4 ms·

"Self-sovereign identity" is an oxymoron. "Self-sovereign" means each individual is their own identity provider. "Identities" must be uniquely identifiable, o

"Self-sovereign identity" is an oxymoron. "Self-sovereign" means each individual is their own identity provider. "Identities" must be uniquely identifiable, otherwise... they're not identities, they're just bits of data. Practically, that means there must be a centrally-managed namespace of identities that is tightly regulated, ACID-compliant, etc. Federation is practical here, but it will all tie back to the central entity (e.g. government).

vineyardmike 4y ago
PKI can be both self-sovereign and unique. Look at crypto currencies- wallets are uniquely yours and also free from a central identity provider (since you only need the private key). You don’t need a blockchain. Self-signed certs are enough for people to auth their candy crush accounts.
- Pxtl 4y ago
  They fail the uniqueness test. I can create as many self-signed certs and wallets as I like, allowing me infinite sockpuppets. That's not an identity.
  - gnramires 4y ago
    I think you're conflating two things. Creating infinite identities is known as the sybil problem is cybersecurity, or sybil attacks. Indeed you need a way to verify identity in the real world with trusted parties to defeat this. (In my interpretation 'uniquely identifiable' should be satisfied by your unique ability to sign data -- actions, statements, etc. associated with that key. there's a problem of making the identity itself human readable, which essentially needs a name system on top) That said, I think the government de facto already has many useful functions around identity verification, I think making it more accessible, modern and useful is a good idea. Also with good design practices of digital systems, we can also make things more transparent, auditable, etc.. The downside I would say is the possibility of some kind of catastrophic breach or denial of service event having a large impact (any of our usual web services are subject to that though), and having a fallback offline infrastructure should be worthwhile.
  - vineyardmike 4y ago
    Yet despite that, only one of those certs will work for my account. In fact, it's better for me - I can create a different cert for each service and I can't be tracked.
    - bryan_w 4y ago
      That sounds like a username/password with extra steps
pfoof 4y ago
Fingerprint + iris scan + vein scan
dcow 4y ago
Philosophically, identity is not "a centrally-managed namespace of identities that is tightly regulated, ACID-compliant, etc.". The government or a bank or airport or certain business might want that level of book-keeping and verification, but that's not inherent to identity. Identity is self-sovereign. I think, therefore I am. When I go get a drivers license, I'm issued a physical "certificate" by my local government that says I qualify to drive a motor vehicle. It has some useful properties like being hard to counterfeit. A drivers license is not my identity. It's a document that asserts claims about my identity like "I passed a test", "I showed up in person", "I have a utility bill for this address", etc. Meatspace identity is self-sovereign but also sometimes assertions about an identity are made are verified. All of this is possible with a self-sovereign digital identity system. It's how the CA system works. I make an identity, I get it certified for a short period of time. The CA issues me a digital certificate with useful properties like being hard to counterfeit. It's a document that asserts claims e.g. "I manage this domain". CA system is self-sovereign and also sometimes you verify the authenticity of my certificate. But the signature on my certificate is not a stable identifier. That's my public key. The pubkey is the identity. The certificate authority just issues and signs a document vouching for it. So the appropriate digital analog to the present day identity system is one where we create keypairs and then sign assertions about their owners. The thing you're looking for is a modern social security office that looks at your birth certificate, requires you to digitally sign your name, and then issues an assertion along the lines of "a human in possession of this birth certificate showed up before me, a truthful government agent, an signed their name like so". And thus, you have bound some human assertion to a pubkey. (And if your use case cares about a country-unique birth-certificate verified human, then you require the pubkey owner present you the certificate and you verify it.) Or maybe you're looking for a novel digital email verification service that verifies a given pubkey controls a specific inbox. The email verification service periodically sends you a secret via email, you sign the secret and reply, and in response the service issues you a certificate stating that your pubkey is associated with and in control of the email address it just verified. You re-verify every 3 months. In fact, your email client automatically does it for you as you login via webauthn every so often. Just like I can wear a mask, have a twin, have my license stolen, copy the data on my license, or use someone else's drivers license in places that don't care about the picture or credit cards in places that don't check the signature, the same can happen with a private key. Identity is not as sophisticated as you are making it out to be.

vineyardmike 4y ago

PKI can be both self-sovereign and unique. Look at crypto currencies- wallets are uniquely yours and also free from a central identity provider (since you only need the private key). You don’t need a blockchain. Self-signed certs are enough for people to auth their candy crush accounts.

Pxtl 4y ago
They fail the uniqueness test. I can create as many self-signed certs and wallets as I like, allowing me infinite sockpuppets. That's not an identity.
- gnramires 4y ago
  I think you're conflating two things. Creating infinite identities is known as the sybil problem is cybersecurity, or sybil attacks. Indeed you need a way to verify identity in the real world with trusted parties to defeat this. (In my interpretation 'uniquely identifiable' should be satisfied by your unique ability to sign data -- actions, statements, etc. associated with that key. there's a problem of making the identity itself human readable, which essentially needs a name system on top) That said, I think the government de facto already has many useful functions around identity verification, I think making it more accessible, modern and useful is a good idea. Also with good design practices of digital systems, we can also make things more transparent, auditable, etc.. The downside I would say is the possibility of some kind of catastrophic breach or denial of service event having a large impact (any of our usual web services are subject to that though), and having a fallback offline infrastructure should be worthwhile.
- vineyardmike 4y ago
  Yet despite that, only one of those certs will work for my account. In fact, it's better for me - I can create a different cert for each service and I can't be tracked.
  - bryan_w 4y ago
    That sounds like a username/password with extra steps

pfoof 4y ago

Fingerprint + iris scan + vein scan

dcow 4y ago

Philosophically, identity is not "a centrally-managed namespace of identities that is tightly regulated, ACID-compliant, etc.". The government or a bank or airport or certain business might want that level of book-keeping and verification, but that's not inherent to identity. Identity is self-sovereign. I think, therefore I am. When I go get a drivers license, I'm issued a physical "certificate" by my local government that says I qualify to drive a motor vehicle. It has some useful properties like being hard to counterfeit. A drivers license is not my identity. It's a document that asserts claims about my identity like "I passed a test", "I showed up in person", "I have a utility bill for this address", etc. Meatspace identity is self-sovereign but also sometimes assertions about an identity are made are verified. All of this is possible with a self-sovereign digital identity system. It's how the CA system works. I make an identity, I get it certified for a short period of time. The CA issues me a digital certificate with useful properties like being hard to counterfeit. It's a document that asserts claims e.g. "I manage this domain". CA system is self-sovereign and also sometimes you verify the authenticity of my certificate. But the signature on my certificate is not a stable identifier. That's my public key. The pubkey is the identity. The certificate authority just issues and signs a document vouching for it. So the appropriate digital analog to the present day identity system is one where we create keypairs and then sign assertions about their owners. The thing you're looking for is a modern social security office that looks at your birth certificate, requires you to digitally sign your name, and then issues an assertion along the lines of "a human in possession of this birth certificate showed up before me, a truthful government agent, an signed their name like so". And thus, you have bound some human assertion to a pubkey. (And if your use case cares about a country-unique birth-certificate verified human, then you require the pubkey owner present you the certificate and you verify it.) Or maybe you're looking for a novel digital email verification service that verifies a given pubkey controls a specific inbox. The email verification service periodically sends you a secret via email, you sign the secret and reply, and in response the service issues you a certificate stating that your pubkey is associated with and in control of the email address it just verified. You re-verify every 3 months. In fact, your email client automatically does it for you as you login via webauthn every so often. Just like I can wear a mask, have a twin, have my license stolen, copy the data on my license, or use someone else's drivers license in places that don't care about the picture or credit cards in places that don't check the signature, the same can happen with a private key. Identity is not as sophisticated as you are making it out to be.