3 ms·
Actually, it seems that this did go into production - you can now verify identity using the service. For example, you can identify yourself for Govt. of Canada
by throwaway201606 5y ago
Actually, it seems that this did go into production - you can now verify identity using the service. For example, you can identify yourself for Govt. of Canada services (immigration, taxes) by logging into to your banking platform that then vouches for your identity using a service called SecureKeyConcierge / Verified.Me - note that ALL of Canada's major and quite a few minor banks are signed up to the service.
See this page:
https://services.securekeyconcierge.com/cbs/saml/login?l=1&lang=eng https://services.securekeyconcierge.com/cbs/saml/login?l=1&l...
The way the service works by getting permission from you, the user, to share some part of your identity with the destination and you can chose what you share. You could pick for example just to share name and not DoB.
The one reason I hate this otherwise superbly designed service and refused to use it is that is has a dark pattern where it creates a "SecureKey / Verified.Me Concierge Account" for "you" when you use it and starts proxying/pre-emptying the bank-login-as-verification process.
WHICH IS STUPID
AND SCAMMY
IF YOU ARE READING THIS VERIFIED.ME, THIS IS DARK PATTERN BEHAVIOR AND IT IS NOT RIGHT OR FAIR
/start rant
From my perspective, the whole point is - inhale - "I sorta trust my bank because I have to so I will log on to them so that they can vouch for me but I definitely don't trust you so why are you being a dick and making me make an account with your service that I don't trust and will never trust" - exhale
Just let the bank vouch for me each time, this is what I expect a reasonable and non-scammy service provider to do. Don't wait till you have my info then tell me, hey, I will make an verified.met / secureconcierge account for you so that <insert your preferred monetization rationale here> before you do what you promised to do.
I get the idea that they want to consolidate a profile so that you can pick what to share without entering it each time but they way it is done right now feels really slimy.
/end rant
- voidmain0001 5y agoI wrote an identity verification process with Verified.Me. I understand your concern regarding SecureKey's creation of a user account for its service built around identity verification sources such as the chartered banks. Your Verified.Me account is tied to your mobile device, and that it doesn't have any extra PII. You can delete your Verified.Me account from the app at any time. If you move to a new device and want to use Verified.Me, it will tell you that your account is already on another device and needs to be deleted from it before proceeding. The PII that is shared from the banks to the Verified.Me consumer is name, email, and phone number. At all times SecureKey said that it's the conduit and doesn't see that data. Similar to Stripe, SecureKey currently offers an analysis service for photo ID that looks for anomalies and calls them out. The next version of the service integrates with provincial records to concretely confirm validity.