3 ms·
Yep,proof of possession - the ID contains a public key, you own the matching private key. You send them the ID with a matching assertion ("This is meant for che
by hirsin 4y ago
Yep,proof of possession - the ID contains a public key, you own the matching private key. You send them the ID with a matching assertion ("This is meant for cheapboozeforstudents.com"), signed by your private key. The website can't in turn generate an assertion for statestudentaid.gov because the whole envelope (ID, assertion, signature) is uniquely tied to them.
It does rely on statestudentaid.gov actually validating said assertion, of course, but that's only like... The second most common screw up with JWTs and related tokens.
- jameshart 4y agoAnd... cheapboozeforstudents can't fool me into generating an assertion for statestudentaid.gov by showing me statestudentaid.gov's presentation request? But yeah, the issue here is that when you present your student ID to anyone, you are relying to some extent on every single other service that accepts student ID to be validating the audience assertion. That's not a great trust model.
- NovemberWhiskey 4y agoThe verifiable presentation is not just the credential; it should be signed by the holder, and that can include a 'domain' to specify the intended recipient and a challenge token to guard against replay. https://www.w3.org/TR/vc-data-model/#concrete-lifecycle-example https://www.w3.org/TR/vc-data-model/#concrete-lifecycle-exam... It's always contingent on the recipient of an identity proof to verify that it's valid; I'm not sure I understand the criticism to be honest.
- nileshtrivedi 4y agoThere's also the possibility that cheapboozeforstudents and statestudentaid.gov are colluding - either directly or because of corrupt employees - against the ID holder. We have seen examples where banks issued loans in user's name against fake IDs/applications.
- yazzku 4y agoYou (client) wouldn't accept a statestudentaid.gov presentation request coming from cheapboozeforstudents.com.