Mozilla and Google Objections Overruled on “Decentralized Identifiers” by W3C

The forces in place here seems to be:

- distributed ledgers allow a different (decentralized) paradigm for identity management, where users own their identities and service providers authorize and authenticate them through verifiable credentials

- years of blockchains and even more years of web certificates have created processes to handle cryptographic material, that service providers supposedly find more secure than "username and password" to manage the identities issuing the verifiable credentials

- in realpolitik, Microsoft (Azure) is expanding in the cloud market by trying to establish a presence in niches (ie: Intel SGX, DIDs) [1]

I understand the overall skepticism about blockchain related technologies, but the intrinsic advantages that I see in them are:

- (for a service provider) having a tamper-proof log of all the auth changes for an identity

- (for a service provider/user) relying on cryptographic signatures allows for a private validation of an identity/claim

- (for a user) provided this is not EEE allover again, a greater degree of choices on how to manage your identity

I do not have as much experience as you do, so maybe there is some wheel-reinventing that I am not aware of :)

0. https://docs.microsoft.com/en-us/azure/active-directory/veri...

1. https://techcommunity.microsoft.com/t5/identity-standards-bl...

Regardless of the legitimate issues raised by objectors, I am happy to have some W3C standard to build on. Methods may be underdefined, but as consensus is reached I could pivot to it. And even if no consensus is ever reached, I can at least try and reach consensus with the communities I care about.

Coupled with ActivityPub [1], this feels like a much safer foundation for building a DApp than anything else I have been able to find. The only thing that confuses me is the relationship between DID [2] and the Verifiable Credentials [3]. Can anybody explain how they relate, and how they should be used together (or not)?

[1] https://www.w3.org/TR/activitypub/

[2] https://w3c.github.io/did-core/

[3] https://www.w3.org/TR/vc-data-model/

Who you are is important in understanding what you can and can’t do in a system. For example, an identity might say “this person is a US citizen” and then all systems that can’t allow US citizens will respond appropriately and block your access.

Credentials are often shared, identities should never be shared. Credentials will often grant you access to a specific identity.

The issue with DID is that there isn’t a way to differentiate whether a credential holder matches the identity those credentials grant access to. The nice thing is that it allows for a set of attestations to be associated with your identity that allow you to essentially be verified once instead of per-system. You could have one financial company go through the KYC process for you and others could leverage their attestations about who you are.

You also don’t have to give control over your identity to a third party like Google, Apple, Meta, or Microsoft. I appreciate that since I’m leaving the Apple ecosystem and have way too many accounts set up which use Apple for login. It’s not fun to try and change that and recover my access to those sites.

"1. there should be no central issuing agency;

2. the identifier should be inherently persistent, not requiring the continued operation of an underlying organization;

3. it should be possible to prove control of the identifier cryptographically;

4. it should be possible to discover metadata about the identifier."

Additional capabilities got tacked on during discussions, and I think are handled in different specs, such as DID-Messaging, but at it's core the above are the primary requirements.

[1] https://www.w3.org/TR/did-use-cases/