Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Auth0 Verifiable Credentials

verifiablecredentials.dev

Post reply on HN
Print view View original

41–50 of 134 posts

Re: Auth0 Verifiable Credentials

#41

Post by NovemberWhiskey »

Natfan wrote: post #40
NovemberWhiskey wrote: post #27

Earlier quoted context omitted.

You could issue the credential with an "ageOver" property set to 21; use of abstract claims like that is actually a non-normative preference in the W3C standard. https://www.w3.org/TR/vc-data-model/#favor-abstract-claims

Surely you'd store their birthdate (or maybe birth year and month for privacy reasons). Then you only allow people who you know are older than 21, those born before (not in) 2001-11 (based on currentYear of 2022). With the magic of modern JavaScript, this shouldn't be too hard: let birthday = "1998-08" # This value is taken from the user's verified credentials, in my case September 1998. let ageRestriction = 21 let l…

Who is the "you" in this? The party that knows the truth of your personal data isn't the same party that you want to rely on your personal data.

The idea here is, say, the DMV in your state knows your age. But you don't want to show your driver's license credential which includes your home address and exact birthdate at a bar, because it's not their need-to-know.

So you can ask the DMV to issue you with a "drinker's permit" which only has your photo and ageOver=21. A bar just validates you match your picture and knows you're of legal drinking age.

Re: Auth0 Verifiable Credentials

#42

Post by boosteri »

Natfan wrote: post #40
NovemberWhiskey wrote: post #27

Earlier quoted context omitted.

You could issue the credential with an "ageOver" property set to 21; use of abstract claims like that is actually a non-normative preference in the W3C standard. https://www.w3.org/TR/vc-data-model/#favor-abstract-claims

Surely you'd store their birthdate (or maybe birth year and month for privacy reasons). Then you only allow people who you know are older than 21, those born before (not in) 2001-11 (based on currentYear of 2022). With the magic of modern JavaScript, this shouldn't be too hard: let birthday = "1998-08" # This value is taken from the user's verified credentials, in my case September 1998. let ageRestriction = 21 let l…

Genuinely interested what calendar you're using where 08 represents September?

Re: Auth0 Verifiable Credentials

#43

Post by jameshart »

NovemberWhiskey wrote: post #31
jameshart wrote: post #29

Can't immediately grasp how this avoids a MITM attack at the 'verifiable presentation' stage. Am I missing something?

That's a transport problem - you would use TLS.

So, I go to cheapboozeforstudents.com, to buy some cheap booze, and they ask me to show my student ID to qualify for the cheap booze.

I'm using TLS to ensure that I share the 'verifiable presentation' of my ID securely with, as I expected, cheapboozeforstudents.com.

But what's to stop that website from taking my student ID and showing it to statestudentaid.gov as proof that they're a student, allowing them to apply for a tuition grant in my name?

Is there a part where I put into my verifiable presentation that I am signing it because I believe I'm showing it to cheapboozeforstudents.com? So that if they try to pass that VP on to statestudentaid.gov the ID will be rejected?

Re: Auth0 Verifiable Credentials

#44

Post by mmarti »

boosteri wrote: post #42
Natfan wrote: post #40

Earlier quoted context omitted.

Surely you'd store their birthdate (or maybe birth year and month for privacy reasons). Then you only allow people who you know are older than 21, those born before (not in) 2001-11 (based on currentYear of 2022). With the magic of modern JavaScript, this shouldn't be too hard: let birthday = "1998-08" # This value is taken from the user's verified credentials, in my case September 1998. let ageRestriction = 21 let l…

Genuinely interested what calendar you're using where 08 represents September?

Ignoring the specific example given, JavaScript Date objects use zero-based months depending on how you construct or interact with them, so I'm assuming the OP was thinking of a zero-based example and just wrote it out using 08 in the string.

Re: Auth0 Verifiable Credentials

#45

Post by naikrovek »

boosteri wrote: post #42
Natfan wrote: post #40

Earlier quoted context omitted.

Surely you'd store their birthdate (or maybe birth year and month for privacy reasons). Then you only allow people who you know are older than 21, those born before (not in) 2001-11 (based on currentYear of 2022). With the magic of modern JavaScript, this shouldn't be too hard: let birthday = "1998-08" # This value is taken from the user's verified credentials, in my case September 1998. let ageRestriction = 21 let l…

Genuinely interested what calendar you're using where 08 represents September?

months sometimes start at zero in programming languages. days of the week, as well, often.

Re: Auth0 Verifiable Credentials

#46

Post by hirsin »

jameshart wrote: post #43
NovemberWhiskey wrote: post #31

Earlier quoted context omitted.

That's a transport problem - you would use TLS.

So, I go to cheapboozeforstudents.com, to buy some cheap booze, and they ask me to show my student ID to qualify for the cheap booze. I'm using TLS to ensure that I share the 'verifiable presentation' of my ID securely with, as I expected, cheapboozeforstudents.com. But what's to stop that website from taking my student ID and showing it to statestudentaid.gov as proof that they're a student, allowing them to apply f…

Yep,proof of possession - the ID contains a public key, you own the matching private key. You send them the ID with a matching assertion ("This is meant for cheapboozeforstudents.com"), signed by your private key. The website can't in turn generate an assertion for statestudentaid.gov because the whole envelope (ID, assertion, signature) is uniquely tied to them.

It does rely on statestudentaid.gov actually validating said assertion, of course, but that's only like... The second most common screw up with JWTs and related tokens.

Re: Auth0 Verifiable Credentials

#47

Post by hirsin »

dudebod wrote: post #28

Im interested to know why opt for basic asymmetric cryptography (is this like a ECDSA scheme?) when there are so many advances in zero knowledge proofs to allow for queryable data?

It's tricky when the whole chunk of data is only signed over once by your issuer - you can't go back to the government for a new token every time you want to give out your first name instead of first and last name.

This is where SD-jwt comes in - https://datatracker.ietf.org/doc/draft-fett-oauth-selective-..., which selectively offers pieces from that once-signed chunk of data.

Re: Auth0 Verifiable Credentials

#48

Post by NovemberWhiskey »

jameshart wrote: post #43
NovemberWhiskey wrote: post #31

Earlier quoted context omitted.

That's a transport problem - you would use TLS.

So, I go to cheapboozeforstudents.com, to buy some cheap booze, and they ask me to show my student ID to qualify for the cheap booze. I'm using TLS to ensure that I share the 'verifiable presentation' of my ID securely with, as I expected, cheapboozeforstudents.com. But what's to stop that website from taking my student ID and showing it to statestudentaid.gov as proof that they're a student, allowing them to apply f…

e.g. token binding.

https://www.w3.org/TR/vc-data-model/#token-binding

Re: Auth0 Verifiable Credentials

#49

Post by jameshart »

hirsin wrote: post #46
jameshart wrote: post #43

Earlier quoted context omitted.

So, I go to cheapboozeforstudents.com, to buy some cheap booze, and they ask me to show my student ID to qualify for the cheap booze. I'm using TLS to ensure that I share the 'verifiable presentation' of my ID securely with, as I expected, cheapboozeforstudents.com. But what's to stop that website from taking my student ID and showing it to statestudentaid.gov as proof that they're a student, allowing them to apply f…

Yep,proof of possession - the ID contains a public key, you own the matching private key. You send them the ID with a matching assertion ("This is meant for cheapboozeforstudents.com"), signed by your private key. The website can't in turn generate an assertion for statestudentaid.gov because the whole envelope (ID, assertion, signature) is uniquely tied to them. It does rely on statestudentaid.gov actually validatin…

And... cheapboozeforstudents can't fool me into generating an assertion for statestudentaid.gov by showing me statestudentaid.gov's presentation request?

But yeah, the issue here is that when you present your student ID to anyone, you are relying to some extent on every single other service that accepts student ID to be validating the audience assertion. That's not a great trust model.

Re: Auth0 Verifiable Credentials

#50

Post by [deleted] »

boosteri wrote: post #42
Natfan wrote: post #40

Earlier quoted context omitted.

Surely you'd store their birthdate (or maybe birth year and month for privacy reasons). Then you only allow people who you know are older than 21, those born before (not in) 2001-11 (based on currentYear of 2022). With the magic of modern JavaScript, this shouldn't be too hard: let birthday = "1998-08" # This value is taken from the user's verified credentials, in my case September 1998. let ageRestriction = 21 let l…

Genuinely interested what calendar you're using where 08 represents September?

[deleted]
Post reply on HN