Needs auth

Question

Needs auth

rhiaro opened this issue 4 years ago · comments

There is no authentication or authorization mechanism applied to the DID Document, leaving it unprotected from modification by an attacker.

Dmitri Zagidulin · Answer 1 · Tue Oct 20 2020 07:37:10 GMT+0800 (China Standard Time)

I think this is a duplicate of issue #13?

Dmitri Zagidulin · Answer 2 · Wed Oct 28 2020 08:02:16 GMT+0800 (China Standard Time)

@rhiaro I propose this issue be closed as either duplicate of #13 or out of scope.

Amy Guy · Answer 3 · Wed Oct 28 2020 20:58:15 GMT+0800 (China Standard Time)

Auditability (being able to check historical changes) is completely different to having a mechanism to decide who is allowed to do those changes in the first place, isn't it (this issue being about the latter)?

Dmitri Zagidulin · Answer 4 · Wed Oct 28 2020 23:08:12 GMT+0800 (China Standard Time)

@rhiaro ah, I see. In that case, no, the spec cannot dictate that - the auth policies differ for each individual site (much like the update/delete/etc operations).

Orie Steele · Answer 5 · Tue Jun 28 2022 03:16:58 GMT+0800 (China Standard Time)

Agree, this issue should be closed, this will be at the discretion of the web service provider / hosting company... I'll suggest using GitHub / version control, but I don't think its appropriate to call this an "issue" with the method... its actually a "feature" of the method... that comes from its legacy facing interoperability design considerations.