Add privacy consideration on profiling of requestors #157
Conversation
wip-abramson
requested review from
peacekeeper,
dmitrizagidulin,
mccown,
ChristopherA and
danpape
as code owners
|
This was discussed during the #did meeting on 12 June 2025. View the transcriptw3c/did-resolution#157Wip: majority of PRs are ready to be merged so everyone should take a close look at them. Wip: DiD resolvers should be aware of requesters - questions? <ottomorac> Looks good |
Co-authored-by: Ted Thibodeau Jr <[email protected]>
|
This is a good description of the "phone home" privacy problem's impact on DID Method resolution. Traditionally, DID Methods have been "at" a specific location (e.g., secure database, ledger, etc.) and will therefore be susceptible to logging correlation. During resolution, the DID resolver will return an address/location for the DID Method, which causes this situation. However, DID Methods for other types of more decentralized architectures, such as did:webvh or did:webs / KERI can be created in ways that don't have a protocol-wide central DID Method location. For these architectures, there can be a DID Method hosted in a large number of locations, which means that any logging by the DID Method would be limited to the specific DIDs hosted at that location. Of course, DID Method hosting locations can correlate their logs, but they should be discouraged from doing so. The net effect of this is that different DID Methods have different privacy risks & mitigations. I would be happy to write up some text that could be added to the above submitted privacy warning. However, it would need to cite did:webvh and did:webs (KERI) as architectural examples. Would it be helpful if I submitted this new text? |
|
This was discussed during the #did meeting on 17 July 2025. View the transcriptw3c/did-resolution#157Wip: This one has been open for a month... smccown: Depending on how DID methods are implemented they can be somewhat centralized... I was talking to Stephen Curran that may not always be the case with did:webvh... You can still host your did-docs in a variety of locations... This also applies to did:keri because of the way they structured the infra.... This could be interesting to discuss and analyze.... Wip: Yes I think you are then agreeing with the PR and we could discuss this other item in a separate issue... <bengo> +1 to merge |
|
Merging after some discussion and approvals. |
This PR addresses #95
Preview | Diff