3 ms·
So then you're just back to the even more basic problem of "is the person using this device the same person that the payload was signed on behalf of?"
by danaris 11mo ago
So then you're just back to the even more basic problem of "is the person using this device the same person that the payload was signed on behalf of?"
- mariusor 11mo agoYep. But in my mind that's being mitigated by the real measure for identity proof, which is some type of electronic ids.
- danaris 11mo agoWhich a) has a whole host of other concerns associated with it, and b) still does not solve that problem, because it's not at all hard for a child (especially a teenager!) to sneak their parent's ID, use it to authenticate for a service, then put it back. After all, are most services going to require the ID to be present for every session? Or are they going to require a one-time authentication for the account?