w3c-cg/udna

WebID - W3C Wiki

The W3C is still exploring better ways to do authentication, for example in the 2014 workshop on authentication. The WebID is a Community Group, and anyone can start a Community Group. A Community Group does not necessarily reflect the endorsement of the W3C, but we encourage grassroots communities to experiment with technology that may become a future standard.

From ZK-first to AT Protocol — our path to DDS | Agora Citizen Network

We've been building Agora — a platform for public deliberation using Polis-style clustering — for a while now. Along the way, we've written about what we think about Nostr, AT Protocol, Polis, Community Notes, and protocol interoperability. Those posts are somewhat outdated now. This one describes w...

w3c/webextensions

Charter and administrivia for the WebExtensions Community Group (WECG)

High Assurance DIDs with DNS

This document outlines a method for improving the authenticity, discoverability, and portability of Decentralized Identifiers (DIDs) by utilizing the current DNS infrastructure and its technologies. This method offers a straightforward procedure for a verifier to cryptographically cross-validate a DID using data stored in the DNS, separate from the DID document.

Exploring Identities in the AT Protocol via Bluesky

The AT Protocol is an open, decentralized network for building social applications. Bluesky, a relatively new social network, is built on top of the AT Protocol. It recently piqued my interest as I came across this fascinating research paper Bluesky and the AT Protocol: Usable Decentralized Social Media. In this post, we’ll dive into one of the key elements of the AT Protocol: identities. We will start with Bluesky user handles, explore additional information about them, and see what else we can discover. DID Resolution A handle in Bluesky is associated with a DID, which can be resolved using DNS or HTTPS. decentralized identifier (DID) A globally unique persistent identifier that does not require a centralized registration authority and is often generated and/or registered cryptographically. […] Many—but not all—DID methods make use of distributed ledger technology (DLT) or some other form of decentralized network. From Decentralized Identifiers (DIDs) v1.0 The DID for @jay.bsky.team can be resolved via a DNS record. Example with dig: > dig _atproto.jay.bsky.team TXT [...] _atproto.jay.bsky.team. 14400 IN TXT "did=did:plc:oky5czdrnfjpqslsw2a5iclo" If you don’t have dig installed, try an online tool like nslookup.io. If no DNS TXT entry exists, the handle may resolve to a DID through a well-known HTTPS endpoint. Let’s take the example of @jamesgunn.bsky.social: > curl https://jamesgunn.bsky.social/.well-known/atproto-did did:plc:lotavzt36yanhfy3j3gpysyj If you don’t have curl installed, you can just open the link in your browser https://jamesgunn.bsky.social/.well-known/atproto-did. PLC Once you have a DID, examine the part after the first colon. This is known as the method. The above two examples use plc, which stands for Public Ledger of Credentials. These PLC DIDs can be looked up in the PLC directory at plc.directory. The AT Protocol also supports the web method, though we focus on plc here. We can use curl again to get more information about a DID. Let’s take @jay.bsky.team’s DID as example. > curl https://plc.directory/did:plc:oky5czdrnfjpqslsw2a5iclo/log | jq [ { "sig": "KuN3A61golVNSDU71wZKLP9lVuXk6YekJAz1lwDzrPsNTEWHBBW_8zSyV6pDxV4KiYXuAXlS1Ik47XkjQZ94mA", "prev": null, "type": "create", "handle": "jay.bsky.social", "service": "https://bsky.social", "signingKey": "did:key:zQ3shP5TBe1sQfSttXty15FAEHV1DZgcxRZNxvEWnPfLFwLxJ", "recoveryKey": "did:key:zQ3shhCGUqDKjStzuDxPkTxN6ujddP4RkEKJJouJGRRkaLGbg" }, { "sig": "TY3ot8yFF-0LL8ceoRwSGaNQj0F1aj-IApYXRGT21G1fnznKHUHT1QE7c1aTrYd9PQLVvXUGag6CZ9EEeIKqgA", "prev": "bafyreidswhiwi4ljkl4es4vwqhkas3spmmktortqbp6lkrb5v7qqdfr3mm", "type": "plc_operation", "services": { "atproto_pds": { "type": "AtprotoPersonalDataServer", "endpoint": "https://bsky.social" } }, "alsoKnownAs": [ "at://jay.bsky.social" ], "rotationKeys": [ "did:key:zQ3shhCGUqDKjStzuDxPkTxN6ujddP4RkEKJJouJGRRkaLGbg", "did:key:zQ3shpKnbdPx3g3CmPf5cRVTPe1HtSwVn5ish3wSnDPQCbLJK" ], "verificationMethods": { "atproto": "did:key:zQ3shXjHeiBuRCKmM36cuYnm7YEMzhGnCmCyW92sRJ9pribSF" } }, { "sig": "WmQmobHA6abtu8xIkBSrDkkoMNjOxP1Tl_1zl1DbIZlA9kjOyxjX-J1rzwWVy3stdzMowpBeBnedkAug84n_RQ", "prev": "bafyreicgb25yf5fro22oyhtkbgerzr4nume4sx757r525skxdzpeoeseha", "type": "plc_operation", "services": { "atproto_pds": { "type": "AtprotoPersonalDataServer", "endpoint": "https://bsky.social" } }, "alsoKnownAs": [ "at://jay.bsky.team" ], "rotationKeys": [ "did:key:zQ3shhCGUqDKjStzuDxPkTxN6ujddP4RkEKJJouJGRRkaLGbg", "did:key:zQ3shpKnbdPx3g3CmPf5cRVTPe1HtSwVn5ish3wSnDPQCbLJK" ], "verificationMethods": { "atproto": "did:key:zQ3shXjHeiBuRCKmM36cuYnm7YEMzhGnCmCyW92sRJ9pribSF" } }, { "sig": "dhstt4uPua8OVs8TVzHTqtCnNMsBDN7kjxIBmTIYBDRkknrtprBJ_AISXFoBZyqfoxq2altp-vlRAPEKSh5zeg", "prev": "bafyreihmf7dapx27fexc7jwj4cdpbxcmhnnwo3x5vrpvbr6lclzj7gpsmi", "type": "plc_operation", "services": { "atproto_pds": { "type": "AtprotoPersonalDataServer", "endpoint": "https://morel.us-east.host.bsky.network" } }, "alsoKnownAs": [ "at://jay.bsky.team" ], "rotationKeys": [ "did:key:zQ3shhCGUqDKjStzuDxPkTxN6ujddP4RkEKJJouJGRRkaLGbg", "did:key:zQ3shpKnbdPx3g3CmPf5cRVTPe1HtSwVn5ish3wSnDPQCbLJK" ], "verificationMethods": { "atproto": "did:key:zQ3shtJpFGgEG3tv3ERKvjo7VHbjDPVyvjYvW7gpie49rtNtc" } } ] Again, feel free to click on it instead, https://plc.directory/did:plc:oky5czdrnfjpqslsw2a5iclo/log. This returns a list of all operations that were performed on this DID. The first entry is the genesis operation — the one that created the DID. It is the only one where prev (previous entry) is null, because it is the first one. Note that the first entry of this DID’s log has a different format. This entry uses the legacy format. Currently, newly created DIDs use the new format (subsequent records), but @jay.bsky.team has been around for a while (the account belongs to Bluesky’s CEO). If you look through the logs you will notice a couple of changes that were made to her identity over time: the handle was changed from jay.bsky.social to jay.bsky.team (note that the legacy format used handle whereas the new format uses alsoKnownAs) the handle now includes at:// the personal data server changed from https://bsky.social to https://morel.us-east.host.bsky.network Signatures Each entry in the log includes a sig field, which contains the signature. This cryptographic signature is derived from the other fields in the entry. For the genesis operation, the rotationKeys (or signingKey for legacy) field contains the public key(s) of the key pair(s) with which the entry was signed. Subsequent operations need to be signed with the key from the previous entry. Additionally, the prev field references the previous entry. Creating a DID The identifier in the DID, which is the last part of the colon-separated string, is constructed from the genesis operation. For @jay.bsky.team: the identifier is oky5czdrnfjpqslsw2a5iclo the genesis operation is this JSON document: { "sig": "KuN3A61golVNSDU71wZKLP9lVuXk6YekJAz1lwDzrPsNTEWHBBW_8zSyV6pDxV4KiYXuAXlS1Ik47XkjQZ94mA", "prev": null, "type": "create", "handle": "jay.bsky.social", "service": "https://bsky.social", "signingKey": "did:key:zQ3shP5TBe1sQfSttXty15FAEHV1DZgcxRZNxvEWnPfLFwLxJ", "recoveryKey": "did:key:zQ3shhCGUqDKjStzuDxPkTxN6ujddP4RkEKJJouJGRRkaLGbg" } Steps: encode the genesis operation in DAG-CBOR (this is a concise binary format and looks a bit like JSON) create a SHA256 hash of the encoded document encode the hash with base 32 and make its letters lowercase. take the first 24 characters add did:plc: as a prefix to create the 32-character DID Verification Based on what we’ve learned so far we can verify a handle from Bluesky. For example, if we want to check @jay.bsky.team: resolve DID via DNS: did:plc:oky5czdrnfjpqslsw2a5iclo look up DID in PLC directory the handle in the alsoKnownAs (or handle for legacy) field must match jay.bsky.team verify all operations using the public keys and signatures reconstruct the DID from the genesis operation and ensure it is the same as the one we found in the DNS TXT record Can we trust the PLC directory though? Say a malicious actor has taken over control and modified all entries in the log. The hacker even constructed the entries in the log so that all the signatures appear valid. How would we still know the PLC directory is compromised? Remember that the DID can be reconstructed from the genesis operation. If that were modified, we’d end up with a different DID from the one we found in the DNS TXT record. Summary This blog explores the AT Protocol, the decentralized foundation of social applications like Bluesky, with a focus on user identities and their technical underpinnings. It explains how Bluesky user handles are associated with Decentralized Identifiers (DIDs), which can be resolved using DNS records or HTTPS endpoints. Detailed examples demonstrate how tools like dig and curl retrieve DID data, revealing the method (plc) and structure used to catalog them in the Public Ledger of Credentials (PLC). The post also examines the DID lifecycle, showcasing how historical operations and changes—such as updates to handles or servers—are logged and accessible for transparency. There are several aspects that we did not investigate, such as: the web method for DIDs tombstone operations in the log recovery how exactly to construct the prev entry in the DID document what the other fields in the DID document mean If you are curious, the links in the next section will help you answer these questions. Links & Further Reading Bluesky Application AT Protocol AT Protocol Identity AT Protocol DID AT Protocol Handle Decentralized Identifiers (DIDs) v1.0 did:plc Method Specification Specification: DAG-CBOR

DASL — Data-Addressed Structures & Links

A small set of simple, standard primitives to work on content-addressed data.

DASL — Data-Addressed Structures & Links

A small set of simple, standard primitives to work on content-addressed data.

Goodbye WinterCG, welcome WinterTC | Web-interoperable Runtimes Community Group

[Reblog from the W3C Blog: Collaborating across W3C and Ecma for web-interoperable server runtimes through WinterTC]

DWeb Virtual Meetup — Jan 2025 — Latest in the DWeb Ecosystem

DWeb Virtual Meetup (January 2026) featuring speakers sharing their latest DWeb product releases and community organizing efforts. SPEAKERSmauve signweaver, Awana Digital: Awana Digital supports those working to defend their human and environmental rights, but who lack the tools to do so. Their local partners represent marginalized communities worldwide, including Indigenous Peoples and ethnic minorities. They train local partners to use basic digital tools to gather, share, and manage information about environmental and human rights infractions. mauve presented CoMapeo Abare, an open-source local-first Android app designed with Indigenous communities, to enable non-technical users to easily map and document biodiversity, environmental threats, and human rights abuses.Blaine Cook, New_ Public: New_ Public is a nonprofit focused on building digital public spaces that foster connection, facilitate pluralism, and encourage civic engagement. Blaine presented Roundabout, their new social app and website to improve information sharing in rural and suburban towns, and city neighborhoods — areas with about 10,000-50,000 people.Afri Schoedon, Department of Decentralization (DoD): The Department of Decentralization is a collective of people from Berlin, who first assembled in 2018 to organize ETHBerlin hackathon. They aim to be an agnostic vehicle to drive adoption, educate newcomers, and raise awareness of the challenges and benefits of decentralization and open-source software. Afri shared their experience of previous DoD events and share the technologies and approaches that their collective sees as being on the horizon of network decentralization.Facilitated by DWeb Senior Organizer, mai ishikawa sutton

DIDComm: The Future of Secure and Decentralized Communication

How the W3C-Defined DIDComm Protocol is Revolutionizing Digital Messaging

DID - AT Protocol

Persistent decentralized identifiers (as used in atproto)

Decentralized Deliberation Stack (DDS)

A W3C Community Group working draft for an open stack for sovereign, verifiable, interoperable, and resilient deliberation.

[Proposal] WG for group/community standards and infrastructure in ATProto

Interested in contributing — specifically to Phase 1 (shared ontology and community archetypes). I’m a cognitive linguist and university researcher. My work on the AT Protocol side includes Mezzanine, an information networking system using opaque cashtag connectors as a routing layer, and two Leaflet pieces on community infrastructure as a gradient — from permissionless tag-based commons to credentialed spaces. The reason I’m flagging my disciplinary background: Phase 1 is where this WG will e...

12 November 2025 | Isolated Web Apps - Current state and future direction | Calendar

The World Wide Web Consortium (W3C) is an international community where Member organizations, a full-time staff, and the public work together to develop Web standards.

RFC: Identity · tilesprivacy · Discussion #52

Tiles Identity Decentralized identifiers (DIDs) Tiles will be having decentralized identifiers, since its foremost should be used locally that means authn/authz should be also local. But since Tile...