Response to 'Call for Review: Decentralized Identifiers (DIDs) v1.0'

> In short, if the large platforms like Facebook, Google, Apple, Microsoft et al started using DIDs, we could start using logins across platforms instead of creating new accounts for each one.

Not a chance really.

First, DIDs define a method behind resolving data be it use a website, use bitcoin classic, etc. There are over 100 defined, and only "web" and "key" (inlined data in the URI) have achieved interoperability.

Second, if DIDs define authentication then your Apple/Facebook/Google account will require to own the DID so that they can make sure the authentication requirements aren't rewritten to be too weak to qualify.

Third, DIDs used in that way are less privacy preserving than the existing system, since it is now a global identifier shared with everyone.

mozilla conspiracy:

Mozilla referenced quite openly "Google sez PoW bad", idk if something this open is a conspiracy.

"Proof-of-work methods (e.g. blockchains) are harmful for sustainability (s12y). Also as noted by __Google__, the registry contains methods which rely upon proof-of-work which is wasteful. “Successful” proof-of-work systems ..."

Google simply wants to own the entire identity stack end to end, and they can, because they own Android. Same with Apple. Apple is canvassing various jurisdictions right now with their Digital ID, and demands internal govt discussions use a codename and that nobody mentions Apple by name, and also try to restrict who gets to know, gonna be one anti-open standard if they get their way. Google is likely doing the same, haven't been following this stuff too closely these days, but their ventures arm has made investments all over in identity in the last decade.

centralized objection:

The DID push from Microsoft hinges on their ability to route around the mobile platform control (because they don't have a mobile platform), so that they can even begin to compete with Apple/Google here. I'm sure Apple and Google just love the idea of being cut out and commoditized.

That's all this is about, Microsoft not having a mobile platform. so now MSFT is fighting for an open standard, which is hilarious. They don't care if it's centralized on some identity provider like github or whatever. If you dig deep enough all identity is centralized in the end on the most authoritative source of identity: government. "decentrablazed" is just a window dressing.

I concede that this doesn't explain Mozilla actions very clearly, but they are at this point a mostly irrelevant player in the identity market anyway, nobody except their 3% of marketshare cares what they think. Mozilla just renewed their deal with Google for 400mil, so it could very well be an executive decision that "DID very bad, no matter what", and how their standards architects have to contort themselves into pretzels on mailing lists and invent new catchy acronyms. The mozilla-google contract terms haven't been published even in the roughest approximation, make of that what you will.

Right, it's not a conspiracy. When there are multiple participants in a forum, and one participant has already raised a point that you agree with, saying "I agree with so-and-so's point about..." is the normal way to do things.

What would be a conspiracy - and a genuine problem - is if Mozilla were repeating Google's line because they were there to advocate for Google's beliefs instead of what they thought was best, i.e,. the group was stacked in Google's favor. But the evidence we have doesn't permit us to conclude that this is happening or even likely.

As a simple example, Mozilla and Google tend to reach the same conclusions about whether a new CA should be trusted or an old CA should be distrusted. But this isn't because one is telling the other what to do; it's because they have similar standards and expectations of CAs.

(It would also be weird, and perhaps a conspiracy and a problem, if Google were not a participant in the W3C and Mozilla felt that its role was to represent Google's thoughts instead of its own. But that's not what's happening here, either.)

I'm not going to give bigcorps a pass, but the thing with specs is that it is hard to criticize it until the spec is, you know, published in many cases, especially if you aren't in the committee.

While of course it is just one of many (alongside e.g. “just use a public key”(or hash of one or something. I don’t know the details), and “just use a github username”, when looking at the example resolver, and trying to read the docs, my impression was that a fair proportion of the examples given were blockchain related?

So, that could be part of the reason for the misconception.

I was first introduced to it by the, bold post on the Protocol Labs (the people behind IPFS) blog, about ION as a particular type of DID (sorry, “type of” is probably not quite the right terminology, but I’m not sure what the preferred terminology is) which appears to use the Bitcoin chain (but in a way that involves only very few transactions and very little on-chain data).

Personally I found the FAQ page for DIDs to be a little,

well, it isn’t particularly focused on assisting the reader in evaluating “should I care about this”?

I guess in some ways it seemed a third of the from being a normal FAQ and being a specification, or, not a specification but a, documentation of policy and plans etc.