4 ms·

I want to give everyone a digital identity. In some countries (including mine) basically everyone has an e-ID which we use to sign in to things like government

I want to give everyone a digital identity. In some countries (including mine) basically everyone has an e-ID which we use to sign in to things like government services, banks, payment providers and much more. This is absolutely essential to everyday life and many startups are built around it. Unfortunately, many countries don't have useful e-IDs and the ones that do are limited to that one country. I want to create a single digital identity which works for everyone, for all applications, across borders. The basic features are: - App based with no special hardware necessary. - Privacy friendly with the user always fully aware of what data they are revealing. - Simple to integrate for developers. It's a standard SSO flow over OAuth/OIDC. I'm currently calling it Pass: https://getpass.app https://getpass.app. If anyone wants to have a chat about digital identities you can reach me at fabian (at) flapplabs.se

dane-pgp 6y ago
> Privacy friendly Does this mean that a user can use their identity on two separate sites, and those two sites can't collude to build a shared profile of the user, without the user's permission? Does the user have to choose a specific server to be involved in all their identity interactions? If the server stops working, does the user lose their identity? Also, is it possible to create an account without a phone (or rather without a SIM, since those are often tied to real identities)? Does your proposed system assume that people can't register multiple identities (using multiple phones) if they wanted to?
- fabianlindfors 6y ago
  > Does this mean that a user can use their identity on two separate sites, and those two sites can't collude to build a shared profile of the user, without the user's permission? That's precisely what it means. User IDs will be unique for each site and I'm hoping to anonymize email addresses as well, similar to what Apple has done for "Sign in with Apple". Some companies might be required by law to collect some PII but in that case their needs will be vetted before. > Does the user have to choose a specific server to be involved in all their identity interactions? If the server stops working, does the user lose their identity? I'm currently building this as a centralized product so no, there is only a single server maintained by us. I'm mostly concerned with building a great product but the prospect of decentralized, verified identities is also very interesting. I'd love to see what that could look like! > Also, is it possible to create an account without a phone (or rather without a SIM, since those are often tied to real identities)? Does your proposed system assume that people can't register multiple identities (using multiple phones) if they wanted to? The current product is in the form of an app so you will need a phone but you won't need a phone number (or SIM). An email address is currently required though. My current system assumes one identity per person but it's fully possible to have multiple devices which acts as that identity. This might change depending on regulation though and is not set in stone. If you have any more questions I'd be happy to answer them!
  - dane-pgp 6y ago
    Thank you for those excellent answers. I do have a couple more questions if you are interested: > [companies'] needs will be vetted before. Is the plan that a single entity offering this centralized product will control not just which users are allowed to have identities, but which companies are allowed to access users' IDs? Presumably there is a somewhat costly process to vetting companies and their requirements, so would companies pay a fixed amount to cover this vetting process, or pay more based on the level of personal information they hoped to receive from users? > the prospect of decentralized, verified identities is also very interesting. What type of verification do you imagine being necessary or available for user identities? > The current product is in the form of an app so you will need a phone but you won't need a phone number (or SIM). Are there any technologies specific to phones that mean this couldn't run as a web app instead? > My current system assumes one identity per person but it's fully possible to have multiple devices which acts as that identity. So if you can install multiple copies of the app on your (Android) phone, you could have multiple identities on the same device?
    - fabianlindfors 6y ago
      > Is the plan that a single entity offering this centralized product will control not just which users are allowed to have identities, but which companies are allowed to access users' IDs? Presumably there is a somewhat costly process to vetting companies and their requirements, so would companies pay a fixed amount to cover this vetting process, or pay more based on the level of personal information they hoped to receive from users? That's the plan, yes. The current pricing structure is to let companies pay a monthly price per active user. They would not be able to pay more to get access to more data. As this is early stages, I'm not sure what the vetting process will look like yet. It's mostly there to ensure that the the data the companies request are actually needed for their core business and will not be used for tracking. For example, a company can only request the legal name of a user if the law requires them to know it. This might be true for a bank but not for a dating app. > What type of verification do you imagine being necessary or available for user identities? The verification we will be performing is at the level required by some laws, for example Know Your Customer (KYC) and Anti-Money Laundering (AML) laws. Our goal is to make Pass suitable for fintech companies which have quite stringent requirements. I can also see lighter forms of verification being good enough for other applications, like the Web of Trust model used by PGP. > Are there any technologies specific to phones that mean this couldn't run as a web app instead? Yes. Many modern phones have a built-in Hardware Security Module (HSM) which can be used to store and use asymmetric keys securely. Browser storage can't offer the same level of security currently but there have been some interesting developments which might change this, for example WebAuthn. > So if you can install multiple copies of the app on your (Android) phone, you could have multiple identities on the same device? I can't really answer this right now as I'm not sure which way we'll go. It will depend on what regulations require and what we can achieve in terms of verification.
occamrazor 6y ago
The eIDAS system in theory should work across countries, but AFAIK it is not compulsory and this functionality hasn’t been implemented by aby country. Moreover it requires a smart card for the highest level of authentication.
- fabianlindfors 6y ago
  eIDAS is a great initiative but unfortunately I think it’s going to take a while before it becomes useful outside government. As you said, many countries don’t have well established e-IDs and that is what I’m trying to remedy. My main target is not government. Ht Smart cards don’t work very well today where the average person uses most services through their phone. With the HSMs in modern phones, security in a e-ID app will get very close to that of a smart card though which is really exciting!
a1369209993 6y ago
How do you plan to insure that your digital identity system can be used for illegal/criminal purposes, such as aiding Jews and other undesirables in evading lawfully authorized detention and relocation (or by said undesirables for said evasion)? (I don't mean to single you out specifically; this is something that any digital identity system needs to deal with. And most of them enthusiastically don't.)
- dang 6y ago
  Why have you chosen to express this point in such a trollish way? We've already received complaints about it. It sounds like you're trying to say something about the danger of such systems being abused by the state in holocaust-like situations, but the wording is so odd that it's unclear what your real intent is.
  - a1369209993 6y ago
    > Why have you chosen to express this point in such a trollish way? I am legitimately confused by this question, since it does not appear trollish to me. I chose to express it that way to emphasize that (some) abuses of a digital identity system would present as lawful actions by authorized law enforcement personnel, and (apparently too tacitly) that "holocaust-like situations" are not a qualitatively different operating regime that system can assume it is not in during 'normal' operation. I was a bit worried that it would be percieved as overly confrontational (hence the second paragraph attempting to disclaim that), but I assume that's not what you mean by "trollish".
  - _-___________-_ 6y ago
    FWIW, I didn't read that comment as trollish at all. It's quite awkwardly written, and it could do with scare quotes around "undesirables" to make it clear that it refers to the view of authorities in their scenario rather than the view of the comment author, but which part of it is trollish? My understanding of the comment was expressing a concern that some kind of universal identity system would undoubtedly become an agent of the state, which is fine most of the time but in various situations (including holocaust-like ones) means that it could be used as an instrument of oppression, since it would likely be unable to be used by those who wanted to hide some aspect of their identity for safety reasons. This seems like a legitimate concern for something that has a goal of becoming a global universal identity system. I would hope that something like that would look more like cash - usable by anyone, whether the state likes it or not, with fundamental privacy aspects - rather than like VISA with some privacy bolted on.

dane-pgp 6y ago

> Privacy friendly Does this mean that a user can use their identity on two separate sites, and those two sites can't collude to build a shared profile of the user, without the user's permission? Does the user have to choose a specific server to be involved in all their identity interactions? If the server stops working, does the user lose their identity? Also, is it possible to create an account without a phone (or rather without a SIM, since those are often tied to real identities)? Does your proposed system assume that people can't register multiple identities (using multiple phones) if they wanted to?

fabianlindfors 6y ago
> Does this mean that a user can use their identity on two separate sites, and those two sites can't collude to build a shared profile of the user, without the user's permission? That's precisely what it means. User IDs will be unique for each site and I'm hoping to anonymize email addresses as well, similar to what Apple has done for "Sign in with Apple". Some companies might be required by law to collect some PII but in that case their needs will be vetted before. > Does the user have to choose a specific server to be involved in all their identity interactions? If the server stops working, does the user lose their identity? I'm currently building this as a centralized product so no, there is only a single server maintained by us. I'm mostly concerned with building a great product but the prospect of decentralized, verified identities is also very interesting. I'd love to see what that could look like! > Also, is it possible to create an account without a phone (or rather without a SIM, since those are often tied to real identities)? Does your proposed system assume that people can't register multiple identities (using multiple phones) if they wanted to? The current product is in the form of an app so you will need a phone but you won't need a phone number (or SIM). An email address is currently required though. My current system assumes one identity per person but it's fully possible to have multiple devices which acts as that identity. This might change depending on regulation though and is not set in stone. If you have any more questions I'd be happy to answer them!
- dane-pgp 6y ago
  Thank you for those excellent answers. I do have a couple more questions if you are interested: > [companies'] needs will be vetted before. Is the plan that a single entity offering this centralized product will control not just which users are allowed to have identities, but which companies are allowed to access users' IDs? Presumably there is a somewhat costly process to vetting companies and their requirements, so would companies pay a fixed amount to cover this vetting process, or pay more based on the level of personal information they hoped to receive from users? > the prospect of decentralized, verified identities is also very interesting. What type of verification do you imagine being necessary or available for user identities? > The current product is in the form of an app so you will need a phone but you won't need a phone number (or SIM). Are there any technologies specific to phones that mean this couldn't run as a web app instead? > My current system assumes one identity per person but it's fully possible to have multiple devices which acts as that identity. So if you can install multiple copies of the app on your (Android) phone, you could have multiple identities on the same device?
  - fabianlindfors 6y ago
    > Is the plan that a single entity offering this centralized product will control not just which users are allowed to have identities, but which companies are allowed to access users' IDs? Presumably there is a somewhat costly process to vetting companies and their requirements, so would companies pay a fixed amount to cover this vetting process, or pay more based on the level of personal information they hoped to receive from users? That's the plan, yes. The current pricing structure is to let companies pay a monthly price per active user. They would not be able to pay more to get access to more data. As this is early stages, I'm not sure what the vetting process will look like yet. It's mostly there to ensure that the the data the companies request are actually needed for their core business and will not be used for tracking. For example, a company can only request the legal name of a user if the law requires them to know it. This might be true for a bank but not for a dating app. > What type of verification do you imagine being necessary or available for user identities? The verification we will be performing is at the level required by some laws, for example Know Your Customer (KYC) and Anti-Money Laundering (AML) laws. Our goal is to make Pass suitable for fintech companies which have quite stringent requirements. I can also see lighter forms of verification being good enough for other applications, like the Web of Trust model used by PGP. > Are there any technologies specific to phones that mean this couldn't run as a web app instead? Yes. Many modern phones have a built-in Hardware Security Module (HSM) which can be used to store and use asymmetric keys securely. Browser storage can't offer the same level of security currently but there have been some interesting developments which might change this, for example WebAuthn. > So if you can install multiple copies of the app on your (Android) phone, you could have multiple identities on the same device? I can't really answer this right now as I'm not sure which way we'll go. It will depend on what regulations require and what we can achieve in terms of verification.

occamrazor 6y ago

The eIDAS system in theory should work across countries, but AFAIK it is not compulsory and this functionality hasn’t been implemented by aby country. Moreover it requires a smart card for the highest level of authentication.

fabianlindfors 6y ago
eIDAS is a great initiative but unfortunately I think it’s going to take a while before it becomes useful outside government. As you said, many countries don’t have well established e-IDs and that is what I’m trying to remedy. My main target is not government. Ht Smart cards don’t work very well today where the average person uses most services through their phone. With the HSMs in modern phones, security in a e-ID app will get very close to that of a smart card though which is really exciting!

a1369209993 6y ago

How do you plan to insure that your digital identity system can be used for illegal/criminal purposes, such as aiding Jews and other undesirables in evading lawfully authorized detention and relocation (or by said undesirables for said evasion)? (I don't mean to single you out specifically; this is something that any digital identity system needs to deal with. And most of them enthusiastically don't.)

dang 6y ago
Why have you chosen to express this point in such a trollish way? We've already received complaints about it. It sounds like you're trying to say something about the danger of such systems being abused by the state in holocaust-like situations, but the wording is so odd that it's unclear what your real intent is.
- a1369209993 6y ago
  > Why have you chosen to express this point in such a trollish way? I am legitimately confused by this question, since it does not appear trollish to me. I chose to express it that way to emphasize that (some) abuses of a digital identity system would present as lawful actions by authorized law enforcement personnel, and (apparently too tacitly) that "holocaust-like situations" are not a qualitatively different operating regime that system can assume it is not in during 'normal' operation. I was a bit worried that it would be percieved as overly confrontational (hence the second paragraph attempting to disclaim that), but I assume that's not what you mean by "trollish".
- _-___________-_ 6y ago
  FWIW, I didn't read that comment as trollish at all. It's quite awkwardly written, and it could do with scare quotes around "undesirables" to make it clear that it refers to the view of authorities in their scenario rather than the view of the comment author, but which part of it is trollish? My understanding of the comment was expressing a concern that some kind of universal identity system would undoubtedly become an agent of the state, which is fine most of the time but in various situations (including holocaust-like ones) means that it could be used as an instrument of oppression, since it would likely be unable to be used by those who wanted to hide some aspect of their identity for safety reasons. This seems like a legitimate concern for something that has a goal of becoming a global universal identity system. I would hope that something like that would look more like cash - usable by anyone, whether the state likes it or not, with fundamental privacy aspects - rather than like VISA with some privacy bolted on.