3 ms·
Isn't there two things going on here? A single sign on service, and also an identity check. A yubico device can say "I'm still the same security key that was e
by desas 5y ago
Isn't there two things going on here? A single sign on service, and also an identity check.
A yubico device can say "I'm still the same security key that was enrolled" but it doesn't say at enrolment "I am being used by Fred Jones of <address> with passport no 123, NiNo ABC".
GDS verify / government gateway do support 'authenticators' (typically password + totp) to provide a level of assurance that the person logging into the account is the person the account belongs to.
The "document check" is part of the identity bit. That is, how confident are we that the person creating this account / performing this action is who they say they are and can do this thing or see that information. The document check is part of their solution but other parts are supposed to layer on top of it to provide a proportionate level of assurance. e.g. a video of you holding up the passport to check that it's you using it or asking you to provide answers to details you already have like 'how much tax did you pay last year' or checking multiple documents.
> I presume the British government does own a database of the passports they issued, so this isn't news to them.
The passport office (part of the Home Office) own that database. Part of this work is basically a web service to that database for the rest of the government to use.
- mpyne 5y agoThis is the difference between 'identity assurance' (at enrollment) and 'authentication assurance' in the relevant NIST standard, SP 800-63 https://pages.nist.gov/800-63-3/ https://pages.nist.gov/800-63-3/ A remote passport check might be suitable to claim an identity assurance level of 2, say, while getting to identity assurance level 3 would need an in-person visit with multiple forms of other government identification records. In that way you might then constrain some actions to be taken remotely only by users who have provided strong assurance of their identity at enrollment (even if they login with strong non-phishable authentication... doesn't matter that the auth is ironclad if the user's identity is muddy).
- westurner 5y agoThx. NIST SP 800-63* https://pages.nist.gov/800-63-3/ https://pages.nist.gov/800-63-3/ : > SP 800-63-3: Digital Identity Guidelines https://doi.org/10.6028/NIST.SP.800-63-3 https://doi.org/10.6028/NIST.SP.800-63-3 > SP 800-63A: Enrollment and Identity Proofing https://doi.org/10.6028/NIST.SP.800-63a https://doi.org/10.6028/NIST.SP.800-63a > SP 800-63B: Authentication and Lifecycle Management https://doi.org/10.6028/NIST.SP.800-63b https://doi.org/10.6028/NIST.SP.800-63b > SP 800-63C: Federation and Assertions https://doi.org/10.6028/NIST.SP.800-63c https://doi.org/10.6028/NIST.SP.800-63c