Verifiable Credentials aims to solve that. The standard describes a document which includes the claim (this person is an airline pilot), the person's identity (name, DOB, etc), the party making the claim (Name, ID, date of issuing), and a digital signature to tie it all together. (It is a lot more complicated than that, obviously.)

Let's take a look at the data inside COVID Vaccine "Passport". I've removed some of the metadata for simplicity, but you can read the full spec if you're interested.

   {
   "ver": "1.0.0",
   "nam": {
     "fn": "Smith",
     "gn": "Jo",
   },
   "dob": "1984-02-29",
   "t": [
     {
       "tg": "840539006",
       "tt": "LP217198-3",
       "tr": "260415000",
       "ma": "1232",
       "sc": "2021-04-13T14:20:00+00:00",
       "dr": "2021-04-13T14:40:01+00:00",
       "tc": "GGD Fryslân, L-Heliconweg",
       "co": "NL",
       "is": "Ministry of VWS",
       "ci": "urn:uvci:01:NL:GGD/81AAH16AZ"
     }
   ]
},
"YR/yMsyE3AOysWLCXuDc/Rlu507gH0/wgok+P8dxJtCwy0ydsIE2J5MeMxbynynU3n//zgOKSTB20FN0Fs1bgQ=="

It tells you the person's name, date of birth, when they had the vaccine, which vaccine it is, who administered it, some administrative codes, and then gives it a digital signature which can be verified without needing an Internet connection. Nifty!

The same is broadly true with academic qualifications. It lists your names, birthday, university, level obtained. Or your employment history can be encoded with your employment dates, salary, references.

So you can show the above - encoded as a QR code - to anyone. They can scan it and verify that it is authentic! AWESOME!

Except...

How do you prove that you're the person mentioned in the credential?

You could show your passport or driving licence at the same time. Assuming you can afford either of those documents. But that still leaves the same problem. How do you prove that the passport belongs to you? Perhaps you grabbed it at the same time you stole the certificate.

Humans are not very good at recognising faces from photos. So comparing the picture of me in my passport (young! clean shaven! well lit!) with the person in front of you (old and tired! beardy! under a street lamp!) is always going to be error prone.

This isn't a problem which can be solved by adding more digital signatures. Even if I co-signed the credential with my private key - you have no way of linking that key to a corporeal human being.

A Verifiable Credential could also contain a hash of biometric data like a fingerprint, for example. But that leads to further problems. Are people comfortable giving away their biometrics to lots of different organisations? Do verifiers want the extra expense of getting fingerprint readers? That might work for an airport, but is probably prohibitive for a café. You could use proxies - did I see this person unlock their phone to present the claim - but these are weak ties at best.

To be clear, this problem isn't limited to vaccine certificates. It applies to any Verifiable Credential. Whether it is an academic qualification, a health certificate, employment status, or any other claim.

This isn't something which can be solved by putting a claim on a blockchain (lolsob) - it is a fundamental limitation of the fact that humans don't come with built in, irrevocable, digital signatures.

I've had to manually change it on a dozen different Slacks, a bunch of social networks, a few forums, all my email accounts, and I'm still not done.

I just want to change my photo once. Because I'm vain and lazy.

For a nerd like me, the solution is obvious:

• My latest avatar image has a permanent web address - https://edent.tel/avatar.
• When I register for a service, it should ask me for my homepage address and automatically detect the URl for my avatar.
• Periodically, it should check for an update.

What about Gravatar?

The Globally Recognised Avatar project from WordPress is supposed to be a solution to this problem. But it doesn't work, for two main reasons.

1. Not everywhere uses it.
2. Works on a per-email basis.

Nothing we can do about (1), but I find (2) is annoying. I use a different email address for each website I use. Which means I have dozens of Gravatars!

Because Gravatar uses MD5 hashes, there's no way around this. It's also a (minor) privacy concern.

What about Libravatar?

The Libravatar project is basically an open source version of Gravatar. It also uses hashes for email addresses. And, sadly, very few sites use it.

What about Webfinger?

The documentation for Webfinger is comically absent.

What about Microformats?

Standards like microformats2 let you add an image to your profile.

Similarly, Schema.org an add an image to your personal metadata.

Social Networking Sites

This sort of exists. Services like Avatars.io let you use you Twitter & Facebook avatars as a URl - for example avatars.io/twitter/edent.

Sadly, the service isn't maintained any more, has broken images for Instagram, and doesn't include newer services like GitHub.

Regain Control

There are two fundamental mistakes we're making.

• An email address is not an identity.
• A 3rd party service is not an identity.

Given that Gravatar is promoted by WordPress - the largest website provider on the planet - and it still isn't universally accepted, I don't think there's any hope for smaller services.

So, I guess what I need is an app which can log in to all my accounts and automatically change the avatar whenever I want.

Or is there some other practical action I can take?

People don't own mobile phone numbers. They are rented from mobile operators. Yes, you may be able to move "your" number between a limited set of providers - but it ultimately doesn't belong to you. An operator can unilaterally take your number away from you.

If you move to a different country, you will almost certainly have to change your number - thus invalidating any account which relies on a mobile being your primary identifier.

That's before we get on to how hideously insecure phone numbers are. Transmitting an SMS with a sensitive one-time code over a cleartext which can be easily intercepted is not a sensible approach to security. Modern phone networks are designed to accommodate Lawful Intercept - and suffer from a range of security weaknesses.

Fine. Whatever. Let's use emails as our primary ID. Bzzzt! Wrong! Email addresses are just as ephemeral as mobile numbers.

If you use a service like Gmail, Yahoo, or Hotmail, then you're at the mercy of those providers. They can revoke your access at any time. They can give away your cherished address. And, like phones, they can be legally compelled to give access to certain 3rd parties.

Social Media IDs are equally rubbish. Your presence on Twitter or Facebook is little more than virtual sharecropping. You don't own or control your ID. If the provider goes bust, you've lost the ability to identify yourself.

OK, here's an answer! What if I run my own domain? Then I'll be in control of my identity. And my email as well!

No. Not really. Your domain is only temporarily leased from your registrar. Perhaps you forget to renew your domain. Or renewal prices will jump and you can't afford your "home" any more. Perhaps a global corporation insists that they alone have the right to use your name and take you to court. That kills off the ability to use something like IndieAuth.

Umm... How about IP addresses? Again, for most people these are leased from ISPs and are dynamic. Even with a switch to IPv6, there's no way to own an address permanently and move it between ISPs.

I want an online identity which is immune from 3rd parties to take back. Something unaffected by Eminent Domain. That - no matter the social and technological changes of the Internet - will remain valid throughout my lifetime.

Let's craft a problem statement

As a user, I want to have an identifier on the Internet which can only be revoked by me.

(That's not a perfect story, of course. It says nothing about security, access rights, or usability. But it is a simple starting point.)

Does such an identifier exist today?

Something like a Public/Private keypair is almost right. Ignoring the many usability issues with things like PGP, it is conceivable that you could authenticate yourself to a service by cryptographically signing a challenge they send you which is then verified against your public key.

This is more-or-less how FIDO UAF works. You generate and store your keypair on a piece of cryptographic hardware and use that for authentication and identification.

But there is a more fundamental flaw - a keypair doesn't provide a method for delivering a message or a service.

At the moment there's no way to say

• "Visit my website at impossibly long cryptographic string" or
• "Give me a call at ..." or
• "Let's exchange data via ..."

OK, I can add multiple email addresses to a PGP key and hope that all the major email providers don't go bust, or sell me out.

I'm sure there are hacks which will turn 000D05F640557C62 into a DNS entry for a website. But that still falls back on requiring an existing domain name. Which can be taken away from you.

(As an aside, if you're an intergovernmental agency registered by an international treaty, you can apply for a .int domain. That's probably harder for someone to unilaterally revoke.)

The Internet, so we are told, routes around damage. But where does it route to?

I don't have an answer to this. It seems like a fundamental design flaw with existing Internet infrastructure. How can I carve out a permanent home here?

Mydex provides the individual with a hyper-secure storage area to enable them to manage their personal data, including text, numbers, images, video, certificates and sound. No-one but the individual can access or see the data.

Not just secure, but hyper-secure! They've been signed up by the UK Government to provide Identity Assurance. Pretty impressive, eh?

Let's ignore the fact that their website doesn't use SSL and concentrate on the XSS flaw on the site.

Cross-Site-Scripting (XSS) is, in simple terms, a way to force a web page to run some malicious code against the wishes of its owner. Let's take a look at a simple example:

By searching for

<em>test

We can force the page to display in italics.

This is because the search box's input isn't sanitised. You can put whatever you want in there and the web page will display it. For example, if you paste in the HTML code to display a photo, then this happens:

Ok - so that's a bit annoying, but nothing too bad. So, what happens if we try to inject JavaScript into the page? Aha! Now we can run arbitrary code on this website. In fact, we can completely take it over. Using JavaScript we can tell the page to redirect to some other website, we can switch on the user's microphone and camera - all sorts of naughty tricks.

To Mydex's credit, a few minutes after reporting the flaw it was fixed.

There's absolutely no suggestion that any user's personal data was at risk here. I would consider it extremely unlikely that anything entered into that search field could have caused an SQL injection attack.

Mydex also operates a strict separation of their "publicity" site and their Personal Data Service - which really does seem very secure.

It would, however, have been very easy for a scammer to set up a JavaScript redirection to a phishing site in order to trick a user into entering her personal details. Similarly, an attacker could have sent Mydex staff a link saying "Please reset your admin password - click here" and been granted the keys to the kingdom.

The Open Web Application Security Project list their top ten most critical web security risks facing organizations. XSS is number 3.

If you're running a website - especially one which deals in security - please take the time to read over the list and understand how to protect your business and your users.

Timeline

• January 23rd - Reported and fixed.
• February 5th - Publication agreed.