Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Decentralized Identifiers (DIDs) v1.0 (W3C draft)

w3.org

Post reply on HN
Print view View original

71–80 of 89 posts

Re: Decentralized Identifiers (DIDs) v1.0 (W3C draft)

#71

Post by rad_gruchalski »

witweb wrote: post #41
jeremie wrote: post #27

This should be v0.1 based on the actual utility of the spec, just because it's been incubated for so long doesn't magically make it useful. DIDs are fundamentally antithetical to privacy and will only enable a deeper and more obscure level of tracking to all applications that use them. They were originally inspired for mapping public blockchain use-cases, but IMO personal identity and related keys should _never_ be p…

But what would be the solution? I've already played around with DIDs and Verifiable Credentials in the SSI-context and I like it from a tech perspective. I am also not sure if the spec should be held accountable to potential privacy misuses – the user should be. Additionally, you don't have to use the big tech solutions. The tech is inherently open, just look at the many DID methods. But what I am concerned of are co…

> The identity layer of a state should not be governed by a consortium of private companies, no matter what fancy governance model they have.

It’s the same with gaia-x.

Re: Decentralized Identifiers (DIDs) v1.0 (W3C draft)

#72

Post by nerdponx »

nine_k wrote: post #61
dwaite wrote: post #45

Earlier quoted context omitted.

The issue is not other identity information in the DID, it is the identifier mandate itself is antithetical to privacy. Having a global identifier as you go about the internet means that parties can correlate and share information about you. Trying to solve that by isolation (using a DID per party you want to interact with) negative affects their usability and privacy properties with verifiable credentials.

Then there ought to be a way tp cheaply produce verified but ephemeral identities, which may be discarded after a particular transaction. User: I want to use this site. Site: we need your trusted identity. User: Trusted Third Party, please make an anonymous identity for me. TTP: I know you, user; here's your new identity. User: Site, look here, TTP which you trust says I'm legit. Site: OK, transaction completed. ' Us…

Sounds kind of like LetsEncrypt, but for people.

Re: Decentralized Identifiers (DIDs) v1.0 (W3C draft)

#73

Post by schoen »

nine_k wrote: post #61
dwaite wrote: post #45

Earlier quoted context omitted.

The issue is not other identity information in the DID, it is the identifier mandate itself is antithetical to privacy. Having a global identifier as you go about the internet means that parties can correlate and share information about you. Trying to solve that by isolation (using a DID per party you want to interact with) negative affects their usability and privacy properties with verifiable credentials.

Then there ought to be a way tp cheaply produce verified but ephemeral identities, which may be discarded after a particular transaction. User: I want to use this site. Site: we need your trusted identity. User: Trusted Third Party, please make an anonymous identity for me. TTP: I know you, user; here's your new identity. User: Site, look here, TTP which you trust says I'm legit. Site: OK, transaction completed. ' Us…

> User: Site, look here, TTP which you trust says I'm legit.

What does "legit" mean here?

That's a really subtle issue for online identity applications.

Re: Decentralized Identifiers (DIDs) v1.0 (W3C draft)

#74

Post by ghoshbishakh »

abzfd wrote: post #62
dwaite wrote: post #45

Earlier quoted context omitted.

The issue is not other identity information in the DID, it is the identifier mandate itself is antithetical to privacy. Having a global identifier as you go about the internet means that parties can correlate and share information about you. Trying to solve that by isolation (using a DID per party you want to interact with) negative affects their usability and privacy properties with verifiable credentials.

Where did you get the idea 'global' from? Have you seen Peer DIDs? Most specifications advise you to create limited purpose identities. Use a widely known one when it suits you, like a LinkedIn profile, or Twitter page.

Exactly. DIDs don't need to be global identifiers. I can create multiple DIDs. Maybe one of them gets issued an identity VC. When required I may use that DID to prove my identity, otherwise use the other DIDs.

Re: Decentralized Identifiers (DIDs) v1.0 (W3C draft)

#75

Post by nine_k »

schoen wrote: post #73
nine_k wrote: post #61

Earlier quoted context omitted.

Then there ought to be a way tp cheaply produce verified but ephemeral identities, which may be discarded after a particular transaction. User: I want to use this site. Site: we need your trusted identity. User: Trusted Third Party, please make an anonymous identity for me. TTP: I know you, user; here's your new identity. User: Site, look here, TTP which you trust says I'm legit. Site: OK, transaction completed. ' Us…

> User: Site, look here, TTP which you trust says I'm legit. What does "legit" mean here? That's a really subtle issue for online identity applications.

It means: "TTP certifies that the user presenting identity X is indeed a user known to me, and is an acceptable user for the purposes that Site asked about: not a bot, not a spammer".

The idea that TTP certifies User against particular requirements of Site, and gives User an identity which User can give to Site. TTP keeps the "real" identity of the user hidden from Site, replacing it with a temporary identity.

TTP does not givel Site anything; User shares the temporary identity with Site. Then Site can check the identity, cryprographically and/or by asking TTP directly.

The identity should also be checked by a challenge-response protocol between Site and User, so that stealing it from User would be pointless. E.g. User keeps the private key and Site receives the public key, and Site asks to encrypt a random string, then tries to decrypt it.

Re: Decentralized Identifiers (DIDs) v1.0 (W3C draft)

#76

Post by runeks »

Is this a generalization of the SSL certificate authority system? An SSL certificate is a signature from a trusted authority that the corresponding private key of some signed public key is the owner of some domain, optionally with some address information as well.

Can DIDs be used to e.g. prove that my name is Rune Svendsen and that some provided profile picture is actually me? If so, it seems like this could be a decentralized replacement for Facebook, whose main function — in my opinion — is tying together a digital and physical identity.

Re: Decentralized Identifiers (DIDs) v1.0 (W3C draft)

#77

Post by j-pb »

capableweb wrote: post #46
j-pb wrote: post #24

Earlier quoted context omitted.

Apparently it also has bLoCkcHaIns.

Nope, no blockchains _in_ DIDs. But do give reading the specification (draft) a try yourself to verify.

Either your verifyable data registry is a blockchain or the thing should be called "root source of trust centralized, federated identifiers". Because otherwise the thing is like a DOI, where you're relying on a bunch of organisations to hand out random 128bit values out to people.

Re: Decentralized Identifiers (DIDs) v1.0 (W3C draft)

#78

Post by AlexITC »

runeks wrote: post #76

Is this a generalization of the SSL certificate authority system? An SSL certificate is a signature from a trusted authority that the corresponding private key of some signed public key is the owner of some domain, optionally with some address information as well. Can DIDs be used to e.g. prove that my name is Rune Svendsen and that some provided profile picture is actually me? If so, it seems like this could be a de…

> Is this a generalization of the SSL certificate authority system?

No, DIDs are a way to claim a decentralized identity but it doesn't prove any details related to our physical world, what you are mentioning about SSL is more-or-less Web of Trust, which DIDs do not support.

> Can DIDs be used to e.g. prove that my name is Rune Svendsen and that some provided profile picture is actually me?

No, anyone could easily claim that, and you need to be aware of who you trust.

Re: Decentralized Identifiers (DIDs) v1.0 (W3C draft)

#80

Post by nmadden »

jarym wrote: post #70
sedatk wrote: post #44

Earlier quoted context omitted.

No, it doesn't? Colon is a special character only in the hostname part of a URI to signify the port number. It's free to use anywhere else without escaping.

I swear most places convert : into %3A if I haven’t lost my mind?

Yes - technically you don't need to escape : in most places, but many implementations will do so anyway as they use a single encoding method for all URI components. (And if you don't encode these things where they are not required then you'll soon find lots of downstream systems that break).
Post reply on HN