4 ms·

That's a transport problem - you would use TLS.

jameshart 4y ago
So, I go to cheapboozeforstudents.com, to buy some cheap booze, and they ask me to show my student ID to qualify for the cheap booze. I'm using TLS to ensure that I share the 'verifiable presentation' of my ID securely with, as I expected, cheapboozeforstudents.com. But what's to stop that website from taking my student ID and showing it to statestudentaid.gov as proof that they're a student, allowing them to apply for a tuition grant in my name? Is there a part where I put into my verifiable presentation that I am signing it because I believe I'm showing it to cheapboozeforstudents.com? So that if they try to pass that VP on to statestudentaid.gov the ID will be rejected?
- hirsin 4y ago
  Yep,proof of possession - the ID contains a public key, you own the matching private key. You send them the ID with a matching assertion ("This is meant for cheapboozeforstudents.com"), signed by your private key. The website can't in turn generate an assertion for statestudentaid.gov because the whole envelope (ID, assertion, signature) is uniquely tied to them. It does rely on statestudentaid.gov actually validating said assertion, of course, but that's only like... The second most common screw up with JWTs and related tokens.
  - jameshart 4y ago
    And... cheapboozeforstudents can't fool me into generating an assertion for statestudentaid.gov by showing me statestudentaid.gov's presentation request? But yeah, the issue here is that when you present your student ID to anyone, you are relying to some extent on every single other service that accepts student ID to be validating the audience assertion. That's not a great trust model.
    - NovemberWhiskey 4y ago
      The verifiable presentation is not just the credential; it should be signed by the holder, and that can include a 'domain' to specify the intended recipient and a challenge token to guard against replay. https://www.w3.org/TR/vc-data-model/#concrete-lifecycle-example https://www.w3.org/TR/vc-data-model/#concrete-lifecycle-exam... It's always contingent on the recipient of an identity proof to verify that it's valid; I'm not sure I understand the criticism to be honest.
    - nileshtrivedi 4y ago
      There's also the possibility that cheapboozeforstudents and statestudentaid.gov are colluding - either directly or because of corrupt employees - against the ID holder. We have seen examples where banks issued loans in user's name against fake IDs/applications.
    - yazzku 4y ago
      You (client) wouldn't accept a statestudentaid.gov presentation request coming from cheapboozeforstudents.com.
- NovemberWhiskey 4y ago
  e.g. token binding. https://www.w3.org/TR/vc-data-model/#token-binding https://www.w3.org/TR/vc-data-model/#token-binding
- lxgr 4y ago
  Digitally verifiable statements are usually of the form "z attests that x is a y", not "whoever presents this statement is x". For digital ID, such a statement could be "only person Foo Bar knows the private key that corresponds to this public key, and they use that one for verifying their age, but not for voting or opening new bank accounts". I do see the UX concern, though: The European digital Covid certificate works in exactly this way ("Foo Bar is fully vaccinated against Covid as of April 1st"), making no claim of the form "the person showing you this QR code is Foo Bar" or "the person presenting this code is vaccinated" – yet this is how it was and is unfortunately still often used.
- dwaite 4y ago
  Presentation is typically signed with a proof, e.g. of possession of the private key. It also includes elements in the request for a presentation - a non-repeating nonce and the domain to make it an interactive challenge. The ability to prevent MITM depends on how well the wallet/protocol does web domain binding.

So, I go to cheapboozeforstudents.com, to buy some cheap booze, and they ask me to show my student ID to qualify for the cheap booze. I'm using TLS to ensure that I share the 'verifiable presentation' of my ID securely with, as I expected, cheapboozeforstudents.com. But what's to stop that website from taking my student ID and showing it to statestudentaid.gov as proof that they're a student, allowing them to apply for a tuition grant in my name? Is there a part where I put into my verifiable presentation that I am signing it because I believe I'm showing it to cheapboozeforstudents.com? So that if they try to pass that VP on to statestudentaid.gov the ID will be rejected?

hirsin 4y ago
Yep,proof of possession - the ID contains a public key, you own the matching private key. You send them the ID with a matching assertion ("This is meant for cheapboozeforstudents.com"), signed by your private key. The website can't in turn generate an assertion for statestudentaid.gov because the whole envelope (ID, assertion, signature) is uniquely tied to them. It does rely on statestudentaid.gov actually validating said assertion, of course, but that's only like... The second most common screw up with JWTs and related tokens.
- jameshart 4y ago
  And... cheapboozeforstudents can't fool me into generating an assertion for statestudentaid.gov by showing me statestudentaid.gov's presentation request? But yeah, the issue here is that when you present your student ID to anyone, you are relying to some extent on every single other service that accepts student ID to be validating the audience assertion. That's not a great trust model.
  - NovemberWhiskey 4y ago
    The verifiable presentation is not just the credential; it should be signed by the holder, and that can include a 'domain' to specify the intended recipient and a challenge token to guard against replay. https://www.w3.org/TR/vc-data-model/#concrete-lifecycle-example https://www.w3.org/TR/vc-data-model/#concrete-lifecycle-exam... It's always contingent on the recipient of an identity proof to verify that it's valid; I'm not sure I understand the criticism to be honest.
  - nileshtrivedi 4y ago
    There's also the possibility that cheapboozeforstudents and statestudentaid.gov are colluding - either directly or because of corrupt employees - against the ID holder. We have seen examples where banks issued loans in user's name against fake IDs/applications.
  - yazzku 4y ago
    You (client) wouldn't accept a statestudentaid.gov presentation request coming from cheapboozeforstudents.com.
NovemberWhiskey 4y ago
e.g. token binding. https://www.w3.org/TR/vc-data-model/#token-binding https://www.w3.org/TR/vc-data-model/#token-binding
lxgr 4y ago
Digitally verifiable statements are usually of the form "z attests that x is a y", not "whoever presents this statement is x". For digital ID, such a statement could be "only person Foo Bar knows the private key that corresponds to this public key, and they use that one for verifying their age, but not for voting or opening new bank accounts". I do see the UX concern, though: The European digital Covid certificate works in exactly this way ("Foo Bar is fully vaccinated against Covid as of April 1st"), making no claim of the form "the person showing you this QR code is Foo Bar" or "the person presenting this code is vaccinated" – yet this is how it was and is unfortunately still often used.
dwaite 4y ago
Presentation is typically signed with a proof, e.g. of possession of the private key. It also includes elements in the request for a presentation - a non-repeating nonce and the domain to make it an interactive challenge. The ability to prevent MITM depends on how well the wallet/protocol does web domain binding.