3 ms·

What is a "trust bundle"?

• sixothree 9y ago
  To add to the trust bundle a vendor needs to be accredited. The trust bundle holds the public key for every "email" address.
  • Niten 9y ago
    So it's a PKI, except obfuscated by a bunch of health industry acronyms and "accredited" logos?
    • sixothree 9y ago
      It always surprises me how little this tech community knows about the Direct Project, especially considering how many hundreds of thousands of people have direct addresses assigned to them. This thing is in production very wide usage by health industry. And the applications for it continue to grow. For example FHIR via Direct promises to empower patients. But yes, this particular implementation especially is PKI with identity vetting. There are other trust bundles with different logos and requirements. But the direct project defines more than just the PKI. It defines edge protocols such as XDR and IMAP. It also defines methods for message delivery and processed notifications. And of course you can create your own trust bundle with whatever requirements you want. This particular accredited portion means that these organizations have particular identity vetting processes for users, have on site visits to inspect servers, and adhere to a long list of privacy and security practices.
• sixothree 9y ago
  Trust bundles also represent "networks" of people. Networks can be run by different organizations with different requirements. Here is the most popular one. https://services.directtrust.org/about_accredited_bundle/ https://services.directtrust.org/about_accredited_bundle/