6 ms·

I was initially pretty hyped when I read the abstract for DIDs, bookmarked the spec and read it later. The "spec" is a bunch of buzzwords and vague generic "con

by cplli 4y ago

I was initially pretty hyped when I read the abstract for DIDs, bookmarked the spec and read it later. The "spec" is a bunch of buzzwords and vague generic "concepts". The DIDs themselves mean basically nothing, it's the "methods" that actually must have their own specification and actually "do something". Another feeling you can quickly get from DIDs is that they're blockchain centric. The entire concept is "jack of all trades, master of none". I actually hope to be wrong, and see some more fully fledged implementations/examples of real world use-cases, because I love the idea of federated/decentralized identity.

deleted 4y ago
[deleted]
jceb81 4y ago
Microsoft has already lined up the tech in their products. So I'm confident that it's just a matter of time before it becomes available in a shop nearby.
- mistrial9 4y ago
  see current python azure-identity==1.7.1 azure-digitaltwins-core==1.1.0 azure-cognitiveservices-vision-face==0.5.0 azure-cognitiveservices-anomalydetector==0.3.0 azure-communication-identity==1.0.1
- cplli 4y ago
  > lined up the tech in their products Link? Or an explanation as to what this means? > before it becomes available in a shop nearby Meaning what exactly? If you're saying Microsoft will implement DIDs, my question is, "Which of the 50+ methods?"
  - jceb81 4y ago
    Here's the link: https://www.microsoft.com/en-us/security/business/solutions/decentralized-identity https://www.microsoft.com/en-us/security/business/solutions/... I haven't used their implementation yet but Microsoft initiated the did:ion method. I guess they'll support it :-D In general, the idea with DID methods is that you can support many methods without too much effort - for example the Universal Resolver implements already a good bunch: https://dev.uniresolver.io/ https://dev.uniresolver.io/ However, pointing in the direction of the many DID method implementations, I agree with you that they're confusing. Many people try their hands on implementing a new method. Most of the methods will not amount to much. I recommend focusing on simple methods like did:key or did:web to get started and high throughput methods like did:ion, did:elem, did:orb (all sidetree based) for production. did:ethr is also a good starting point for a public blockchain DID method that doesn't require a transaction to create the DID, i.e. no expenses required. did:ethr is also one of the oldest methods and can easily be used in existing Self-Sovereign Identity software solutions.
    - cplli 4y ago
      Ok, I'll have to look more in-depth into the Microsoft link, they link to many more pages including a whitepaper. Regarding all the blockchain centric DID methods, would someone wanting to validate a DID (eg: did:thecoin:whatever_would_go_here), need to hold a copy of the blockchain? (in a scenario where one doesn't want to be dependent on a third party for blockchain interactions).
      - miohtama 4y ago
        For most of blockchains you can do light client validation without the full chain (or full node). Light client needs to only know the block headers to validate a truth. You can get block headers with very lightweight download work from peer-to-peer network. https://geth.ethereum.org/docs/interface/les https://geth.ethereum.org/docs/interface/les
      - Kubuxu 4y ago
        Depends on the implementation and the blockchain, but for many cases there are ways to make such resolutions provably correct, such that you don't have to hold the copy of blockchain and you don't have to trust that a third party did the resolution correctly.
    - davidgerard 4y ago
      > https://www.microsoft.com/en-us/security/business/solutions/decentralized-identity https://www.microsoft.com/en-us/security/business/solutions/... So I went and had a look. There's no specification there that I could see - is there a more specific link I missed? The white paper was issued in 2018. Is that what there is? The product is Entra Verified ID - which turns out to be a directory service on Azure. https://docs.microsoft.com/en-us/azure/active-directory/verifiable-credentials/decentralized-identifier-overview https://docs.microsoft.com/en-us/azure/active-directory/veri... This appears for all the world like a centralised product marketing itself as "decentralised".
    - dwaite 4y ago
      DID resolution is a security operation and has to be done by a trusted component. The document you get back does not have any additional integrity protection on it, so a resolver that lies will basically let the malicious party impersonate anyone. The resolution process for DID methods also vary in their processing and storage requirements. Some method implementations may result in gigabytes of local data. For these and other reasons, I don't believe real-world deployments will resolve more methods than they deem necessary. Of course, that would mean that between implementer networks you have far less portability and interoperability for DIDs.
- oofbey 4y ago
  MS has a habit lately of backing lots of standard proposals that fizzle and go nowhere.
- k__ 4y ago
  Microsoft always was big on identity with Active Directory. Obviously, they jump on this as soon as possible to call more shots.
hosh 4y ago
Both Google and Mozilla objected to this standard because the "method" is left undefined. W3C overruled them. https://www.theregister.com/2022/07/01/w3c_overrules_objections/ https://www.theregister.com/2022/07/01/w3c_overrules_objecti...
- oofbey 4y ago
  The outcomes of decentralization sound good until you realize it means you’re either running your own server, or using a blockchain and need to protect a private key somehow. But normal humans want nothing to do with either of those responsibilities and always rely on a centralized service. If this ID standard included a way to use a centrally-controlled email address (the defacto ID standard today that works just fine for most legal activities) or a social login then maybe some of the bigger players would be onboard and it would take hold. As is it seems like it’s just gonna be another crypto fad.
  - cowtools 4y ago
    I don't buy this idea that average people can't manage a keypair. Humans already manage secrets in the form of passwords, it's not that much different. In the worst-case scenario in which users defer to some weak/centralized system, how is that categoricially worse than the centralized systems we already have?
    - ryukafalz 4y ago
      > Humans already manage secrets in the form of passwords, it's not that much different. Humans are bad at this which is why we recommend password managers. That said, I do think keypairs are the way forward, I just also think they need either strong integrated software support in whichever device is being used, or strong external hardware support. (Yubikeys are nice because they kind of extend the “key” metaphor that people are already used to, but I wish they shipped with a paired backup key that was provisioned with the same key material. Maybe colored red to distinguish it.)
      - 4y ago
isitmadeofglass 4y ago
> The entire concept is "jack of all trades, master of none" is The quote is “a jack of all trades is a master of none, but oftentimes better than a master of one.”
- teddyh 4y ago
  No it isn’t. Wikipedia says “there are no known instances of this second line dated to before the twenty-first century”: https://en.wikipedia.org/w/index.php?title=Jack_of_all_trades,_master_of_none&oldid=1098920638#%E2%80%9CFull_quotation%E2%80%9D https://en.wikipedia.org/w/index.php?title=Jack_of_all_trade...
liminal18 4y ago
Here is a spec for the `did:key` method: https://w3c-ccg.github.io/did-method-key/ https://w3c-ccg.github.io/did-method-key/
- irq-1 4y ago
  Thank you. Skimming this was much more informative.
k__ 4y ago
The standard has grown out of the blockchain space, because they finally offered a way to do decentralized PKI. Most methods are based on blockchain networks. But there are some that work without blockchains. Like IOTA, IPFS, p2p, web, etc.
- oofbey 4y ago
  IPFS still looking for something useful it can do.
  - ithkuil 4y ago
    Location independent stable identifiers for immutable docker images that allow you to cache them wherever you want (including in airgapped envs) and still don't require users to patch your image names with kustomize/helm/whatever
  - cowtools 4y ago
    I think the idea is that it (or some future incarnation of it) eventually replaces most static web hosting, FTP, Bittorrent, and quite a bit of dynamic web hosting. Oh, and maybe messaging stuff like IRC. Sounds like a big piece to chew, but I think the main hurdle is replacing HTTP(S) on the client side.
- duskwuff 4y ago
  I mean, let's be real here. IOTA is a blockchain in all but name, IPFS is substantially blockchain-adjacent, "p2p" is vague to the point of meaninglessness (and isn't actually a registered method), and "web" is silly (a web site is already identified perfectly well by its URL).
  - cowtools 4y ago
    I would classify BitTorrent, GNUtella and other filesharing networks as p2p
    - duskwuff 4y ago
mw888 4y ago
You must not be familiar with PKI or the meaning of decentralized if the reliance on blockchain networks is a surprise to you.

by cplli 4y ago

deleted 4y ago

[deleted]

jceb81 4y ago

Microsoft has already lined up the tech in their products. So I'm confident that it's just a matter of time before it becomes available in a shop nearby.

mistrial9 4y ago
see current python azure-identity==1.7.1 azure-digitaltwins-core==1.1.0 azure-cognitiveservices-vision-face==0.5.0 azure-cognitiveservices-anomalydetector==0.3.0 azure-communication-identity==1.0.1
cplli 4y ago
> lined up the tech in their products Link? Or an explanation as to what this means? > before it becomes available in a shop nearby Meaning what exactly? If you're saying Microsoft will implement DIDs, my question is, "Which of the 50+ methods?"
- jceb81 4y ago
  Here's the link: https://www.microsoft.com/en-us/security/business/solutions/decentralized-identity https://www.microsoft.com/en-us/security/business/solutions/... I haven't used their implementation yet but Microsoft initiated the did:ion method. I guess they'll support it :-D In general, the idea with DID methods is that you can support many methods without too much effort - for example the Universal Resolver implements already a good bunch: https://dev.uniresolver.io/ https://dev.uniresolver.io/ However, pointing in the direction of the many DID method implementations, I agree with you that they're confusing. Many people try their hands on implementing a new method. Most of the methods will not amount to much. I recommend focusing on simple methods like did:key or did:web to get started and high throughput methods like did:ion, did:elem, did:orb (all sidetree based) for production. did:ethr is also a good starting point for a public blockchain DID method that doesn't require a transaction to create the DID, i.e. no expenses required. did:ethr is also one of the oldest methods and can easily be used in existing Self-Sovereign Identity software solutions.
  - cplli 4y ago
    Ok, I'll have to look more in-depth into the Microsoft link, they link to many more pages including a whitepaper. Regarding all the blockchain centric DID methods, would someone wanting to validate a DID (eg: did:thecoin:whatever_would_go_here), need to hold a copy of the blockchain? (in a scenario where one doesn't want to be dependent on a third party for blockchain interactions).
    - miohtama 4y ago
      For most of blockchains you can do light client validation without the full chain (or full node). Light client needs to only know the block headers to validate a truth. You can get block headers with very lightweight download work from peer-to-peer network. https://geth.ethereum.org/docs/interface/les https://geth.ethereum.org/docs/interface/les
    - Kubuxu 4y ago
      Depends on the implementation and the blockchain, but for many cases there are ways to make such resolutions provably correct, such that you don't have to hold the copy of blockchain and you don't have to trust that a third party did the resolution correctly.
  - davidgerard 4y ago
    > https://www.microsoft.com/en-us/security/business/solutions/decentralized-identity https://www.microsoft.com/en-us/security/business/solutions/... So I went and had a look. There's no specification there that I could see - is there a more specific link I missed? The white paper was issued in 2018. Is that what there is? The product is Entra Verified ID - which turns out to be a directory service on Azure. https://docs.microsoft.com/en-us/azure/active-directory/verifiable-credentials/decentralized-identifier-overview https://docs.microsoft.com/en-us/azure/active-directory/veri... This appears for all the world like a centralised product marketing itself as "decentralised".
  - dwaite 4y ago
    DID resolution is a security operation and has to be done by a trusted component. The document you get back does not have any additional integrity protection on it, so a resolver that lies will basically let the malicious party impersonate anyone. The resolution process for DID methods also vary in their processing and storage requirements. Some method implementations may result in gigabytes of local data. For these and other reasons, I don't believe real-world deployments will resolve more methods than they deem necessary. Of course, that would mean that between implementer networks you have far less portability and interoperability for DIDs.
oofbey 4y ago
MS has a habit lately of backing lots of standard proposals that fizzle and go nowhere.
k__ 4y ago
Microsoft always was big on identity with Active Directory. Obviously, they jump on this as soon as possible to call more shots.

hosh 4y ago

Both Google and Mozilla objected to this standard because the "method" is left undefined. W3C overruled them. https://www.theregister.com/2022/07/01/w3c_overrules_objections/ https://www.theregister.com/2022/07/01/w3c_overrules_objecti...

oofbey 4y ago
The outcomes of decentralization sound good until you realize it means you’re either running your own server, or using a blockchain and need to protect a private key somehow. But normal humans want nothing to do with either of those responsibilities and always rely on a centralized service. If this ID standard included a way to use a centrally-controlled email address (the defacto ID standard today that works just fine for most legal activities) or a social login then maybe some of the bigger players would be onboard and it would take hold. As is it seems like it’s just gonna be another crypto fad.
- cowtools 4y ago
  I don't buy this idea that average people can't manage a keypair. Humans already manage secrets in the form of passwords, it's not that much different. In the worst-case scenario in which users defer to some weak/centralized system, how is that categoricially worse than the centralized systems we already have?
  - ryukafalz 4y ago
    > Humans already manage secrets in the form of passwords, it's not that much different. Humans are bad at this which is why we recommend password managers. That said, I do think keypairs are the way forward, I just also think they need either strong integrated software support in whichever device is being used, or strong external hardware support. (Yubikeys are nice because they kind of extend the “key” metaphor that people are already used to, but I wish they shipped with a paired backup key that was provisioned with the same key material. Maybe colored red to distinguish it.)
    - 4y ago

isitmadeofglass 4y ago

> The entire concept is "jack of all trades, master of none" is The quote is “a jack of all trades is a master of none, but oftentimes better than a master of one.”

teddyh 4y ago
No it isn’t. Wikipedia says “there are no known instances of this second line dated to before the twenty-first century”: https://en.wikipedia.org/w/index.php?title=Jack_of_all_trades,_master_of_none&oldid=1098920638#%E2%80%9CFull_quotation%E2%80%9D https://en.wikipedia.org/w/index.php?title=Jack_of_all_trade...

liminal18 4y ago

Here is a spec for the `did:key` method: https://w3c-ccg.github.io/did-method-key/ https://w3c-ccg.github.io/did-method-key/

irq-1 4y ago
Thank you. Skimming this was much more informative.

k__ 4y ago

The standard has grown out of the blockchain space, because they finally offered a way to do decentralized PKI. Most methods are based on blockchain networks. But there are some that work without blockchains. Like IOTA, IPFS, p2p, web, etc.

oofbey 4y ago
IPFS still looking for something useful it can do.
- ithkuil 4y ago
  Location independent stable identifiers for immutable docker images that allow you to cache them wherever you want (including in airgapped envs) and still don't require users to patch your image names with kustomize/helm/whatever
- cowtools 4y ago
  I think the idea is that it (or some future incarnation of it) eventually replaces most static web hosting, FTP, Bittorrent, and quite a bit of dynamic web hosting. Oh, and maybe messaging stuff like IRC. Sounds like a big piece to chew, but I think the main hurdle is replacing HTTP(S) on the client side.
duskwuff 4y ago
I mean, let's be real here. IOTA is a blockchain in all but name, IPFS is substantially blockchain-adjacent, "p2p" is vague to the point of meaninglessness (and isn't actually a registered method), and "web" is silly (a web site is already identified perfectly well by its URL).
- cowtools 4y ago
  I would classify BitTorrent, GNUtella and other filesharing networks as p2p
  - duskwuff 4y ago

mw888 4y ago

You must not be familiar with PKI or the meaning of decentralized if the reliance on blockchain networks is a surprise to you.