2 ms·
And... cheapboozeforstudents can't fool me into generating an assertion for statestudentaid.gov by showing me statestudentaid.gov's presentation request? But y
by jameshart 4y ago
And... cheapboozeforstudents can't fool me into generating an assertion for statestudentaid.gov by showing me statestudentaid.gov's presentation request?
But yeah, the issue here is that when you present your student ID to anyone, you are relying to some extent on every single other service that accepts student ID to be validating the audience assertion. That's not a great trust model.
- NovemberWhiskey 4y agoThe verifiable presentation is not just the credential; it should be signed by the holder, and that can include a 'domain' to specify the intended recipient and a challenge token to guard against replay. https://www.w3.org/TR/vc-data-model/#concrete-lifecycle-example https://www.w3.org/TR/vc-data-model/#concrete-lifecycle-exam... It's always contingent on the recipient of an identity proof to verify that it's valid; I'm not sure I understand the criticism to be honest.
- nileshtrivedi 4y agoThere's also the possibility that cheapboozeforstudents and statestudentaid.gov are colluding - either directly or because of corrupt employees - against the ID holder. We have seen examples where banks issued loans in user's name against fake IDs/applications.
- yazzku 4y agoYou (client) wouldn't accept a statestudentaid.gov presentation request coming from cheapboozeforstudents.com.