4 ms·

Both Google and Mozilla objected to this standard because the "method" is left undefined. W3C overruled them. https://www.theregister.com/2022/07/01/w3c_overrul

by hosh 4y ago

Both Google and Mozilla objected to this standard because the "method" is left undefined. W3C overruled them. https://www.theregister.com/2022/07/01/w3c_overrules_objections/ https://www.theregister.com/2022/07/01/w3c_overrules_objecti...

oofbey 4y ago
The outcomes of decentralization sound good until you realize it means you’re either running your own server, or using a blockchain and need to protect a private key somehow. But normal humans want nothing to do with either of those responsibilities and always rely on a centralized service. If this ID standard included a way to use a centrally-controlled email address (the defacto ID standard today that works just fine for most legal activities) or a social login then maybe some of the bigger players would be onboard and it would take hold. As is it seems like it’s just gonna be another crypto fad.
- cowtools 4y ago
  I don't buy this idea that average people can't manage a keypair. Humans already manage secrets in the form of passwords, it's not that much different. In the worst-case scenario in which users defer to some weak/centralized system, how is that categoricially worse than the centralized systems we already have?
  - ryukafalz 4y ago
    > Humans already manage secrets in the form of passwords, it's not that much different. Humans are bad at this which is why we recommend password managers. That said, I do think keypairs are the way forward, I just also think they need either strong integrated software support in whichever device is being used, or strong external hardware support. (Yubikeys are nice because they kind of extend the “key” metaphor that people are already used to, but I wish they shipped with a paired backup key that was provisioned with the same key material. Maybe colored red to distinguish it.)
    - leaflets2 4y ago
      > but I wish they shipped with a paired backup key that was provisioned with the same key material Two identical keys, is less secure, for those who would otherwise have bought many different keys. If you instead buy two different keys, then, when you lose the first, you can know it's safe to continue using the second one. And you can block the first one, without locking yourself out. Maybe getting two different keys would be a good idea
      - freeone3000 4y ago
        It is! GitHub suggests this, Gmail requires it. Yubikey has a 2-pack discount that's nearly as cheap as a single key.
      - ryukafalz 4y ago
        The trouble with this is that you need the second key present each time you need to enroll it to an account, meaning you can’t stash it in a safe deposit box as a backup. And you have to remember to add it to each and every account or it’s not really functional as a backup. Yes, two different keys are more secure, but they have some pretty severe usability problems.
- mw888 4y ago
  Yes, but the universal ability to create authentic sources of data means people will use what is convenient but always have the option to go to the base layer without permission should they dislike their service.
riedel 4y ago
Funny to see Google and Mozilla siding on ethical issues. It really seems like the W3C has finally lost its compass and now wants to venture into the blockchain. Only positive thing is to see Google loosing once in a standards fight, however, I think it might just have been the wrong anarchist endeavour inside the W3C. In the end we will get more centralisation because looks like nobody except the big ones can push standards on a technical decent level (indirectly pushing their agenda).
- espadrine 4y ago
 > Only positive thing is to see Google loosing once in a standards fight It is far from the first time. For instance, Google was involved in the WHATWG, which developed the HTML standard while the W3C pushed XHTML. The standards war, itself, is only lost when nearly nobody uses the standard, which is what happened to XHTML, which lost to WHATWG’s HTML when browsers simply didn’t use XHTML. It sounds like a lot of cryptocurrency companies wish to prop up this standard, but it is not clear to me that actual people would use it for a non-circular goal.
 - mark_and_sweep 4y ago
 > browsers simply didn’t use XHTML Do you mean "developers didn't use XHTML"? All browsers implement XHTML. It's referred to as "the second concrete syntax for HTML" in the WHATWG spec.[1] Indeed many websites do use XHTML, the HTML application of XML. However, since proper documents render identically, you won't be aware that you're visiting an XHTML site - that is, unless you check the source. Fun history side note: Browsers like Netscape and Internet Explorer didn't agree on how to parse HTML in the past. They handled omitability differently, for example, in overlapping hierarchies (). To fix this mess, Sir Tim asked well-respected SGML practicioners to create a clean subset of SGML and define a document type definition (DTD) for HTML. They came up with XML, the clean subset, and XHTML, the DTD. [2] Basically, XHTML was the first actual standardization of HTML. Unfortunately, minor syntax errors will prevent a XHTML document from rendering, which, to some degree, is probably why it was never widely accepted by developers. [1] https://html.spec.whatwg.org/multipage/introduction.html#html-vs-xhtml https://html.spec.whatwg.org/multipage/introduction.html#htm... [2] https://www.youtube.com/watch?v=Q4dYwEyjZcY https://www.youtube.com/watch?v=Q4dYwEyjZcY

by hosh 4y ago

oofbey 4y ago

The outcomes of decentralization sound good until you realize it means you’re either running your own server, or using a blockchain and need to protect a private key somehow. But normal humans want nothing to do with either of those responsibilities and always rely on a centralized service. If this ID standard included a way to use a centrally-controlled email address (the defacto ID standard today that works just fine for most legal activities) or a social login then maybe some of the bigger players would be onboard and it would take hold. As is it seems like it’s just gonna be another crypto fad.

cowtools 4y ago
I don't buy this idea that average people can't manage a keypair. Humans already manage secrets in the form of passwords, it's not that much different. In the worst-case scenario in which users defer to some weak/centralized system, how is that categoricially worse than the centralized systems we already have?
- ryukafalz 4y ago
  > Humans already manage secrets in the form of passwords, it's not that much different. Humans are bad at this which is why we recommend password managers. That said, I do think keypairs are the way forward, I just also think they need either strong integrated software support in whichever device is being used, or strong external hardware support. (Yubikeys are nice because they kind of extend the “key” metaphor that people are already used to, but I wish they shipped with a paired backup key that was provisioned with the same key material. Maybe colored red to distinguish it.)
  - leaflets2 4y ago
    > but I wish they shipped with a paired backup key that was provisioned with the same key material Two identical keys, is less secure, for those who would otherwise have bought many different keys. If you instead buy two different keys, then, when you lose the first, you can know it's safe to continue using the second one. And you can block the first one, without locking yourself out. Maybe getting two different keys would be a good idea
    - freeone3000 4y ago
      It is! GitHub suggests this, Gmail requires it. Yubikey has a 2-pack discount that's nearly as cheap as a single key.
    - ryukafalz 4y ago
      The trouble with this is that you need the second key present each time you need to enroll it to an account, meaning you can’t stash it in a safe deposit box as a backup. And you have to remember to add it to each and every account or it’s not really functional as a backup. Yes, two different keys are more secure, but they have some pretty severe usability problems.
mw888 4y ago
Yes, but the universal ability to create authentic sources of data means people will use what is convenient but always have the option to go to the base layer without permission should they dislike their service.

riedel 4y ago

Funny to see Google and Mozilla siding on ethical issues. It really seems like the W3C has finally lost its compass and now wants to venture into the blockchain. Only positive thing is to see Google loosing once in a standards fight, however, I think it might just have been the wrong anarchist endeavour inside the W3C. In the end we will get more centralisation because looks like nobody except the big ones can push standards on a technical decent level (indirectly pushing their agenda).

espadrine 4y ago
> Only positive thing is to see Google loosing once in a standards fight It is far from the first time. For instance, Google was involved in the WHATWG, which developed the HTML standard while the W3C pushed XHTML. The standards war, itself, is only lost when nearly nobody uses the standard, which is what happened to XHTML, which lost to WHATWG’s HTML when browsers simply didn’t use XHTML. It sounds like a lot of cryptocurrency companies wish to prop up this standard, but it is not clear to me that actual people would use it for a non-circular goal.
- mark_and_sweep 4y ago
 > browsers simply didn’t use XHTML Do you mean "developers didn't use XHTML"? All browsers implement XHTML. It's referred to as "the second concrete syntax for HTML" in the WHATWG spec.[1] Indeed many websites do use XHTML, the HTML application of XML. However, since proper documents render identically, you won't be aware that you're visiting an XHTML site - that is, unless you check the source. Fun history side note: Browsers like Netscape and Internet Explorer didn't agree on how to parse HTML in the past. They handled omitability differently, for example, in overlapping hierarchies (). To fix this mess, Sir Tim asked well-respected SGML practicioners to create a clean subset of SGML and define a document type definition (DTD) for HTML. They came up with XML, the clean subset, and XHTML, the DTD. [2] Basically, XHTML was the first actual standardization of HTML. Unfortunately, minor syntax errors will prevent a XHTML document from rendering, which, to some degree, is probably why it was never widely accepted by developers. [1] https://html.spec.whatwg.org/multipage/introduction.html#html-vs-xhtml https://html.spec.whatwg.org/multipage/introduction.html#htm... [2] https://www.youtube.com/watch?v=Q4dYwEyjZcY https://www.youtube.com/watch?v=Q4dYwEyjZcY