted Third Party? And you also need to worry about security breaches, or one company quietly buying up all the independents, or governments legislating in back doors, or every service you use ganging up behind the scenes to try and collate your "anonymous" public keys back into a single identity.

Don't get me wrong, I do think there's a way forward, but it's not going to be easy.

Re: Decentralized Identifiers (DIDs) v1.0 (W3C draft)

#67

Post by cel »

tetrisgm wrote: post #64
cel wrote: post #48

Earlier quoted context omitted.

Great questions, csense. It is preferable that users bring their own DIDs, rather than you assigning them DIDs as a service provider, to ensure user autonomy. However, you can create DIDs via websites as you are suggesting, using did:web [1]. DIDs are structured or namespaced by DID Methods: the part after "did:" is called the DID Method name, and each Method has its own specification and implementations. There is a…

Thanks so much for taking the time to write a detailed answer. I was going to do this after work, but you’ve completely outdone what I would have said. What project are you working on?

You're welcome.

I'm working on ssi/DIDKit, at Spruce:

https://github.com/spruceid/ssi

https://github.com/spruceid/didkit

Re: Decentralized Identifiers (DIDs) v1.0 (W3C draft)

#68

Post by Ken_Adler »

openthc wrote: post #58
Ken_Adler wrote: post #56

Earlier quoted context omitted.

Especially in British Columbia. The government is way forward in implementing "TrustOverIP.org" type DID/VC/ETC systems for interacting with the government

You're both sorta correct; cannibis in Canada is covered by Health Canada who's still taking reports via CSV upload. It's like a 4k column thing. And no IDs

BC's "orgBook"... running on Hyperledger Indy blockchain

https://www.orgbook.gov.bc.ca/en/home

This link has a search for Cannabis in BC's org book

https://www.orgbook.gov.bc.ca/en/search/name?query=cannabis&...

Re: Decentralized Identifiers (DIDs) v1.0 (W3C draft)

#69

Post by tty7 »

jeremie wrote: post #27

This should be v0.1 based on the actual utility of the spec, just because it's been incubated for so long doesn't magically make it useful. DIDs are fundamentally antithetical to privacy and will only enable a deeper and more obscure level of tracking to all applications that use them. They were originally inspired for mapping public blockchain use-cases, but IMO personal identity and related keys should _never_ be p…

DIDs do not specify keys should be written to a public chain, another commented mentioned the VC spec.

Another thing to look at is the did:peer method, it allows you to have a direct connection with a party for secure communication. Either party could root their did against a public key (eg a public organisation) but that is not required.

Re: Decentralized Identifiers (DIDs) v1.0 (W3C draft)

#70

Post by jarym »

sedatk wrote: post #44
jarym wrote: post #26

Personally not in favour of using ':' as a separator since amongst other things it has to be escaped in HTTP query parameters.

No, it doesn't? Colon is a special character only in the hostname part of a URI to signify the port number. It's free to use anywhere else without escaping.

I swear most places convert : into %3A if I haven’t lost my mind?
Post reply on HN