Hacker News Reader

Comment by m33k44 | Hacker News Reader

This relies on public-key cryptography? If that is the case, then who is responsible for maintaining the private key? If that responsibility is with the user, then what happens if the user loses the private key? Does the user loses the identity as well? Is there a way to recover that?

View on HN

There'll surely be custodial services if this takes off.

It depends on the DID method that you're using. The DID method is kind of the identity management system for Decentralized Identifiers. Many DID methods are based on blockchains and with that there are usually no recovery mechanisms for DIDs in place - if you lose your private key the identifier can't be updated and you can't prove ownership over the identifier anymore which in turn renders associated credentials (see Verifiable Credentials https://w3c.github.io/vc-data-model/) unusable.

Custodial services are a good way out. Another option with DIDs is that you can add more than one key to DID. This way you can have one key that is stored away somewhere safe and is only used for recovery purposes.

This reminds me of web service/UDDI registries, that were supposed to come, and all the WS buzz in early 2000s. Some of them came indeed only to be shut down in a few years.

That's exactly the same comparison I've been making regards the W3C VC and DID specifications - we're basically repeating the bad parts of the WS specifications.

Somebody up above mentioned the land grab smell of the DID spec.

So what's different this time? gRPC, protobuf and GraphQL are out there vs. SOAP or CORBA? Some new thing about to rev up? Just plain old loss aversion?

Lambda? We need a FrontPage or Macromedia ColdFusion for that...

I guess that's it, somebody else from the Roblox generation can pick that up.

The difference this time is that there are quite a number of blockchains who are very non-transparently attempting to become rent seekers.

There's a chance for someone to earn $x per ID card or verifiable credential issued; you're essentially becoming a TLD operator only with something 95% of the population of developed countries will use.

Okay, it is not truly decentralised then.

web3auth offers such a service.

There are already some really simple solutions: for example https://keri.one specifies one of the most obvious solutions to the problem. Then proceeds to wrap it up in a lot of web3-inspired gobbledygook.

Have you ever used 2FA systems where you can create various printed "back-up keys". Take that idea then run with it a little and you have KERI.

We're already in use of dIDs on the chia blockchain, and it can be used to verify who issued an NFT to prevent fraud. People have already built games on this and used it to save character profiles (dIDs). Custody solutions are what save you, you can see Bram Cohen talk about it here https://odysee.com/@Chia:d/off-the-chain-Bram-Cohen-2022:5

Reply on news.ycombinator.com