Enhancement: Decentralized Identifiers (DIDs) for true self-sovereign identity

[michaelstingl]

Background

Tribelike currently uses email-based authentication with WebAuthn. While this works, it still ties user identity to email addresses. Decentralized Identifiers (DIDs) could provide true self-sovereign identity that works across platforms.

How This Idea Came About

While documenting the authentication architecture, I noticed an interesting contradiction: Tribelike is fully P2P with no central authority, yet users still identify themselves with email addresses - which depend on centralized email providers. This feels like the last piece of centralization in an otherwise decentralized system. DIDs are the W3C standard for decentralized identity and would allow users to truly own their identity without depending on any external service.

Proposal

Implement DID-based authentication as an alternative to email-based login, allowing users to own their identity independently of any email provider or platform.

Implementation Approach

1. DID Methods

   • Support did:key for simplicity
   • Consider did:web for discoverability
   • Future: did:ion for permanence

2. Authentication Flow

   // Generate DID from keypair
   const did = await generateDID(publicKey)
   
   // Store in Gun with proof
   gun.get('identities').get(did).put({
     publicKey,
     proof: signature,
     profile: gun.get(`profile/${did}`)
   })

3. Migration Path

   • Keep email auth as option
   • Link DIDs to existing accounts
   • Gradual transition

Benefits

• True ownership of identity
• Cross-platform identity portability
• No dependency on email providers
• Enhanced privacy
• Interoperability with other DID systems

Integration Points

• Verifiable Credentials for profiles
• Cross-platform reputation
• Decentralized social graph
• Identity recovery mechanisms

Considerations

• Key management UX
• Recovery mechanisms
• DID resolution methods
• Backwards compatibility

Resources

• W3C DID Specification
• DID Method Registry
• Verifiable Credentials
• DIF Identity Libraries

[addiinnocent]

We are not using email based authentication currently with WebAuthn. While the email login is still somehow in the code and would likely be re-implemented at a later point, email addresses are currently only placeholders and could be replaced with unique usernames or DID.

[felixboehm]

Email as a technical protocol is decentralized. It would be possible to build a decentralized mail network on toplocs peers.

For me the question is: Could we make use of emails for communication?

Privacy: Emails should not be readable for other users or plugins.
The core / peers could offer a functionality to send email to a user for notifications.

---

DID: great. Could we implement DIDs anyway?

[felixboehm]

@michaelstingl do you have an idea how we could implement smtp / mail on peers to have "decentralised mail" ?
What exactly is matrix.org doing? It seems they have something like that...
What parts of the API that Matrix defines would make sense to look at / implement? "Matrix defines a set of open APIs for decentralised communication".