3 ms·

I have to mention the Direct Project. This is secure email that is in use today by a vast number of healthcare professionals. https://www.healthit.gov/provider

I have to mention the Direct Project. This is secure email that is in use today by a vast number of healthcare professionals. https://www.healthit.gov/providers-professionals/faqs/what-direct-project https://www.healthit.gov/providers-professionals/faqs/what-d... It uses trust bundles that hold the public key. Identity is vetted so there is no spam and it helps guarantee you are communicating with the right person. https://www.directmdemail.com/info/how-it-works/Direct-exchange https://www.directmdemail.com/info/how-it-works/Direct-excha... edit: I would also like to add that the direct trust model is starting to get used for things outside of email.

rrggrr 9y ago
What is a "trust bundle"?
- sixothree 9y ago
  To add to the trust bundle a vendor needs to be accredited. The trust bundle holds the public key for every "email" address.
  - Niten 9y ago
    So it's a PKI, except obfuscated by a bunch of health industry acronyms and "accredited" logos?
    - sixothree 9y ago
      It always surprises me how little this tech community knows about the Direct Project, especially considering how many hundreds of thousands of people have direct addresses assigned to them. This thing is in production very wide usage by health industry. And the applications for it continue to grow. For example FHIR via Direct promises to empower patients. But yes, this particular implementation especially is PKI with identity vetting. There are other trust bundles with different logos and requirements. But the direct project defines more than just the PKI. It defines edge protocols such as XDR and IMAP. It also defines methods for message delivery and processed notifications. And of course you can create your own trust bundle with whatever requirements you want. This particular accredited portion means that these organizations have particular identity vetting processes for users, have on site visits to inspect servers, and adhere to a long list of privacy and security practices.
- sixothree 9y ago
  Trust bundles also represent "networks" of people. Networks can be run by different organizations with different requirements. Here is the most popular one. https://services.directtrust.org/about_accredited_bundle/ https://services.directtrust.org/about_accredited_bundle/

rrggrr 9y ago

What is a "trust bundle"?

sixothree 9y ago
To add to the trust bundle a vendor needs to be accredited. The trust bundle holds the public key for every "email" address.
- Niten 9y ago
  So it's a PKI, except obfuscated by a bunch of health industry acronyms and "accredited" logos?
  - sixothree 9y ago
    It always surprises me how little this tech community knows about the Direct Project, especially considering how many hundreds of thousands of people have direct addresses assigned to them. This thing is in production very wide usage by health industry. And the applications for it continue to grow. For example FHIR via Direct promises to empower patients. But yes, this particular implementation especially is PKI with identity vetting. There are other trust bundles with different logos and requirements. But the direct project defines more than just the PKI. It defines edge protocols such as XDR and IMAP. It also defines methods for message delivery and processed notifications. And of course you can create your own trust bundle with whatever requirements you want. This particular accredited portion means that these organizations have particular identity vetting processes for users, have on site visits to inspect servers, and adhere to a long list of privacy and security practices.
sixothree 9y ago
Trust bundles also represent "networks" of people. Networks can be run by different organizations with different requirements. Here is the most popular one. https://services.directtrust.org/about_accredited_bundle/ https://services.directtrust.org/about_accredited_bundle/