Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Auth0 Verifiable Credentials

verifiablecredentials.dev

Post reply on HN
Print view View original

21–30 of 134 posts

Re: Auth0 Verifiable Credentials

#21

Post by woodruffw »

Alupis wrote: post #20
woodruffw wrote: post #17

I wonder what the benefits of this versus e.g. OpenID Connect[1] are: OIDC is already semi-widely adopted, reuses a popular underlying envelope scheme (JWTs), and performs a similar type of proof (that some identity provider claims something about an identity). [1]: https://openid.net/connect/

The biggest problem with OIDC is how non-standard every implementation is. I mean, there is a standard, but then there's what everyone actually does. Even within the standard, there is a very surprising amount of it that is... optional . Even discovery endpoints are non-standard... basics like `/.well-known/openid-configuration` is recommended but not required... and don't even try to guess where /userinfo lives! Cla…

I agree completely about OIDC's discovery limitations! If this standard can improve along that axis, then that alone will make it a valuable contribution to the identity space.

I also agree about standardized claim names, although I'll point out that standardizing something like `phone_verified` just pushed the identity/claim value question one level deeper: what does it mean for IdP A to have `phone_verified` versus IdP B? Do they have the same ontological value? That's part of why (IMO) "generalized" identity management has never succeeded: you can make everybody generate the same claims, but you can't assert that they've done a uniform or sufficient degree of diligence for those claims. The only way you can do the latter is to select "high quality" IdPs, at which point the consistency of the claim names no longer matters.

Re: Auth0 Verifiable Credentials

#22

Post by wyc »

CleverLikeAnOx wrote: post #2

This places all the trust in the institution that mints verifiable credentials. (or the institution + Auth0 if they use Auth0). This is good for use cases where you want to assert that an organization says something about you (e.g., you have a degree). It is not good for use cases where you want to assert that you say something (e.g., I voted for Blah, or I authorized this transfer).

Anyone with a keypair can issue verifiable credentials, and we work on making this simple[0], starting with developers. However, the ultimate challenge will be to be able to associate that keypair to the entity (or abstracted entity) who is making those statements, which is what Web of Trust tried to do, and there are some adjacent efforts to revitalize SPKI-style[1] trust models that are being discussed at RWoT[2].

[0] https://www.spruceid.dev/quickstart

[1] https://en.wikipedia.org/wiki/Simple_public-key_infrastructu...

[2] https://github.com/WebOfTrustInfo/rwot11-the-hague

Re: Auth0 Verifiable Credentials

#24

Post by cassonmars »

I love that verifiable credentials are starting to make mainstream, but one thing I couldn’t glean from this page: is this purely VC from a perspective of “here’s the attributes I care to see”, or “here’s the characteristics I care to see”? To clarify: say I’m an alcohol vendor and wish to confirm that a user is 21 or older. Does the VC issuance provide a range proof that does not reveal the age, or does the VC issuance explicitly reveal the age?

Re: Auth0 Verifiable Credentials

#26

Post by Avamander »

Traubenfuchs wrote: post #18
paxys wrote: post #12

The only thing the web identity ecosystem needs is another independent standard – said no one ever. JWT is already a thing, as is X.509, OAuth/OpenID, WebAuthn... Just use a combination of these that best fits your use case. "But this new standard will be the true unifying one". Nope, it will not. The most it will do is get some share of usage and add to the chaos.

Offerings in the SSI/VD space are currently exploding -some even government backed. Microsoft, MasterCard, Auth0, the European Union are the biggest players that come to my mind. This will turn the whole billion dollar kyc/identity verification space upside down. I work in that space.

Feels like reinventing the past, looking at what people have done with just x509/PKI in multiple European countries. Though that's not to say there aren't a few fun ideas in there, it just seems much less mature with many mistakes repeated.

Re: Auth0 Verifiable Credentials

#27

Post by NovemberWhiskey »

cassonmars wrote: post #24

I love that verifiable credentials are starting to make mainstream, but one thing I couldn’t glean from this page: is this purely VC from a perspective of “here’s the attributes I care to see”, or “here’s the characteristics I care to see”? To clarify: say I’m an alcohol vendor and wish to confirm that a user is 21 or older. Does the VC issuance provide a range proof that does not reveal the age, or does the VC issua…

You could issue the credential with an "ageOver" property set to 21; use of abstract claims like that is actually a non-normative preference in the W3C standard.

https://www.w3.org/TR/vc-data-model/#favor-abstract-claims

Re: Auth0 Verifiable Credentials

#30

Post by Alupis »

tomjen3 wrote: post #9
CleverLikeAnOx wrote: post #5

Earlier quoted context omitted.

Agreed! I think this is the start of something that will be big in a decade as adoption goes up.

Anonymous verification of age is a nice one: Site a generates a bit of bytes, you then take that to a government portal, login and get it signed, then you return with the signature and now the site knows nothing whatsoever about you, other than that you could get a government site to assert that you are old enough to order beer online. The government site doesn't have to know anything about you either, other than you…

> The government site doesn't have to know anything about you either, other than you requested a beer token.

That's the 7th beer token you've requested this week, citizen. For your own good, we've denied your request.

Post reply on HN