W3C home > Mailing lists > Public > public-credentials@w3.org > October 2014

Re: Credentials specifications page created

From: Anders Rundgren <anders.rundgren.net@gmail.com>
Date: Sat, 04 Oct 2014 10:49:26 +0200
Message-ID: <542FB496.4040401@gmail.com>
To: Manu Sporny <msporny@digitalbazaar.com>, Credentials Community Group <public-credentials@w3.org>
On 2014-10-03 23:29, Manu Sporny wrote:
> We finally got around to porting the history[1] over for the Identity
> Credentials specification today, so the opencreds.org website finally
> has a specifications page:
> http://opencreds.org/specs/

If I got it correctly, Identity Credentials' WAYF (Where Are You From) mechanism
is based on a distributed system (TeleHash) which I haven't seen anywhere else
in the identity space, have you?

I must confess that I have big difficulties understanding the full set of
pros and cons of using TeleHash as a foundation.

IMO it is a pity that Mozilla et. al. clings on to software and architectures
that are almost 20 years old (NSS), since an obvious (=simple) solution would
be keeping WAYF-information inside of a locally provisioned and accessed token
like already was the case with Microsoft's brilliant [but unfortunately failed]
Information Card scheme.  Microsoft essentially have the same problem as Mozilla,
a severely dated platform with respect to token handling which made Information Cards
an "alien bird" instead of an integral part of the credentialing system.
Information Cards had no private keys...Oops

Yes, I know we can't change browsers but I'm not convinced that putting a lot of
effort on workarounds is the right approach either, at least not in standards context.

The real problem is rather that a lot of IC-like schemes [probably] need the same thing but for
historic reasons, slightly overblown egos and a general lack of foresight, the critical mass
for a unified solution seems to be outside of what can be achieved through a standards process
unless we are talking about standardization of something which is already firmly established
like it was for XHR.

Anyway, I'm fairly convinced that the Information Card principle eventually will be resurrected
(in some way...) because it is simple and extensible[*], it only needs a [much] better platform!


*] This is a problematic point because there is no established/accepted model for
"trusted web applications" except for features like geo-location which IMO is something
entirely different than for example payment credentials which I think the WebCrypto.Next
folks will soon find out :-)

> -- manu
> [1]
> https://github.com/opencreds/website/commits/master/specs/source/identity-credentials/index.html
Received on Saturday, 4 October 2014 08:49:56 UTC

This archive was generated by hypermail 2.4.0 : Thursday, 24 March 2022 20:24:38 UTC