8 ms·

Decentralized Identifiers – DIDs

126 points by rapnie 8y ago

saurik 8y ago
This is really annoying as the technical term for the identifier of a phone number--one of the most prototypical centralized identifiers--is also a "DID": a Direct Inward Dialing (number, but we don't say "number"). So now "in the future, people won't tell each other their DID to let people call them, they will give them their DID" :/.
- deleted 8y ago
  [deleted]
- dkersten 8y ago
  Does anybody care what the W3C think anymore? I was under the impression that the WHATWG was formed due to the browser developers’ frustrations with the W3C and they now mostly ignore what W3C says or does. So, what are the chances of this actually catching on?
  - zaarn 8y ago
    For pure browser stuff maybe. The W3C still puts out some very very useful resources and standards not directly browser related that are important (such as AP and Micropub)
    - xj9 8y ago
      AP isn't relevant because of W3C, AP is relevant because Mastodon is relatively popular.
      - zaarn 8y ago
        AP was developed in conjuction with Mastodon developers and as part of one of the reference implementations.
  - parvenu74 8y ago
    W3C is the coordination point for WebAssembly: https://www.w3.org/wasm/ https://www.w3.org/wasm/ Personally, I think WebAssembly is going to massively revolutionize app delivery. In ten years we will have all but forgotten about JavaScript, switching instead to client-side apps that run at near binary-native speeds, written in real languages with complete type systems.
    - deleted 8y ago
      [deleted]
    - dkersten 8y ago
      Ah, thanks, I didn’t know that WebAssembly was a W3C drive. Good to know they still have relevance.
- discreditable 8y ago
  Even better, a phone DID is a very centralized identifier, whereas this refers to a decentralized identifier.
- gervase 8y ago
  I don't think this is very well-known, at least among people who haven't worked on telephony implementations (? I have no idea where this is commonly used). Never in my life has someone asked me for my DID instead of my phone number. It's fairly plausible that the people working on this specification were unaware of this pre-existing acronym (which ranked after Defense In Depth, when I searched it), and just said "Oh, we're making Distributed IDentifiers. Let's call them DIDs! That's easy to remember." When used in verbal conversation, is it generally spelled out like CPU (dee eye dee), or said as a word like RAM (did)?
  - iamdave 8y ago
    at the two telecom jobs in my past DID only got called a "DID" when specifically talking about configuring routes for DID or some other associated configuration. Even as telecom engineers unless that was the specific context the nomenclature was to call it a phone number all other times. Across separate companies. And yet ... ...you've got me wanting to pay attention to something; I'm migrating from a public telco/PTSN job to The world of hosted pbx and managed voice in two weeks and I wonder if that linguistic quirk translates between the two types of environment.
edhelas 8y ago
> It is also similar to the relationship of the IETF generic URN specification ([URN]) and a specific URN namespace definition (such as the UUID URN namespace defined in [RFC4122]). The difference is that a DID method specification, in addition to defining a specific DID scheme, must also specify the methods for reading, writing, and revoking DID records on the network for which it is written. So let's stick with UUID for now…
- rapnie 8y ago
  "Horsepower - The term was adopted in the late 18th century by Scottish engineer James Watt to compare the output of steam engines with the power of draft horses." So let's stick with horses for now :) DIDs are different beasts than UUIDs, with different design goals [0]. Is why they need this specification. Whether the specification is any good, is a topic of discussion, of course.. [0] https://w3c-ccg.github.io/did-spec/#design-goals https://w3c-ccg.github.io/did-spec/#design-goals
hobofan 8y ago
While I can see the need for DIDs somewhat, I feel like content-addressing documents fits the decentralization paradigm much better when it comes to a lot of types of data. While it doesn't have all the properties of DIDs, it has the most important ones, and comes with some other nice ones (automatic deduplication).
- rapnie 8y ago
  Interesting. Could you provide some links to relevant reading materials?
  - hobofan 8y ago
    Sadly not that much from the top of my head. I mostly became familiar with it through IPFS[0][1], but the Wikipedia article lists other projects that might have interesting resources[2]. Disclaimer: I'm working on a project[3] to create a content-addressable version of OWL2 (Web Ontology Language), so I'm certainly a bit biased. [0]: https://arxiv.org/abs/1407.3561 https://arxiv.org/abs/1407.3561 [1]: https://medium.com/@ConsenSys/an-introduction-to-ipfs-9bba4860abd0 https://medium.com/@ConsenSys/an-introduction-to-ipfs-9bba48... [2]: https://en.wikipedia.org/wiki/Content-addressable_storage#Open-source_implementations https://en.wikipedia.org/wiki/Content-addressable_storage#Op... [3]: https://github.com/rlay-project/rlay-ontology https://github.com/rlay-project/rlay-ontology
- vertex-four 8y ago
  Unfortunately, much of the information we interact with every day is ever-changing and published by someone specific, which is not a feature provided by content-addressable storage.
  - diggan 8y ago
    Depends on what content-addressable storage you mean specifically. IPFS (disclaimer: I work on IPFS) handles this by using IPNS together with your PeerID. As long as you have the ID of who the "someone specific" is, you can listen for their published changes. The changesets themselves are immutable, but IPNS provides a mutable naming layer on top of that.
rapnie 8y ago
There is an interesting paper on using DID in combination with ActivityPub [0] presented in the 'Rebooting the Web-of-Trust' [1] event in Fall 2017. > ActivityPub implementations at the present moment rely on HTTPS as their transport, which in turn relies on two centralized systems: DNS and SSL certificate authorities. Is there any way to bring self-sovereignty to the federated social web? > Thankfully there is; ActivityPub was written intentionally to be layerable on any protocol that can support HTTP GET and POST verbs. The Decentralized Identifiers specification looks to be a good fit for ActivityPub. [..] > Here we see an example of Alyssa's profile that is entirely free of traditional centralized DNS authorities. We were able to look up Alyssa's object via her DID, but we still have access to all her endpoints, which in this case are pointing to Tor Hidden Services. No central DNS required! [0] https://github.com/WebOfTrustInfo/rebooting-the-web-of-trust-fall2017/blob/master/topics-and-advance-readings/activitypub-decentralized-distributed.md#distributed-identity https://github.com/WebOfTrustInfo/rebooting-the-web-of-trust... [1] http://www.weboftrust.info/ http://www.weboftrust.info/
runeks 8y ago
So... how, exactly, do they propose tying together a human being with a public key, thus creating a DID, without the use of a central registrar? As far as I can see, in the end it just comes down to users trusting the same set of registrars — which we already have in the form of Certificate Authorities.
- rapnie 8y ago
  I am wondering about this too. The spec says: > Because DIDs reside on a distributed ledger, each entity may serve as its own root authority—an architecture referred to as DPKI [0] (decentralized PKI). There is a whole bunch of related docs in the WebOfTrust github repo's, many of which are related to blockchain (which does not have my interest, ATM). The spec continues: > Note that DID methods may also be developed for identifiers registered in federated or centralized identity management systems. For their part, all types of identifier systems may add support for DIDs. This creates an interoperability bridge between the worlds of centralized, federated, and decentralized identifiers. Then later on there is a chapter on DID Resolvers [1] but this does not have much detail. So, I guess, the actual resolving mechanisms are out of scope of the spec. [0] https://github.com/WebOfTrustInfo/rebooting-the-web-of-trust/blob/master/final-documents/dpki.pdf https://github.com/WebOfTrustInfo/rebooting-the-web-of-trust... [1] https://w3c-ccg.github.io/did-spec/#did-resolvers https://w3c-ccg.github.io/did-spec/#did-resolvers
- rschulman 8y ago
  The DID system doesn't use any central registrars. Connecting a key with an entity consists of the entity represented by the DID publishing the key in their DID document. That document is then published on some ledger (can be blockchain but could also be, e.g., IPFS) so that others can discover it.
  - rapnie 8y ago
    Most of the reference I found have some relation to blockchain in it. Do you know of existing work of DID + IPFS?
    - 8y ago
yahyaheee 8y ago
Went down this rabbit hole a couple months back, like blockchain I’m sure there are a couple use cases, but most identify is inherently centralized as it is formed through relationships.
- rapnie 8y ago
  Would be great to hear a bit more about your experiences, or maybe provide some pointers?
- jonnydubowsky 8y ago
  Good point about identity being relationship-based. I've found DID's to be quite effective in providing cryptographically verifiable social proofs that are powered by our relationships. Keybase has an excellent integration of DID's and social proofs. I've verified my Hacker news identity and linked this identity to my Keybase identity, along with my Twitter, FB and github identity. If you know me on one of these platforms, you can cross-reference my identity and see that I've attested to my identity across multiple platforms. When you go to my Keybase profile, you can see I am currently in control of these identities, and I can revoke the keys I've created as provable links between my various profiles. This layering of social proofs is powerful in a variety of ways.
Confiks 8y ago
There was a talk about this on the Decentralized Web Summit. Unfortunately the (livestreaming) version uploaded to Youtube is (still) borked, but they have reuploaded the videos to the IA directly: https://archive.org/details/decentralizedwebsummitmedia-2018-hashlounge/DWeb+Hash+Lounge+080118+06.mov https://archive.org/details/decentralizedwebsummitmedia-2018... (from 12m00s on). Would anyone know how they plan to represent Idemix (or U-Prove) keys and proofs, for example for Hyperledger Indy / Sovrin? There doesn't seem to be anything in the w3id.org JSON-LD schemes, and while wading through the mountains of code of Hyperledger Indy I haven't been able to find any interface to DID documents.
- rschulman 8y ago
  I don't know in particular how they intend to portray Idemix, but both Hyperleger and Sovrin are heavily involved in the development of the spec, so I'm pretty sure they're thinking of it. Generally speaking, keys are embedded in a DID document in a standard text format and proofs are published as a signature using one of the published keys.
- rapnie 8y ago
  Great video! Thx, for sharing.
dc10 8y ago
I get the motivation for this kind of identifier. I have a project in mind that could make use of the DID format. So I was optimistic to see that thought has been put into it. But when I read "if value is an object... if value is a string..." (from the specification of publicKey property), I worry. Did the authors choose JSON to take advantage of loose typing as a "feature"? Is it OK for a specification to require this kind of introspection and conditional logic?

126 points by rapnie 8y ago

This is really annoying as the technical term for the identifier of a phone number--one of the most prototypical centralized identifiers--is also a "DID": a Direct Inward Dialing (number, but we don't say "number"). So now "in the future, people won't tell each other their DID to let people call them, they will give them their DID" :/.

deleted 8y ago
[deleted]
dkersten 8y ago
Does anybody care what the W3C think anymore? I was under the impression that the WHATWG was formed due to the browser developers’ frustrations with the W3C and they now mostly ignore what W3C says or does. So, what are the chances of this actually catching on?
- zaarn 8y ago
  For pure browser stuff maybe. The W3C still puts out some very very useful resources and standards not directly browser related that are important (such as AP and Micropub)
  - xj9 8y ago
    AP isn't relevant because of W3C, AP is relevant because Mastodon is relatively popular.
    - zaarn 8y ago
      AP was developed in conjuction with Mastodon developers and as part of one of the reference implementations.
- parvenu74 8y ago
  W3C is the coordination point for WebAssembly: https://www.w3.org/wasm/ https://www.w3.org/wasm/ Personally, I think WebAssembly is going to massively revolutionize app delivery. In ten years we will have all but forgotten about JavaScript, switching instead to client-side apps that run at near binary-native speeds, written in real languages with complete type systems.
  - deleted 8y ago
    [deleted]
  - dkersten 8y ago
    Ah, thanks, I didn’t know that WebAssembly was a W3C drive. Good to know they still have relevance.
discreditable 8y ago
Even better, a phone DID is a very centralized identifier, whereas this refers to a decentralized identifier.
gervase 8y ago
I don't think this is very well-known, at least among people who haven't worked on telephony implementations (? I have no idea where this is commonly used). Never in my life has someone asked me for my DID instead of my phone number. It's fairly plausible that the people working on this specification were unaware of this pre-existing acronym (which ranked after Defense In Depth, when I searched it), and just said "Oh, we're making Distributed IDentifiers. Let's call them DIDs! That's easy to remember." When used in verbal conversation, is it generally spelled out like CPU (dee eye dee), or said as a word like RAM (did)?
- iamdave 8y ago
  at the two telecom jobs in my past DID only got called a "DID" when specifically talking about configuring routes for DID or some other associated configuration. Even as telecom engineers unless that was the specific context the nomenclature was to call it a phone number all other times. Across separate companies. And yet ... ...you've got me wanting to pay attention to something; I'm migrating from a public telco/PTSN job to The world of hosted pbx and managed voice in two weeks and I wonder if that linguistic quirk translates between the two types of environment.

edhelas 8y ago

> It is also similar to the relationship of the IETF generic URN specification ([URN]) and a specific URN namespace definition (such as the UUID URN namespace defined in [RFC4122]). The difference is that a DID method specification, in addition to defining a specific DID scheme, must also specify the methods for reading, writing, and revoking DID records on the network for which it is written. So let's stick with UUID for now…

rapnie 8y ago
"Horsepower - The term was adopted in the late 18th century by Scottish engineer James Watt to compare the output of steam engines with the power of draft horses." So let's stick with horses for now :) DIDs are different beasts than UUIDs, with different design goals [0]. Is why they need this specification. Whether the specification is any good, is a topic of discussion, of course.. [0] https://w3c-ccg.github.io/did-spec/#design-goals https://w3c-ccg.github.io/did-spec/#design-goals

hobofan 8y ago

While I can see the need for DIDs somewhat, I feel like content-addressing documents fits the decentralization paradigm much better when it comes to a lot of types of data. While it doesn't have all the properties of DIDs, it has the most important ones, and comes with some other nice ones (automatic deduplication).

rapnie 8y ago
Interesting. Could you provide some links to relevant reading materials?
- hobofan 8y ago
  Sadly not that much from the top of my head. I mostly became familiar with it through IPFS[0][1], but the Wikipedia article lists other projects that might have interesting resources[2]. Disclaimer: I'm working on a project[3] to create a content-addressable version of OWL2 (Web Ontology Language), so I'm certainly a bit biased. [0]: https://arxiv.org/abs/1407.3561 https://arxiv.org/abs/1407.3561 [1]: https://medium.com/@ConsenSys/an-introduction-to-ipfs-9bba4860abd0 https://medium.com/@ConsenSys/an-introduction-to-ipfs-9bba48... [2]: https://en.wikipedia.org/wiki/Content-addressable_storage#Open-source_implementations https://en.wikipedia.org/wiki/Content-addressable_storage#Op... [3]: https://github.com/rlay-project/rlay-ontology https://github.com/rlay-project/rlay-ontology
vertex-four 8y ago
Unfortunately, much of the information we interact with every day is ever-changing and published by someone specific, which is not a feature provided by content-addressable storage.
- diggan 8y ago
  Depends on what content-addressable storage you mean specifically. IPFS (disclaimer: I work on IPFS) handles this by using IPNS together with your PeerID. As long as you have the ID of who the "someone specific" is, you can listen for their published changes. The changesets themselves are immutable, but IPNS provides a mutable naming layer on top of that.

rapnie 8y ago

There is an interesting paper on using DID in combination with ActivityPub [0] presented in the 'Rebooting the Web-of-Trust' [1] event in Fall 2017. > ActivityPub implementations at the present moment rely on HTTPS as their transport, which in turn relies on two centralized systems: DNS and SSL certificate authorities. Is there any way to bring self-sovereignty to the federated social web? > Thankfully there is; ActivityPub was written intentionally to be layerable on any protocol that can support HTTP GET and POST verbs. The Decentralized Identifiers specification looks to be a good fit for ActivityPub. [..] > Here we see an example of Alyssa's profile that is entirely free of traditional centralized DNS authorities. We were able to look up Alyssa's object via her DID, but we still have access to all her endpoints, which in this case are pointing to Tor Hidden Services. No central DNS required! [0] https://github.com/WebOfTrustInfo/rebooting-the-web-of-trust-fall2017/blob/master/topics-and-advance-readings/activitypub-decentralized-distributed.md#distributed-identity https://github.com/WebOfTrustInfo/rebooting-the-web-of-trust... [1] http://www.weboftrust.info/ http://www.weboftrust.info/

runeks 8y ago

So... how, exactly, do they propose tying together a human being with a public key, thus creating a DID, without the use of a central registrar? As far as I can see, in the end it just comes down to users trusting the same set of registrars — which we already have in the form of Certificate Authorities.

rapnie 8y ago
I am wondering about this too. The spec says: > Because DIDs reside on a distributed ledger, each entity may serve as its own root authority—an architecture referred to as DPKI [0] (decentralized PKI). There is a whole bunch of related docs in the WebOfTrust github repo's, many of which are related to blockchain (which does not have my interest, ATM). The spec continues: > Note that DID methods may also be developed for identifiers registered in federated or centralized identity management systems. For their part, all types of identifier systems may add support for DIDs. This creates an interoperability bridge between the worlds of centralized, federated, and decentralized identifiers. Then later on there is a chapter on DID Resolvers [1] but this does not have much detail. So, I guess, the actual resolving mechanisms are out of scope of the spec. [0] https://github.com/WebOfTrustInfo/rebooting-the-web-of-trust/blob/master/final-documents/dpki.pdf https://github.com/WebOfTrustInfo/rebooting-the-web-of-trust... [1] https://w3c-ccg.github.io/did-spec/#did-resolvers https://w3c-ccg.github.io/did-spec/#did-resolvers
rschulman 8y ago
The DID system doesn't use any central registrars. Connecting a key with an entity consists of the entity represented by the DID publishing the key in their DID document. That document is then published on some ledger (can be blockchain but could also be, e.g., IPFS) so that others can discover it.
- rapnie 8y ago
  Most of the reference I found have some relation to blockchain in it. Do you know of existing work of DID + IPFS?
  - 8y ago

yahyaheee 8y ago

Went down this rabbit hole a couple months back, like blockchain I’m sure there are a couple use cases, but most identify is inherently centralized as it is formed through relationships.

rapnie 8y ago
Would be great to hear a bit more about your experiences, or maybe provide some pointers?
jonnydubowsky 8y ago
Good point about identity being relationship-based. I've found DID's to be quite effective in providing cryptographically verifiable social proofs that are powered by our relationships. Keybase has an excellent integration of DID's and social proofs. I've verified my Hacker news identity and linked this identity to my Keybase identity, along with my Twitter, FB and github identity. If you know me on one of these platforms, you can cross-reference my identity and see that I've attested to my identity across multiple platforms. When you go to my Keybase profile, you can see I am currently in control of these identities, and I can revoke the keys I've created as provable links between my various profiles. This layering of social proofs is powerful in a variety of ways.

Confiks 8y ago

There was a talk about this on the Decentralized Web Summit. Unfortunately the (livestreaming) version uploaded to Youtube is (still) borked, but they have reuploaded the videos to the IA directly: https://archive.org/details/decentralizedwebsummitmedia-2018-hashlounge/DWeb+Hash+Lounge+080118+06.mov https://archive.org/details/decentralizedwebsummitmedia-2018... (from 12m00s on). Would anyone know how they plan to represent Idemix (or U-Prove) keys and proofs, for example for Hyperledger Indy / Sovrin? There doesn't seem to be anything in the w3id.org JSON-LD schemes, and while wading through the mountains of code of Hyperledger Indy I haven't been able to find any interface to DID documents.

rschulman 8y ago
I don't know in particular how they intend to portray Idemix, but both Hyperleger and Sovrin are heavily involved in the development of the spec, so I'm pretty sure they're thinking of it. Generally speaking, keys are embedded in a DID document in a standard text format and proofs are published as a signature using one of the published keys.
rapnie 8y ago
Great video! Thx, for sharing.

dc10 8y ago

I get the motivation for this kind of identifier. I have a project in mind that could make use of the DID format. So I was optimistic to see that thought has been put into it. But when I read "if value is an object... if value is a string..." (from the specification of publicKey property), I worry. Did the authors choose JSON to take advantage of loose typing as a "feature"? Is it OK for a specification to require this kind of introspection and conditional logic?