Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Getting started with decentralized identity

nathangould.com

Post reply on HN
Print view View original

21–30 of 67 posts

Re: Getting started with decentralized identity

#21

Post by Proven »

conradev wrote: post #14
Animats wrote: post #7

As I said 48 days ago when this last came up on YC, the classic "Why your idea for stopping spam sucks" list applies.[1] Go re-read that and you'll see the same identity problems and proposed solutions. If people can create and abandon identities cheaply. they will use those identities for annoyance or fraud. Hence spam, robocalls, etc. This is also why the "federated" social networks are not too useful. On the other…

> The process of binding a DID to something in the physical world, such as a person or an organization — for example, by using verifiable credentials with the same subject as that DID — is contemplated by this specification and further defined in the Verifiable Credentials Data Model [VC-DATA-MODEL]. https://www.w3.org/TR/did-core/#proving-control-and-binding Here is the diagram: https://www.w3.org/TR/vc-data-model/#…

No post body was provided.

Re: Getting started with decentralized identity

#22

Post by judge2020 »

bawolff wrote: post #19
conradev wrote: post #14

Earlier quoted context omitted.

> The process of binding a DID to something in the physical world, such as a person or an organization — for example, by using verifiable credentials with the same subject as that DID — is contemplated by this specification and further defined in the Verifiable Credentials Data Model [VC-DATA-MODEL]. https://www.w3.org/TR/did-core/#proving-control-and-binding Here is the diagram: https://www.w3.org/TR/vc-data-model/#…

> but the idea is that I can now take this cookie, show it to a third party and the third party can verify the credential's validity. Or you know, like oauth. Or if you want to really play up the credential angle, how tls client certificates work, if anyone would ever use them.

Perhaps TLS client certificates are unpopular because pretty much everyone uses some sort of anti-ddos or caching server in front of their services (cloud load balancers, fastly, akamai, cloudflare) so any TLS client certificate authentication and validation has to be baked into the service[0] (another possibility could be the service encoding the client's information and shipping it to the origin server via headers).

Another options for companies is only signing request bodies and validating a request signature in the header like discord does[1].

0: https://developers.cloudflare.com/api-shield/security/mtls/c...

1: https://discord.com/developers/docs/interactions/receiving-a...

Re: Getting started with decentralized identity

#23

Post by helloworld11 »

Animats wrote: post #7

As I said 48 days ago when this last came up on YC, the classic "Why your idea for stopping spam sucks" list applies.[1] Go re-read that and you'll see the same identity problems and proposed solutions. If people can create and abandon identities cheaply. they will use those identities for annoyance or fraud. Hence spam, robocalls, etc. This is also why the "federated" social networks are not too useful. On the other…

Bullshit on at least a couple fronts.

First, even when people strongly have their real identity tied to their digital or other activities, it amazingly often does nearly nothing at all to stop them from all kinds of spammy abuse, fraud, lying, trolling and all sorts of bad behavior. This happens across the board, world-wide in any non-personal social or digital setting.

Secondly, I'd argue that the ability to "decentralize" ID and anonymize oneself is more than worth having as at least a moderate bulwark against the pervasive parasitic, predatory modern corporate/government surveillance world that we increasingly live in. It's nice to talk about keeping people "respectful" with a strongly tied down identity but how ideal is this when these people live in a world of giant institutions that respect next to nothing whenever it's convenient for their interests?

Re: Getting started with decentralized identity

#25

Post by gonehome »

Animats wrote: post #7

As I said 48 days ago when this last came up on YC, the classic "Why your idea for stopping spam sucks" list applies.[1] Go re-read that and you'll see the same identity problems and proposed solutions. If people can create and abandon identities cheaply. they will use those identities for annoyance or fraud. Hence spam, robocalls, etc. This is also why the "federated" social networks are not too useful. On the other…

Urbit solves it by making the ID scarce with a cheap, but non-zero cost that makes spam prohibitively expensive.

It also makes blocking and moderation easy and the pseudonyms accrue reputation.

Re: Getting started with decentralized identity

#26

Post by ngould »

Confiks wrote: post #16

The article completely misses the mark in creating some weird narrative about 'web3 turning into web5', all seemingly based on a wordplay announcement by Dorsey, thereby giving that project a lot of undue credibility. In reality, many of the good projects and people referenced at the end of the article have been working for years without any notion that their projects are sprung out of some hyped but underspecified '…

OP here. Did not mean to imply that web5 sprung out of web3 in any sense. Really I just found web3 to be a useful reference point for explaining SSI. Lots of people understand how web3 works at this point, but there's way less mindshare around the idea of a digital wallet that actually holds credentials and not just private keys.

To that end, I'm generally happy to support the hype, and hope this stuff gets more attention from the web3 lot.

Re: Getting started with decentralized identity

#27

Post by RL_Quine »

helloworld11 wrote: post #23
Animats wrote: post #7

As I said 48 days ago when this last came up on YC, the classic "Why your idea for stopping spam sucks" list applies.[1] Go re-read that and you'll see the same identity problems and proposed solutions. If people can create and abandon identities cheaply. they will use those identities for annoyance or fraud. Hence spam, robocalls, etc. This is also why the "federated" social networks are not too useful. On the other…

Bullshit on at least a couple fronts. First, even when people strongly have their real identity tied to their digital or other activities, it amazingly often does nearly nothing at all to stop them from all kinds of spammy abuse, fraud, lying, trolling and all sorts of bad behavior. This happens across the board, world-wide in any non-personal social or digital setting. Secondly, I'd argue that the ability to "decent…

Yeah, in no small part that "identity" is transferable. It can be stolen, resold to other parties for a profit, or rented out.

Re: Getting started with decentralized identity

#28

Post by thomassmith65 »

helloworld11 wrote: post #23
Animats wrote: post #7

As I said 48 days ago when this last came up on YC, the classic "Why your idea for stopping spam sucks" list applies.[1] Go re-read that and you'll see the same identity problems and proposed solutions. If people can create and abandon identities cheaply. they will use those identities for annoyance or fraud. Hence spam, robocalls, etc. This is also why the "federated" social networks are not too useful. On the other…

Bullshit on at least a couple fronts. First, even when people strongly have their real identity tied to their digital or other activities, it amazingly often does nearly nothing at all to stop them from all kinds of spammy abuse, fraud, lying, trolling and all sorts of bad behavior. This happens across the board, world-wide in any non-personal social or digital setting. Secondly, I'd argue that the ability to "decent…

  even when people strongly have their real identity tied to 
  their digital or other activities, it amazingly often does 
  nearly nothing [...]
Is that based on any particular example? Off the top of my head, I can think of several mechanisms by which tying a pseudonym to a real identity could deter or address malicious behavior: law suit, jail time, loss of collateral, permanent ban of a human being from a service, etc.

   the ability to "decentralize" ID and anonymize oneself is more than worth [...]
Well, the downside is unstoppable crime, harassment, dis/misinformation... but let's entirely ignore all that, and just daydream about the valiant freedom fighters it will save from oppressive government /s

Re: Getting started with decentralized identity

#29

Post by Animats »

rektide wrote: post #17
conradev wrote: post #14

Earlier quoted context omitted.

> The process of binding a DID to something in the physical world, such as a person or an organization — for example, by using verifiable credentials with the same subject as that DID — is contemplated by this specification and further defined in the Verifiable Credentials Data Model [VC-DATA-MODEL]. https://www.w3.org/TR/did-core/#proving-control-and-binding Here is the diagram: https://www.w3.org/TR/vc-data-model/#…

Wow now it sounds awful for other reasons. Still pie-in-the-sky, but I still think we've been low ambition & not had good decentralized-identity-preconditions to begin exploring web-of-trust models. Past behavior is a huge indicator, one we can judge, & which many others will have judged. Trying to filter those other judges, decide what trust anchors we have & what biases to give, is a place where humanity would have…

> web-of-trust models

Been there, done that, seen it abused for SEO.

Post reply on HN