3 ms·

Would you mind expanding on the how ? I am trying to get a handle on whether identity providers / VC providers are going to be 5 big firms or if everyone will d

Would you mind expanding on the how ? I am trying to get a handle on whether identity providers / VC providers are going to be 5 big firms or if everyone will do it like everyone used to have a office stamp for banging a red inked logo onto documents

dwaite 4y ago
I would expect the VC providers will be the issuing authorities - you won't get a digital driving license from Facebook, you'll get it from the DMV. Now they might not be running their own infrastructure, but they still have to be the one who authorized the credential to be minted. A faux digital National ID card issued from a random social network will likely not let you get access to government services or let you open a bank account, even if the data itself is all correct. It is more likely that you'll have "trust frameworks" describing technical and logistical interoperability, and verifiers will accept any issuer that falls under that umbrella. In the US with driving licenses and state identification cards for example, that would likely be AAMVA.
- Traubenfuchs 4y ago
  You might get your physical ids from the government, but private providers will verify them and create a digital-identity for you. Unless the government also wants to play the role of digital identity provider / VC provider.
Traubenfuchs 4y ago
You will have all your email, postal addresses, other PII and (formerly physical) identification documents in a wallet app. Government websites AND private websites will be able to request data from that wallet for login and registration purposes. You will need to approve all requests to your wallet, in the majority of cases by using biometrics (e.g. faceId or non-apple alternatives of it). This has the potential to eradicate several major avenues of fraud. The more of this is offered (for free) by governments the more it could majorly disrupt (=destroy) the industry around the topic. Worldwide it seems there is a new, proprietary wallet each month, which naturally totally ruins this idea of having one wallet, but I see what is currently going on as a "storming phase" or almost "norming phase" already, that will eventually reach the "performing phase", with one or two wallets being the survivors. A big stumbling block here is that everyone involved wants a piece of the cake. The European Union is actively (but slowly) working on this, e.g. with eIDAS. With eIDAS, you create a digital identity in your home country. If that home country DI offering supports eIDAS, you can use it to login to any other government AND private service implementing any DI offering that supports eIDAS. > whether identity providers / VC providers are going to be 5 big firms The big firms will provide the ecosystem (e.g. Microsoft Entra, mastercard-id-for-rp, ...), the real identity verification will happen through offerings like Onfido, Jumio and the 1000 other offerings in the space.
- brabel 4y ago
  Just to clarify something important, though... and I hope you agree with me on that: the VCs that matter will be issued by whoever is the authority that takes care of the subject matter... as it's always been the case in the real world. For example: - date of birth: issued by your government and equivalent to your birth certificate. - Occuppational credentials: issued by the relevant, government-authorized organization, like Engineers Australia or whatever. - Driver's License: issued by the traffic authority in your country/state. - Proof of Vaccination: this is interesting, as COVID showed... in my country, it was private organizations issuing that, but they had to be approve by the Government. The only credentials the big social media companies can issue for you just prove you have a certain handle with them, I guess... which could be used for a more secure "Sign in with Google/Apple/GitHub" for example. But nearly all interesting credentials would be issued by real-world authorities, IMHO.
  - Traubenfuchs 4y ago
    The government issues physical ids and might even issues a digital identity / verified credentials. But there are also private, non-governmental vendors that verify your physical ids and create verified credentials for you. In that case, the private DI vendor is the issuer of the verified credentials. The government might not be involved in anything besides providing the end user with a physical id. But yes indeed, private companies do not have much valuable credentials to offer. There just aren't that many categories of personal data you'd ever want to have in a wallet.
    - brabel 4y ago
      > But there are also private, non-governmental vendors that verify your physical ids and create verified credentials for you. In that case, the private DI vendor is the issuer of the verified credentials. But who's going to trust those vendors? This is the job of the government IMO, one of the few things you just can't rely on the private sector for. I definitely don't want my birth certificate credential tied to, say, Google :D the Government cannot , for example, remove my credentials because I said something polemic, while Google (and infamously Twitter) most definitely can and seem quite happy to do if they can.

dwaite 4y ago

I would expect the VC providers will be the issuing authorities - you won't get a digital driving license from Facebook, you'll get it from the DMV. Now they might not be running their own infrastructure, but they still have to be the one who authorized the credential to be minted. A faux digital National ID card issued from a random social network will likely not let you get access to government services or let you open a bank account, even if the data itself is all correct. It is more likely that you'll have "trust frameworks" describing technical and logistical interoperability, and verifiers will accept any issuer that falls under that umbrella. In the US with driving licenses and state identification cards for example, that would likely be AAMVA.

Traubenfuchs 4y ago
You might get your physical ids from the government, but private providers will verify them and create a digital-identity for you. Unless the government also wants to play the role of digital identity provider / VC provider.

Traubenfuchs 4y ago

You will have all your email, postal addresses, other PII and (formerly physical) identification documents in a wallet app. Government websites AND private websites will be able to request data from that wallet for login and registration purposes. You will need to approve all requests to your wallet, in the majority of cases by using biometrics (e.g. faceId or non-apple alternatives of it). This has the potential to eradicate several major avenues of fraud. The more of this is offered (for free) by governments the more it could majorly disrupt (=destroy) the industry around the topic. Worldwide it seems there is a new, proprietary wallet each month, which naturally totally ruins this idea of having one wallet, but I see what is currently going on as a "storming phase" or almost "norming phase" already, that will eventually reach the "performing phase", with one or two wallets being the survivors. A big stumbling block here is that everyone involved wants a piece of the cake. The European Union is actively (but slowly) working on this, e.g. with eIDAS. With eIDAS, you create a digital identity in your home country. If that home country DI offering supports eIDAS, you can use it to login to any other government AND private service implementing any DI offering that supports eIDAS. > whether identity providers / VC providers are going to be 5 big firms The big firms will provide the ecosystem (e.g. Microsoft Entra, mastercard-id-for-rp, ...), the real identity verification will happen through offerings like Onfido, Jumio and the 1000 other offerings in the space.

brabel 4y ago
Just to clarify something important, though... and I hope you agree with me on that: the VCs that matter will be issued by whoever is the authority that takes care of the subject matter... as it's always been the case in the real world. For example: - date of birth: issued by your government and equivalent to your birth certificate. - Occuppational credentials: issued by the relevant, government-authorized organization, like Engineers Australia or whatever. - Driver's License: issued by the traffic authority in your country/state. - Proof of Vaccination: this is interesting, as COVID showed... in my country, it was private organizations issuing that, but they had to be approve by the Government. The only credentials the big social media companies can issue for you just prove you have a certain handle with them, I guess... which could be used for a more secure "Sign in with Google/Apple/GitHub" for example. But nearly all interesting credentials would be issued by real-world authorities, IMHO.
- Traubenfuchs 4y ago
  The government issues physical ids and might even issues a digital identity / verified credentials. But there are also private, non-governmental vendors that verify your physical ids and create verified credentials for you. In that case, the private DI vendor is the issuer of the verified credentials. The government might not be involved in anything besides providing the end user with a physical id. But yes indeed, private companies do not have much valuable credentials to offer. There just aren't that many categories of personal data you'd ever want to have in a wallet.
  - brabel 4y ago
    > But there are also private, non-governmental vendors that verify your physical ids and create verified credentials for you. In that case, the private DI vendor is the issuer of the verified credentials. But who's going to trust those vendors? This is the job of the government IMO, one of the few things you just can't rely on the private sector for. I definitely don't want my birth certificate credential tied to, say, Google :D the Government cannot , for example, remove my credentials because I said something polemic, while Google (and infamously Twitter) most definitely can and seem quite happy to do if they can.