Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mozilla and Google Objections Overruled on “Decentralized Identifiers” by W3C

w3.org

Post reply on HN
Print view View original

31–40 of 199 posts

Re: Mozilla and Google Objections Overruled on “Decentralized Identifiers” by W3C

#31

Post by makeitdouble »

topspin wrote: post #28
jiggawatts wrote: post #21

Something that should be a bit of a warning flag is that I have two decades of identity-related experience but I still have no idea what DID even is . For reference, I've worked with three vendors' implementations of LDAP, several versions of SAML, OAuth, JWT, Okta, Azure Active Directory, etc, etc... I've even deployed Smart Card authentication in the field several times. I literally have no idea, not a clue what DI…

I found it all pretty simple after looking at it briefly when I first learned about it. A DID URI is a URI with a 'method' and globally unique part: did:method:somegloballyuniqueid. The "did" part is literal; a standardized URI namespace. The method part is some symbol that specifies how the unique id resolves and its representation (JSON, whatever.) The method part is what this story is about; W3C has declined to en…

What I get from your explanation: it’s a new way to deal with cases where one proves ownership of something else (but in a more indirect way than exposing or accessing the thing itself)

That reminded me of proof of domain ownership, where we point a registrar to an arbitrary field in our domain records to prove it’s ours.

Sadly I also don’t have enough imagination to see any practical use for that. It feels like an abstraction above every other systems we have today, except any provider would still need to support both this and the underlying actual protocol…

Re: Mozilla and Google Objections Overruled on “Decentralized Identifiers” by W3C

#32

Post by nl »

jiggawatts wrote: post #21

Something that should be a bit of a warning flag is that I have two decades of identity-related experience but I still have no idea what DID even is . For reference, I've worked with three vendors' implementations of LDAP, several versions of SAML, OAuth, JWT, Okta, Azure Active Directory, etc, etc... I've even deployed Smart Card authentication in the field several times. I literally have no idea, not a clue what DI…

It's a standardized version of Keybase IDs (which can also support non key based identity if you choose)

Re: Mozilla and Google Objections Overruled on “Decentralized Identifiers” by W3C

#33

Post by anon25783 »

I may be suffering from a deficiency of reading comprehension. Can someone please explain to me in plain terms what a DID is and what it's for? It's a "globally unique persistent identifier that does not require a centralized registration authority"[1] - great, an identifier for what exactly? Is it just supposed to be an identifier for anything at all? Local and remote resources? People? Pokemon cards?

[1] https://www.w3.org/TR/did-core/#terminology

Re: Mozilla and Google Objections Overruled on “Decentralized Identifiers” by W3C

#34

Post by aasasd »

jiggawatts wrote: post #21

Something that should be a bit of a warning flag is that I have two decades of identity-related experience but I still have no idea what DID even is . For reference, I've worked with three vendors' implementations of LDAP, several versions of SAML, OAuth, JWT, Okta, Azure Active Directory, etc, etc... I've even deployed Smart Card authentication in the field several times. I literally have no idea, not a clue what DI…

I'm gonna bet just from the requirements list quoted in that post that the implementations are supposed to be blockchains.

Re: Mozilla and Google Objections Overruled on “Decentralized Identifiers” by W3C

#35

Post by cratermoon »

aidenn0 wrote: post #4
cratermoon wrote: post #3

Earlier quoted context omitted.

Where have I heard this before? https://www.wired.com/2012/07/developer-quits-oauth-2-0-spec...

For those of us who aren't webdevs, what was the final fate of OAuth 2.0?

You may have heard the aphorism, "All problems in computer science can be solved by another level of indirection." This, or some variation of it, is known as the fundamental theorem of software engineering, variously attributed to Andrew Koenig, Butler Lampson, and David J. Wheeler.

With oauth2, literally any sort of authorization (or, in theory, authentication) is possible, but first you have to ask some endpoint for the details. In the case of oauth2, the core concept for authorization is "scope", but nothing is prescribed in scopes. They can literally be anything the auth provider describes. In theory, it's not supposed to matter – a consumer is just supposed to be able to pass around scopes from providers and let them determine if access is allowed. In practice, there's no practical way to reason about scope+resource permssions.

Oh, and despite the name, oauth2 is not about authentication, it's only about authorization. The OIDC spec, built on oauth2, provides authentication services, but again, there's no spec. Every auth provider does what it wants.

It's sometimes said that oauth2 is great for consultants, because any organization wanting to deal with it must hire (or contract with) specialist who can sort out the ill-defined problem space.

Re: Mozilla and Google Objections Overruled on “Decentralized Identifiers” by W3C

#36

Post by topspin »

makeitdouble wrote: post #31
topspin wrote: post #28

Earlier quoted context omitted.

I found it all pretty simple after looking at it briefly when I first learned about it. A DID URI is a URI with a 'method' and globally unique part: did:method:somegloballyuniqueid. The "did" part is literal; a standardized URI namespace. The method part is some symbol that specifies how the unique id resolves and its representation (JSON, whatever.) The method part is what this story is about; W3C has declined to en…

What I get from your explanation: it’s a new way to deal with cases where one proves ownership of something else (but in a more indirect way than exposing or accessing the thing itself) That reminded me of proof of domain ownership, where we point a registrar to an arbitrary field in our domain records to prove it’s ours. Sadly I also don’t have enough imagination to see any practical use for that. It feels like an a…

> It feels like an abstraction above every other systems we have today, except any provider would still need to support both this and the underlying actual protocol

It is an abstraction. As to the burden of 'providers', when one reads about the principles of DID design one finds a deliberate bias toward the identity side (person, thing, etc.): All the subject needs is their DID and to (somehow) verify that it represents their identity. Whatever backend providers inflict upon themselves to deal with that is their problem. This mentality is intended to make coping with identity easy for the 'I' (identity) party.

Re: Mozilla and Google Objections Overruled on “Decentralized Identifiers” by W3C

#37

Post by cratermoon »

bawolff wrote: post #13
ukulele wrote: post #7

Earlier quoted context omitted.

It's very widely used. Most SSO providers are using it, including the biggest ones.

Although personally i don't think its a great spec. Its a good enough spec (certainly better than saml, shudder) - "good" is not the same as works acceptably or popular.

After extensive experience with SAML and other specs, I don't think it's better than SAML in a fundamental way. It's certainly better in that it doesn't require a mind-numbingly verbose blob of XML, but strip away the XML and all that verbosity, and you basically end up with... kerberos.

Re: Mozilla and Google Objections Overruled on “Decentralized Identifiers” by W3C

#38

Post by cratermoon »

topspin wrote: post #22
teg4n_ wrote: post #19

I don’t understand the point of having a specification when 2 out of the 3 major browsers have objected. Who will implement it? Why bother with this?

Because expecting standardization of DID methods at this point is unreasonable. A premature attempt to standardize DID methods would be both futile and likely harmful. It's futile because the future universe of DID methods can't be anticipated now, so whatever wrong set of DID methods W3 promulgated would include both poor choices and omit good choices. It's harmful because whatever future methods might emerge will r…

> It's futile because the future universe of DID methods can't be anticipated now, so whatever wrong set of DID methods W3 promulgated would include both poor choices and omit good choices

Or maybe it's just too soon to try to carve a "standard" into the w3c process stone. A half-baked protocol is worse than no protocol at all.

Re: Mozilla and Google Objections Overruled on “Decentralized Identifiers” by W3C

#39

Post by [deleted] »

anon25783 wrote: post #33

I may be suffering from a deficiency of reading comprehension. Can someone please explain to me in plain terms what a DID is and what it's for? It's a "globally unique persistent identifier that does not require a centralized registration authority"[1] - great, an identifier for what exactly? Is it just supposed to be an identifier for anything at all ? Local and remote resources? People? Pokemon cards? [1] https://w…

[deleted]

Re: Mozilla and Google Objections Overruled on “Decentralized Identifiers” by W3C

#40

Post by O__________O »

The objections by Mozilla & Google make sense if you assume by denying their requests that the methods should be define prior to moving forward, but to me, the core as defined is more than enough to move forward and the next step is to define the methods.

Worst case, the core is flawed and the specs are revised to align to what has been learned flushing out the methods or it is abandoned for whatever reason. Mozilla & Google saying they object based on everything not being defined sounds like the opposite of progress to me.

The core already lays out specs for methods and clearly they’re good enough for other workgroups to already be moving forward refining methods for specific use cases. Here’s an example:

https://identity.foundation/peer-did-method-spec/

If there’s an significant issue with moving forward, I am not understanding it.

Post reply on HN