12 ms·

Offerings in the SSI/VD space are currently exploding -some even government backed. Microsoft, MasterCard, Auth0, the European Union are the biggest players tha

Offerings in the SSI/VD space are currently exploding -some even government backed. Microsoft, MasterCard, Auth0, the European Union are the biggest players that come to my mind. This will turn the whole billion dollar kyc/identity verification space upside down. I work in that space.

Avamander 4y ago
Feels like reinventing the past, looking at what people have done with just x509/PKI in multiple European countries. Though that's not to say there aren't a few fun ideas in there, it just seems much less mature with many mistakes repeated.
- lxgr 4y ago
  Federation and acceptance are key. My country of citizenship has been issuing PIV(?)-based smartcards for more than a decade now, yet almost nobody could (and still can) verify them within the country, let alone abroad. On the other hand, the EU digital Covid certificate project managed to get pretty widespread adoption in a short timeframe – with a vastly simpler technology stack backing it. I'm really hoping the eIDAS project or a similar private initiative manages to use that momentum and bring (hopefully private) ID verification to the web. Whenever I "verify my identity" for a request to my bank by attaching a photo of my driver's license to an email, something in me dies...
  - Avamander 4y ago
    > My country of citizenship has been issuing PIV(?)-based smartcards for more than a decade now, yet almost nobody could (and still can) verify them within the country That is most likely specific to your country and it's approach to deployment, your politics. Estonia mandated the availability of smartcard/PIV/mTLS authentication and it's now very widespread. Also really easy and free to implement. > let alone abroad. That is unwillingness to follow the EU standard from some EU countries and wish to reinvent the wheel (e.g. BankID and similar). I know that eIDAS-compliant PIV/smartcard implementations are cross-compliant e.g. Finland-Estonia-Latvia-Lithuania. But code-stealing Polish implementation for example isn't. > On the other hand, the EU digital Covid certificate project managed to get pretty widespread adoption in a short timeframe – with a vastly simpler technology stack backing it. Each country were given most of the stack required, they bypassed a lot of bullshit many countries have with software development. > I'm really hoping the eIDAS project or a similar private initiative manages to use that momentum and bring (hopefully private) ID verification to the web. When PSD2 required 2FA for banking, we had had it for more than five years at that point. So there is hope some EU legislation smooths these things out at some point, but it's going to be quite late.
lifeisstillgood 4y ago
Would you mind expanding on the how ? I am trying to get a handle on whether identity providers / VC providers are going to be 5 big firms or if everyone will do it like everyone used to have a office stamp for banging a red inked logo onto documents
- dwaite 4y ago
  I would expect the VC providers will be the issuing authorities - you won't get a digital driving license from Facebook, you'll get it from the DMV. Now they might not be running their own infrastructure, but they still have to be the one who authorized the credential to be minted. A faux digital National ID card issued from a random social network will likely not let you get access to government services or let you open a bank account, even if the data itself is all correct. It is more likely that you'll have "trust frameworks" describing technical and logistical interoperability, and verifiers will accept any issuer that falls under that umbrella. In the US with driving licenses and state identification cards for example, that would likely be AAMVA.
  - Traubenfuchs 4y ago
    You might get your physical ids from the government, but private providers will verify them and create a digital-identity for you. Unless the government also wants to play the role of digital identity provider / VC provider.
- Traubenfuchs 4y ago
  You will have all your email, postal addresses, other PII and (formerly physical) identification documents in a wallet app. Government websites AND private websites will be able to request data from that wallet for login and registration purposes. You will need to approve all requests to your wallet, in the majority of cases by using biometrics (e.g. faceId or non-apple alternatives of it). This has the potential to eradicate several major avenues of fraud. The more of this is offered (for free) by governments the more it could majorly disrupt (=destroy) the industry around the topic. Worldwide it seems there is a new, proprietary wallet each month, which naturally totally ruins this idea of having one wallet, but I see what is currently going on as a "storming phase" or almost "norming phase" already, that will eventually reach the "performing phase", with one or two wallets being the survivors. A big stumbling block here is that everyone involved wants a piece of the cake. The European Union is actively (but slowly) working on this, e.g. with eIDAS. With eIDAS, you create a digital identity in your home country. If that home country DI offering supports eIDAS, you can use it to login to any other government AND private service implementing any DI offering that supports eIDAS. > whether identity providers / VC providers are going to be 5 big firms The big firms will provide the ecosystem (e.g. Microsoft Entra, mastercard-id-for-rp, ...), the real identity verification will happen through offerings like Onfido, Jumio and the 1000 other offerings in the space.

Avamander 4y ago

Feels like reinventing the past, looking at what people have done with just x509/PKI in multiple European countries. Though that's not to say there aren't a few fun ideas in there, it just seems much less mature with many mistakes repeated.

lxgr 4y ago
Federation and acceptance are key. My country of citizenship has been issuing PIV(?)-based smartcards for more than a decade now, yet almost nobody could (and still can) verify them within the country, let alone abroad. On the other hand, the EU digital Covid certificate project managed to get pretty widespread adoption in a short timeframe – with a vastly simpler technology stack backing it. I'm really hoping the eIDAS project or a similar private initiative manages to use that momentum and bring (hopefully private) ID verification to the web. Whenever I "verify my identity" for a request to my bank by attaching a photo of my driver's license to an email, something in me dies...
- Avamander 4y ago
  > My country of citizenship has been issuing PIV(?)-based smartcards for more than a decade now, yet almost nobody could (and still can) verify them within the country That is most likely specific to your country and it's approach to deployment, your politics. Estonia mandated the availability of smartcard/PIV/mTLS authentication and it's now very widespread. Also really easy and free to implement. > let alone abroad. That is unwillingness to follow the EU standard from some EU countries and wish to reinvent the wheel (e.g. BankID and similar). I know that eIDAS-compliant PIV/smartcard implementations are cross-compliant e.g. Finland-Estonia-Latvia-Lithuania. But code-stealing Polish implementation for example isn't. > On the other hand, the EU digital Covid certificate project managed to get pretty widespread adoption in a short timeframe – with a vastly simpler technology stack backing it. Each country were given most of the stack required, they bypassed a lot of bullshit many countries have with software development. > I'm really hoping the eIDAS project or a similar private initiative manages to use that momentum and bring (hopefully private) ID verification to the web. When PSD2 required 2FA for banking, we had had it for more than five years at that point. So there is hope some EU legislation smooths these things out at some point, but it's going to be quite late.

lifeisstillgood 4y ago

Would you mind expanding on the how ? I am trying to get a handle on whether identity providers / VC providers are going to be 5 big firms or if everyone will do it like everyone used to have a office stamp for banging a red inked logo onto documents

dwaite 4y ago
I would expect the VC providers will be the issuing authorities - you won't get a digital driving license from Facebook, you'll get it from the DMV. Now they might not be running their own infrastructure, but they still have to be the one who authorized the credential to be minted. A faux digital National ID card issued from a random social network will likely not let you get access to government services or let you open a bank account, even if the data itself is all correct. It is more likely that you'll have "trust frameworks" describing technical and logistical interoperability, and verifiers will accept any issuer that falls under that umbrella. In the US with driving licenses and state identification cards for example, that would likely be AAMVA.
- Traubenfuchs 4y ago
  You might get your physical ids from the government, but private providers will verify them and create a digital-identity for you. Unless the government also wants to play the role of digital identity provider / VC provider.
Traubenfuchs 4y ago
You will have all your email, postal addresses, other PII and (formerly physical) identification documents in a wallet app. Government websites AND private websites will be able to request data from that wallet for login and registration purposes. You will need to approve all requests to your wallet, in the majority of cases by using biometrics (e.g. faceId or non-apple alternatives of it). This has the potential to eradicate several major avenues of fraud. The more of this is offered (for free) by governments the more it could majorly disrupt (=destroy) the industry around the topic. Worldwide it seems there is a new, proprietary wallet each month, which naturally totally ruins this idea of having one wallet, but I see what is currently going on as a "storming phase" or almost "norming phase" already, that will eventually reach the "performing phase", with one or two wallets being the survivors. A big stumbling block here is that everyone involved wants a piece of the cake. The European Union is actively (but slowly) working on this, e.g. with eIDAS. With eIDAS, you create a digital identity in your home country. If that home country DI offering supports eIDAS, you can use it to login to any other government AND private service implementing any DI offering that supports eIDAS. > whether identity providers / VC providers are going to be 5 big firms The big firms will provide the ecosystem (e.g. Microsoft Entra, mastercard-id-for-rp, ...), the real identity verification will happen through offerings like Onfido, Jumio and the 1000 other offerings in the space.