Mozilla and Google Objections Overruled on “Decentralized Identifiers” by W3C • Hacker News Board

Re: Mozilla and Google Objections Overruled on “Decentralized Identifiers” by W3C

#111

Post by mordae » Fri, Jul 01, 2022, 11:26 AM UTC

andreskytt wrote: post #83

topspin wrote: post #28

Earlier quoted context omitted.

I found it all pretty simple after looking at it briefly when I first learned about it. A DID URI is a URI with a 'method' and globally unique part: did:method:somegloballyuniqueid. The "did" part is literal; a standardized URI namespace. The method part is some symbol that specifies how the unique id resolves and its representation (JSON, whatever.) The method part is what this story is about; W3C has declined to en…

I’m genuinely curious as to why discussions on identity inevitably also involve claims about that identity. For authentication purposes, all that’s necessary is for a user to prove they are in control of an identifiers by presenting some credentials like a nonce encrypted with a private key. Yes, one can share data in-band during the authentication process (as part of the certificate, for example), but it’s not neces…

You too?

I mean, the data are immediately stale! And there is no persistent subscription to update the data to comply with GDPR. It's crazy.

Re: Mozilla and Google Objections Overruled on “Decentralized Identifiers” by W3C

#112

Post by tgsovlerkhgsel » Fri, Jul 01, 2022, 11:28 AM UTC

From Mozilla's objection: "The lack of restrictions on the registry are allowing methods ... which are actively globally harmful to sustainability."

That seems to me like Mozilla trying to push their social justice goals down into tech standards now.

Re: Mozilla and Google Objections Overruled on “Decentralized Identifiers” by W3C

#113

Post by tgsovlerkhgsel » Fri, Jul 01, 2022, 11:29 AM UTC

topspin wrote: post #28

jiggawatts wrote: post #21

Something that should be a bit of a warning flag is that I have two decades of identity-related experience but I still have no idea what DID even is . For reference, I've worked with three vendors' implementations of LDAP, several versions of SAML, OAuth, JWT, Okta, Azure Active Directory, etc, etc... I've even deployed Smart Card authentication in the field several times. I literally have no idea, not a clue what DI…

I found it all pretty simple after looking at it briefly when I first learned about it. A DID URI is a URI with a 'method' and globally unique part: did:method:somegloballyuniqueid. The "did" part is literal; a standardized URI namespace. The method part is some symbol that specifies how the unique id resolves and its representation (JSON, whatever.) The method part is what this story is about; W3C has declined to en…

That sounds very much like one of those solutions that is so complicated that it covers everything in theory, and in practice everyone just ignores it and picks some other standard (or 3...) that is actually narrow enough to cleanly implement and gets the job done.

Re: Mozilla and Google Objections Overruled on “Decentralized Identifiers” by W3C

#114

Post by barbarbar » Fri, Jul 01, 2022, 11:31 AM UTC

smarx007 wrote: post #103

As a user, I am very happy that W3C has overruled the objections. As a developer, it may a bit of a PITA, albeit a necessary one. For Google, it makes sense for them to request at least some "standard" methods. If the number of DID methods is sufficiently large, Google won't be able to use their network effect to dominate any of them. Surprise, that's the aim of the spec. For Mozilla, it makes sense to support a smal…

Isn't BankID only used in Sweden? At least I have not heard that it is used in Norway, Finland or Denmark.

Re: Mozilla and Google Objections Overruled on “Decentralized Identifiers” by W3C

#115

Post by Communitivity » Fri, Jul 01, 2022, 11:41 AM UTC

015a wrote: post #55

inopinatus wrote: post #41

Earlier quoted context omitted.

Spot on. The list at https://www.w3.org/TR/did-spec-registries/#did-methods tells you everyone who hopes to cash in. Basically it's like a urn, but every sketchy blockchain startup gets their own namespace.

I think it speaks extreme volumes that the "methods" of "did" and "com" were both proposed by no-name crypto organizations; "cosmos" seems to be proposed by one guy with a template website maybe unrelated to the relatively major Cosmos blockchain (they're fighting amongst themselves lol); "ens" was proposed by some organization with no website; "evan" was picked up by literally some guy named Evan. Its not just that…

If you have arguments against DIDs, then raise them here for rational discussion from all POVs, which is something HN is great at.

'"evan" was picked up by literally some guy named Evan' is not an argument. It's also not factual. The Evan DID method spec [1] was written by Sebastian Wolfram and Philip Kaiser. It is for the Evan Network, which is a blockchain attempting to provide a usable decentralized market infrastructure.

"that list alone is an extreme embarrassment for W3". First, a minor point. w3.org is the domain name, which has some minor cachet because it is a two letter domain. The organization is the World Wide Web Consortium, W3C. Second, hyperbole is present on HN at times, but should be avoided whenever possible because it raises the SNR for your comment, the thread, and HN overall. You could have phrased it without the hyperbole as "the status and standing of the objectors may be an impediment to future DID adoption". More accurate, and signal rather than noise. Of course, if you did any significant standards work you likely would know that objections like these are just as often motivated by market interests. I remember asking an OASIS long-time member about a rep on a standards committee I was on. The rep was from one big company whose name is a household word, and he seemed to do nothing but raise objections and build roadblocks. The long-time member told me he was known as that company's hatchet man. When they wanted to kill a spec before it got voted on they'd send him to join the TC and torpedo it from within. The work quality of the TC did not matter in what he raised, only his company's market drivers.

"I need to read up more on the spec". I would suggest you follow my approach: I do not criticize something I have not read end to end twice. The Evan statement above makes me think you didn't even read it once.

[1] https://github.com/evannetwork/evan.network-DID-method-speci...

Re: Mozilla and Google Objections Overruled on “Decentralized Identifiers” by W3C

#116

Post by jgilias » Fri, Jul 01, 2022, 11:47 AM UTC

barbarbar wrote: post #114

smarx007 wrote: post #103

As a user, I am very happy that W3C has overruled the objections. As a developer, it may a bit of a PITA, albeit a necessary one. For Google, it makes sense for them to request at least some "standard" methods. If the number of DID methods is sufficiently large, Google won't be able to use their network effect to dominate any of them. Surprise, that's the aim of the spec. For Mozilla, it makes sense to support a smal…

Isn't BankID only used in Sweden? At least I have not heard that it is used in Norway, Finland or Denmark.

Having lived in both Sweden and Norway, I can say for sure that it's used in both places. I'm not sure though if I could've used my Swedish bankid to log into a Norwegian bank.

Re: Mozilla and Google Objections Overruled on “Decentralized Identifiers” by W3C

#117

Post by akselmo » Fri, Jul 01, 2022, 11:48 AM UTC

barbarbar wrote: post #114

smarx007 wrote: post #103

As a user, I am very happy that W3C has overruled the objections. As a developer, it may a bit of a PITA, albeit a necessary one. For Google, it makes sense for them to request at least some "standard" methods. If the number of DID methods is sufficiently large, Google won't be able to use their network effect to dominate any of them. Surprise, that's the aim of the spec. For Mozilla, it makes sense to support a smal…

Isn't BankID only used in Sweden? At least I have not heard that it is used in Norway, Finland or Denmark.

Finland has something similar: i can use my bank account to log in to places to see my medical info for example.

Re: Mozilla and Google Objections Overruled on “Decentralized Identifiers” by W3C

#118

Post by alisonkisk » Fri, Jul 01, 2022, 11:50 AM UTC

PretzelPirate wrote: post #108

andreskytt wrote: post #83

Earlier quoted context omitted.

I’m genuinely curious as to why discussions on identity inevitably also involve claims about that identity. For authentication purposes, all that’s necessary is for a user to prove they are in control of an identifiers by presenting some credentials like a nonce encrypted with a private key. Yes, one can share data in-band during the authentication process (as part of the certificate, for example), but it’s not neces…

Because identity and credentials aren’t the same. A credential tells a system that “I have the correct secret” and an identity tells it “this is who I am”. Who you are is important in understanding what you can and can’t do in a system. For example, an identity might say “this person is a US citizen” and then all systems that can’t allow US citizens will respond appropriately and block your access. Credentials are of…

No post body was provided.

Re: Mozilla and Google Objections Overruled on “Decentralized Identifiers” by W3C

#119

Post by r00bot » Fri, Jul 01, 2022, 11:51 AM UTC

dmitriid wrote: post #93

r00bot wrote: post #82

Earlier quoted context omitted.

I personally take a hesitant approach to crypto/blockchain technology. I'm open to using it where it's legitimately better than other approaches, but for the vast, vast majority of applications traditional methods are always going to be better than shoe-horned decentralization. It's very unfortunate that the grifters have given the technology such a bad name when, like any technology, it has applications it excels in…

> like any technology, it has applications it excels in Name five.

I don't really think there are five applications it excels in, but there might be in the future..?

Like I said, we're still working out what it's good for. I've seen promising applications but nothing I'd say is obviously better than traditional technology. To dismiss the entire technology because of (admittedly a lot of) grifters is premature in my opinion.

Re: Mozilla and Google Objections Overruled on “Decentralized Identifiers” by W3C

#120

Post by Karunamon » Fri, Jul 01, 2022, 11:53 AM UTC

PretzelPirate wrote: post #108

andreskytt wrote: post #83

Earlier quoted context omitted.

I’m genuinely curious as to why discussions on identity inevitably also involve claims about that identity. For authentication purposes, all that’s necessary is for a user to prove they are in control of an identifiers by presenting some credentials like a nonce encrypted with a private key. Yes, one can share data in-band during the authentication process (as part of the certificate, for example), but it’s not neces…

Because identity and credentials aren’t the same. A credential tells a system that “I have the correct secret” and an identity tells it “this is who I am”. Who you are is important in understanding what you can and can’t do in a system. For example, an identity might say “this person is a US citizen” and then all systems that can’t allow US citizens will respond appropriately and block your access. Credentials are of…

You've described the identity of a person, which is not the only or the most common use for credentials.

Consider a public/private keypair, where the private key is the credential, the public key is the "identity", but that public key can grant access to any number of accounts despite not being anything other than a randomly generated key.