Discussion: Identity Index (IDX)

[michaelsena]

Discussion for CIP-11: Identity Index (IDX)

See PR #65 for the updated spec.

[ericelliott]

Questions (links to docs with answers would be great!):

• How do we address privacy? Are there practices we can recommend to ensure compliance with GDPR, CCPA and so on? Can protocols relying on IDX automatically enforce compliance to make app development easier?
• Am I misunderstanding the structure? Is it a hierarchical directory or a loosely connected graph? Open-ended hierarchical directories almost inevitably devolve into a mess or paint people into classification corners. Deeply nested hierarchies will probably break down quickly. Suggestion: Think in loosely connected, cross-referencing graphs, not nesting directories? If graph is what it is, use the word "graph" rather than "directories"? E.g., it's easy for me to imagine how all of the top level directories listed in this doc would fit under the "collections" directory. In other words, it seems like everything listed here is just a special-cased collection?

[oed]

Thanks for you comment @ericelliott!

With regards to privacy, there are a few ways this is be addressed. The most straight forward one is just encrypting the content of any given Ceramic document. This ensures that the content remains private, however metadata about how much and when the document was updated will remain public. A more complete solution would be to implement encryption inside of the Ceramic protocol. This would essentially mean that every update in a document log would be fully encrypted with a symmetric key. In addition to this it might be interesting to explore ways that only authenticated parties can sync the data of a given document. With these primitives most privacy concerns should be possible to address.

We've been discussing the general structure of IDX internally and actually ended up somewhere very close to what you are suggesting; namely that the "Root Index" can be replaced by the "Collection Index". Basically we can describe all data using the concept of collections. This would collapse the "directory" strcutre into one main index of collections. It would also be possible to create "Collections of Collections" as a way to create "shortcuts" or lists of collections of a particular type.

[vongohren]

Does this relate to any of the standards building at DIF, such as Secure Data store, Identity Hub? Has this been played in there to hear the thoughts of that community?

[oed]

Hey @vongohren We've presented Ceramic and IDX to both DIF and the Credentials community. There is definitely a lot of synergies between IDX and SDS and other emerging standards!

Just updated the first post with the simplified spec!