Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mozilla and Google Objections Overruled on “Decentralized Identifiers” by W3C

w3.org

Post reply on HN
Print view View original

81–90 of 199 posts

Re: Mozilla and Google Objections Overruled on “Decentralized Identifiers” by W3C

#81

Post by capableweb »

jiggawatts wrote: post #21

Something that should be a bit of a warning flag is that I have two decades of identity-related experience but I still have no idea what DID even is . For reference, I've worked with three vendors' implementations of LDAP, several versions of SAML, OAuth, JWT, Okta, Azure Active Directory, etc, etc... I've even deployed Smart Card authentication in the field several times. I literally have no idea, not a clue what DI…

> Something that should be a bit of a warning flag is that I have two decades of identity-related experience but I still have no idea what DID even is.

I'm not sure this is the "flex" you wanted it to be. A cursory look at the specification gave me a pretty good idea what DID are supposed to be, and for (and I would only say I know enough identity-related stuff in order to implement things in my own services, but not over two decades). The use cases are relatively easy to understand, and there is bunch of implementations in the wild as well.

Maybe it would also help by looking at some of the proposed DID methods that are more similar to the approach you're used to. While not centralized, maybe DNS is something you're more familiar with, so you can link it together with existing knowledge?

In that case, the specification for the `did:dns` method, using DID together with DNS might be helpful for you: https://danubetech.github.io/did-method-dns/

What exactly is it you don't understand? Maybe your knowledge about centralized identity management is not helping you in this case, but making it harder to understand.

Re: Mozilla and Google Objections Overruled on “Decentralized Identifiers” by W3C

#82

Post by r00bot »

mtsr wrote: post #72
EGreg wrote: post #67

Earlier quoted context omitted.

Why sigh? Why are Bitcoin maxis and HN Web 2.0 people so intent on keeping everyone from advancing to the next phases of the Web? Do you like centralized VC-funded “cloud”-hosted startups incubated in Silicon Valley that get gobbled up by big tech or dumped on the public? You like the extreme power inequality between those who run these systems and the public? You think the best our systems can do is extract rents at…

It might have something to do with all the cryptobro’s pushing get-rich-quick-schemes. Crypto-enthusiasts ignore how regulations existed for good reasons before regulatory capture made a mess of things. Not everyone likes the idea of an anarchocapitalist future. And I’m not even talking about the outright scamming and the fact that most crypto’s primary use case is criminal. Or the environmental issues of spending en…

I personally take a hesitant approach to crypto/blockchain technology. I'm open to using it where it's legitimately better than other approaches, but for the vast, vast majority of applications traditional methods are always going to be better than shoe-horned decentralization.

It's very unfortunate that the grifters have given the technology such a bad name when, like any technology, it has applications it excels in and others it doesn't. We're still definitely in the phase of working out what, if anything, blockchain is better (than centralised implementations) for. And it sucks that that search is being negatively impacted by all the grifters.

In the future I wouldn't be surprised if we saw 99.99% of blockchain stuff dead, but the small percentage that survive could disrupt some industries (I'm not convinced finance is one of those industries though lol).

Re: Mozilla and Google Objections Overruled on “Decentralized Identifiers” by W3C

#83

Post by andreskytt »

topspin wrote: post #28
jiggawatts wrote: post #21

Something that should be a bit of a warning flag is that I have two decades of identity-related experience but I still have no idea what DID even is . For reference, I've worked with three vendors' implementations of LDAP, several versions of SAML, OAuth, JWT, Okta, Azure Active Directory, etc, etc... I've even deployed Smart Card authentication in the field several times. I literally have no idea, not a clue what DI…

I found it all pretty simple after looking at it briefly when I first learned about it. A DID URI is a URI with a 'method' and globally unique part: did:method:somegloballyuniqueid. The "did" part is literal; a standardized URI namespace. The method part is some symbol that specifies how the unique id resolves and its representation (JSON, whatever.) The method part is what this story is about; W3C has declined to en…

I’m genuinely curious as to why discussions on identity inevitably also involve claims about that identity. For authentication purposes, all that’s necessary is for a user to prove they are in control of an identifiers by presenting some credentials like a nonce encrypted with a private key. Yes, one can share data in-band during the authentication process (as part of the certificate, for example), but it’s not necessary and verifiable claims can be shared via a myriad of other mechanisms like API calls. So why do we spend enormous amounts of resources on trying to merge authentication and data sharing?

Re: Mozilla and Google Objections Overruled on “Decentralized Identifiers” by W3C

#84

Post by vivegi »

There is validity in the W3C position as well as the objections raised by the various parties. However, the respective positions of the parties are on different axes.

It is helpful to look at the DID-core as the WHAT with the methods of the DID to specify HOW.

The methods set is left open by W3C (i.e., an item in the method registry) and rightfully so. The objectors want it to be a defined, possibly closed set before it moves to Recommendation track.

To see why this makes sense, suppose I am a service provider and I need identity services to authenticate and authorize. If I define the data elements that constitute identity (eg: name+phone or emailaddr or nationalid etc.,) in my application. The then DID allows the server and the client to agree on identity by exchanging the DID document and verifying the claims in it using the methods in the DID document.

If we need flexibility in the set of dataelements that constitute identity, then the methods MUST be kept open. The method is only an interface contract that specifies how to validate a specific DID.

Suppose there is a method that relies on nationalid then any future service that also supports the method should be able to interoperate. Whether a service implements that interface or not is a choice that the service can make.

By decoupling the WHAT from the HOW, I could have a fully decentralized identity system (perhaps with services provided by the OS or apps) and sharing only zero-knowledge-proofs with the counterparties without sharing underlying information (or only information necessary for the transaction).

I think this makes sense and is a step in the right direction.

Re: Mozilla and Google Objections Overruled on “Decentralized Identifiers” by W3C

#85

Post by SahAssar »

asimpletune wrote: post #57
cratermoon wrote: post #38

Earlier quoted context omitted.

> It's futile because the future universe of DID methods can't be anticipated now, so whatever wrong set of DID methods W3 promulgated would include both poor choices and omit good choices Or maybe it's just too soon to try to carve a "standard" into the w3c process stone. A half-baked protocol is worse than no protocol at all.

> A half-baked protocol is worse than no protocol at all. I think the literal opposite is true, no?

If there is no protocol nobody expects interoperability.

If there is a half-baked protocol everyone expects interoperability but it never works as it should.

Re: Mozilla and Google Objections Overruled on “Decentralized Identifiers” by W3C

#86

Post by high_5 »

jiggawatts wrote: post #21

Something that should be a bit of a warning flag is that I have two decades of identity-related experience but I still have no idea what DID even is . For reference, I've worked with three vendors' implementations of LDAP, several versions of SAML, OAuth, JWT, Okta, Azure Active Directory, etc, etc... I've even deployed Smart Card authentication in the field several times. I literally have no idea, not a clue what DI…

As far as I understand it (from skimming through a couple of docs and presentations), DIDs are similar to specs for assertions and/or attributes which are stored in a blockchain which functions as federation metadata datastore and IdP at the same time.

Re: Mozilla and Google Objections Overruled on “Decentralized Identifiers” by W3C

#87

Post by pmontra »

vxNsr wrote: post #74
bawolff wrote: post #15

A standard flexible enough where you can do literally anything is usually a bad standard. The point of standards is to write up some small-ish base that everyone can agree on so that people can talk to each other. A standard containing everything where each implementation implements a different incompatible subset, is a failure.

3 sentences on why usb type-c/usb3/usb4/thunderbolt are a failure.

And despite all the mess they are selling well.

Re: Mozilla and Google Objections Overruled on “Decentralized Identifiers” by W3C

#88

Post by pmontra »

high_5 wrote: post #73
Taek wrote: post #6

I've been following DID for a while and I really don't think its the right approach. The voices of concern from Mozilla and Google are spot on: the DID specs expect everyone to coordinate on finding the right structure for different types of data but the real world is messy and no "correct" structure exists. DID in my opinion is unlikely to succeed. Real builders don't use it, because it is cumbersome and requires ag…

> DID in my opinion is unlikely to succeed. Probably a few big tech companies will form a consortium and use their weight for setting a de-facto standard.

Or they won't use it and will be confined to a long tail of use cases?

I mean, not all of the Internet is accessed through a browser but if Chrome and Firefox don't support DIDs, even if Safari would, who would use DIDs in a context exposed to browsers?

Re: Mozilla and Google Objections Overruled on “Decentralized Identifiers” by W3C

#89

Post by jgerrish »

MBCook wrote: post #18

So if Google, Apple, and Mozilla all opposed this what are the chances it ever actually becomes useful? Just because something was given the stamp of approval by the W3C doesn’t mean they actually have to implement it.

That use case chart is kind of interesting.

Like, it's not a flat URI scheme leaving structure up to controllers. But it's also not a fully defined ontology.

Pick a use case description in section three. Any one. Each one could provoke an entire domain-specific organization into heated arguments about subrequirements and subsubrequirements.

Even if this recommendation doesn't make it, it's neat.

Any way you turn you walk into this system, right?

Re: Mozilla and Google Objections Overruled on “Decentralized Identifiers” by W3C

#90

Post by radicalbyte »

015a wrote: post #55
inopinatus wrote: post #41

Earlier quoted context omitted.

Spot on. The list at https://www.w3.org/TR/did-spec-registries/#did-methods tells you everyone who hopes to cash in. Basically it's like a urn, but every sketchy blockchain startup gets their own namespace.

I think it speaks extreme volumes that the "methods" of "did" and "com" were both proposed by no-name crypto organizations; "cosmos" seems to be proposed by one guy with a template website maybe unrelated to the relatively major Cosmos blockchain (they're fighting amongst themselves lol); "ens" was proposed by some organization with no website; "evan" was picked up by literally some guy named Evan. Its not just that…

When we were designing the EU DCC we explicitly choose not to go down the path of the then-nascent w3c verifiable credentials using DIDs. There was a hard lobby from the blockchain bullshitters but they couldn't explain things without a lot of hand waving and technobabble so :)

There's a reason why our spec (EU-DCC) is a global standard: we build on proven technology, we're explicit, and we're not open to allow anyone and their dog to become a "trust anchor". That trust is earned, there are standards you need to follow and keep following to earn that.

DIDs are a wild west and clearly a not-too-unsubtle attempt by the crypto bros to sneak a cash-cow into standards.

The spec reads like it's written by a group of hyperactive kids in a sugar rush.

Post reply on HN