Decentralized advocacy
How serious are we about AT Protocol / DID ?
How this thought experiment started
OR
What would be a good place to start?
I let certain circles of people influence me. They are people who care about privacy, autonomy, and not being tracked by giant corporations. So what do i use that they use? The most obvious daily driver was kagi.com. (This is not an ad, but I do use and pay for it). Well Kagi clearly supports 4 types of accounts, and offers a "Create Account" option. But let's analyze this a bit
Well it seems like "Create Account" is the opportunity? Let's dive into that a bit more. When an account is created with Kagi, they are most likely doing the same thing that most companies do and that's setup their own database of Account Information. It's no shock that companies invest time and effort into this, but these days they REALLY don't want to. This is why the Big Three of identity are listed in that primary position.
Companies like Kagi have to make choices about investing in features, and CIAM (Customer Identity Access Management) is kind of a pain. GDPR and CCPA/CPRA (there are more, but most Identity professionals are familiar with these two.) are laws that try to help people with Privacy and Portability. To OVER simplify it, there are laws built around 4 rights:
Right to Erasure — Request deletion of your personal data.
Right to Rectification — Correct incomplete or inaccurate data.
Right to Portability — Move your data between service providers.
Right to be Informed — Know how your data is collected and used.
This is where DIDs (Decentralized identifiers), something Bluesky PBC helps subtly helps, play a role. But it's kinda important to call out the difference in what Bluesky PBC is promoting rather than: Logon with AppleID, Google Account, Microsoft Account, GitHub Account
When you create a "Bluesky" account, on the backend you create a DID:PLC. (I'm intentionally steering away from my desire to dive deep into more technical explanation and terms, but not everything has to be sandblasted by marketing). It was built with the intention of the Account Holder OWNING it, and more than "I know the password" When you deactivate or delete the account; YOU, the account holder, control that in a way that hasn't existed at this kind of scale before. This has not and will probably never be true of Apple, Google, Microsoft, Meta, Twitter, TikTok, Amazon, Netflix, etc. That's too much control to let go. Currently there are ways for you to control every aspect, it's obscure and ux painful, but it exists.
The Point
It would be ideal if @kagi.com listed 🦋 as one of the 4 primary Icons, but we need to build up to that. So we tackle the "Create Account". Question is, what is Kagi using for CIAM? Well Kagi is a user AND contributor to open source, so maybe GitHub can help us make some educated guesses. There is a fork of Stalwart. What's important to note about that project is it has all the necessary, scalable, components needed for identity management. Pointing to External directories, Apple/Google/Microsoft, but also supports having it's own Internal Directory. Seems like a great way for Kagi to tackle the Account Problem. So back to what I said earlier about DID:PLC, almost all bluesky accounts are made in that directory. Even more interesting is Stalwart Labs just released External OIDC support. So what that means is an Open Source Project like Stalwart needs PRs to support PLC.directory.
Look I really tried not to go too deep, but if you've hung in this long it's time for the payoff / call to action.
As always, I want a start of a conversation. I welcome your editorial comments and discussion.