Hacker News new | ask | show | jobs
by jazzyjackson 586 days ago
Hey pfraze, forgive my ignorance but what role does DID serve that DNS doesn't? My favorite part about bsky is using TXT record to prove that I control my domain for username purposes, what's the downside to just generating a keypair, and using the fingerprint of the public key as my identity? (Maybe with some affordance for key rotation vis a vis KERI*) Not doubting youall weighed every possibility, just wondering what I'm missing

*Key Event Receipt Infrastructure
1 comments
steveklabnik 586 days ago
Not Paul, but DID is a stable ID over time, whereas dns is not. This lets you change your handle without the network losing track of who you are. I was @steveklabnik.bsky.social before I was @steveklabnik.com, and when I made the switch, all of my previous stuff was still there.

This is a fun party trick in some sense, but also a real meaningful feature in another. If I ever decide to move from steveklabnik.com to steve.klabnik.com, a thing I have been considering for a few years, my stuff on @proto/Bluesky will be one of the only services that doesn't have the issue that's kept me from pulling the trigger: updating the entire world that that's where I am now.

link
kiitos 586 days ago
DIDs are stable only in the context of a specific 'verifiable data registry' as the spec puts it.

https://www.w3.org/TR/did-core/#dfn-verifiable-data-registry

DIDs delegate trust and authority to a data registry, in exactly the same way that DNS delegates trust and authority to ~ICANN.

The system model is exactly the same. The difference is only in the properties of the authoritative entity.

link
steveklabnik 586 days ago
That's a good point: I was speaking in a more social manner. Because domains are human-readable, they tend to be used for humans. Bluesky could have chosen to just use domains, but I personally prefer that we have the additional layer of indirection. Plus like, you have the ability (at the low level, not really exposed in the UI in any meaningful way) to be multiple people: I can associate multiple domains with my DID.

That said, you're not wrong that a registry is a registry.

link
kiitos 586 days ago
Yeah, definitely not suggesting domains are a better form of identity!
link
pfraze 586 days ago
Yes! And if this were not the case then account portability between PDS hosts would be really challenging. Same logic as keeping your phone number when you switch cell carriers
link