How do you link Verifiable Credentials to a human?
Verifiable Credentials are a brilliant standard to help... well... Verify Credentials. How do you know that someone has an MBA from Harvard? It's pretty easy to fake a degree certificate, or to change your name to George W. Bush, or simply lie. The same is true with any attestation - it's often hard to contact the issuer of a claim and check that it is genuine.
Verifiable Credentials aims to solve that. The standard describes a document which includes the claim (this person is an airline pilot), the person's identity (name, DOB, etc), the party making the claim (Name, ID, date of issuing), and a digital signature to tie it all together. (It is a lot more complicated than that, obviously.)
Let's take a look at the data inside COVID Vaccine "Passport". I've removed some of the metadata for simplicity, but you can read the full spec if you're interested.
JSON
{
"ver": "1.0.0",
"nam": {
"fn": "Smith",
"gn": "Jo",
},
"dob": "1984-02-29",
"t": [
{
"tg": "840539006",
"tt": "LP217198-3",
"tr": "260415000",
"ma": "1232",
"sc": "2021-04-13T14:20:00+00:00",
"dr": "2021-04-13T14:40:01+00:00",
"tc": "GGD Fryslân, L-Heliconweg",
"co": "NL",
"is": "Ministry of VWS",
"ci": "urn:uvci:01:NL:GGD/81AAH16AZ"
}
]
},
"YR/yMsyE3AOysWLCXuDc/Rlu507gH0/wgok+P8dxJtCwy0ydsIE2J5MeMxbynynU3n//zgOKSTB20FN0Fs1bgQ=="
It tells you the person's name, date of birth, when they had the vaccine, which vaccine it is, who administered it, some administrative codes, and then gives it a digital signature which can be verified without needing an Internet connection. Nifty!
The same is broadly true with academic qualifications. It lists your names, birthday, university, level obtained. Or your employment history can be encoded with your employment dates, salary, references.
So you can show the above - encoded as a QR code - to anyone. They can scan it and verify that it is authentic! AWESOME!
Except...
How do you prove that you're the person mentioned in the credential?
You could show your passport or driving licence at the same time. Assuming you can afford either of those documents. But that still leaves the same problem. How do you prove that the passport belongs to you? Perhaps you grabbed it at the same time you stole the certificate.
Humans are not very good at recognising faces from photos. So comparing the picture of me in my passport (young! clean shaven! well lit!) with the person in front of you (old and tired! beardy! under a street lamp!) is always going to be error prone.
This isn't a problem which can be solved by adding more digital signatures. Even if I co-signed the credential with my private key - you have no way of linking that key to a corporeal human being.
A Verifiable Credential could also contain a hash of biometric data like a fingerprint, for example. But that leads to further problems. Are people comfortable giving away their biometrics to lots of different organisations? Do verifiers want the extra expense of getting fingerprint readers? That might work for an airport, but is probably prohibitive for a café. You could use proxies - did I see this person unlock their phone to present the claim - but these are weak ties at best.
To be clear, this problem isn't limited to vaccine certificates. It applies to any Verifiable Credential. Whether it is an academic qualification, a health certificate, employment status, or any other claim.
This isn't something which can be solved by putting a claim on a blockchain (lolsob) - it is a fundamental limitation of the fact that humans don't come with built in, irrevocable, digital signatures.
| Reply to original comment on twitter.com
| Reply to original comment on twitter.com
| Reply to original comment on twitter.com
| Reply to original comment on twitter.com
| Reply to original comment on twitter.com
Chris Thorpe says:
@edent says:
Chris Thorpe says:
Pierre says:
It's a very niche problem but shows how reliant we are on scanning faces as a basic way of checking someone is who they say they are.
| Reply to original comment on twitter.com
| Reply to original comment on twitter.com
Edward says:
Yoti are trying to do this with scans of your existing id
@edent says:
Chris Thorpe says:
Verified credentials are just attributes of an identity. The verification merely adds provenance to those attributes. It’s not intended to prove your ID or entitlement to use the credentials.
Separate to that, there’s a need to authenticate the bearer of the identity. Strictly speaking, the authentication doesn’t prove they are who they say they are, it just proves they are entitled to grant access to their ID and particular attributes of it.
For example, in an age verification scenario, you really don’t need to know more about me than I have a trusted ID, and my age is over the threshold. Privacy law says you shouldn’t ask for data beyond what’s needed for the use case. A properly set up ID system should allow me to give consent for you to access the ID attributes you need, and no others - in a similar way to when an app asks to use mic, camera, etc.
I’m probably not explaining this well - it’s worth reading someone like David Birch of Consult Hyperion to get the real expert view on this. Suffice to say, it’s not easy but it’s doable
The problem is exclusion. We have two classes of users. One class is equipped with powerful devices that can deliver a rich mix of authentication factors: knowledge; possession: and inherence. The other class don’t have smartphones, and we need not to exclude them
@edent says:
I disagree with your final point, the majority of people in the UK have smartphones. Ofcom statistics show >90% penetration at all social classes and ages groups. If people don't want smartphones, that's fine, but the overwhelming majority of people have access to them.
Chris Thorpe says:
I’m well aware of the level of UK smartphone penetration, though not all are good enough for robust ID. My point there is, introducing an ID system that knowingly excludes at least 10% of the population is not a great idea.
Chris Thorpe says:
https://blog.dgwbirch.com/?p=1091
165 cases were traced back to this club night, which shouldn’t have happened considering people were asked to present a negative test on entry. There’s a suggestion some people might have swapped, shared, and exchanged QR codes to get in. So you had this situation where all the QR codes were valid and showed everyone was clear, but at least one person might have dodged identity verification. It’s an extreme example, but it shows that problem around proving that “the person carrying the device is the person who owns the device”.