Thread by @iang_fc

@Steve_Lockstep @joerosato @csuwildcat sorry, it’s 50 mins long, I don’t watch much video, so speaking from generalisms and hints:

As a term, PKI suffers the same problem as ‘identity’ - it means different things to different people. Consequently, as a sector, it’s totally unreliable as a term. It can mean...

@Steve_Lockstep @joerosato @csuwildcat Use of Public Key cryptography in a technical system - that’s the PK part dominating. OR

Infrastructure around PKs to make the PK do or mean something. OR

Identity system based on PKI, implying use of private key is proof of person. Or...

@Steve_Lockstep @joerosato @csuwildcat X.509-based PKI which locks in a particular technology *and* a set of meanings/doings which don’t work *and* a set of companies that extract rents for little benefit, which extraction works a treat.

So, 1st order question is, what is this person meaning when using the term PKI?

@Steve_Lockstep @joerosato @csuwildcat Without understanding that, it’s unlikely you’ll make much headway because everyone will be talking at cross-purposes.

But even then when you’ve established what the term means in this context, you have to also deal with an insidious problem:

2nd order question:...

@Steve_Lockstep @joerosato @csuwildcat What is the chance that some other meaning of PKI will be imposed over you later on? By some other group that believes in their PKI?

This occurs typically with X.509, which has been pushed by a particular sector as the one and only PKI.

@Steve_Lockstep @joerosato @csuwildcat It comes in after the agreement phase, when you get to building and standards. Most of the tech out there, and all of the standards assume X.509-based CA style activity. So your techies, your suppliers, your browser manufacturers are already aligned with this way, and...

@Steve_Lockstep @joerosato @csuwildcat death by a thousand cuts to whosoever tries to bypass this.

This would be ok if it worked. But it doesn’t work. It only succeeds more or less in its very narrow claimed case. Anything else, it’s just not up to the job.

So let me ask - what did they mean by PKI?

@Steve_Lockstep @joerosato @csuwildcat Coming back to Microsoft - they’re generally ahead of the curve when it comes to Identity - see the 2000s and Stefan Brands, Kim Cameron’s 7 “laws” of identity.

But they’ve never been able to make it work, and the primary reasons is the normal one...

@Steve_Lockstep @joerosato @csuwildcat Identity is a human thing, and PKIs in all their forms are built by technologists, so they are tech-problem forcused. Doesn’t work.

Hence DIDs are basically an expression of Private/public key identifiers for people. Former part is “more important” than the latter.

@Steve_Lockstep @joerosato @csuwildcat Eg, self-sovereign is a reaction to privacy problems of big data. “I know, I’ll make everyone own their data! They will be sovereign.”

Also doesn’t work. None of these programmes will go anywhere until the techies stop being techies and start focussing on society and humans.