Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Auth0 Verifiable Credentials

verifiablecredentials.dev

Post reply on HN
Print view View original

51–60 of 134 posts

Re: Auth0 Verifiable Credentials

#51

Post by Spooky23 »

CleverLikeAnOx wrote: post #2

This places all the trust in the institution that mints verifiable credentials. (or the institution + Auth0 if they use Auth0). This is good for use cases where you want to assert that an organization says something about you (e.g., you have a degree). It is not good for use cases where you want to assert that you say something (e.g., I voted for Blah, or I authorized this transfer).

You can do that by having consortiums of trusted parties. California, New York and Walmart were pioneers in this space for vaccination credentials. (SMART health cards)

If you lived in a crazy state like Florida, vaccinating at Walmart was the best way to get a credential for international travel. In the absence of federal action, countries like Israel recognized these credentials and airlines incorporated them into their ticketing workflow.

Re: Auth0 Verifiable Credentials

#52

Post by siliconc0w »

It'd be nice if you could just assert facts on a verifiable credential without giving over all the information, like I want to request from my bank that they assert I have regular income > $x/mo or a savings account with at least $y. Not like financial institutions will actually adopt this unless they're forced to by regulation but I basically want to give people exactly enough to provide the service requested and no more.

Re: Auth0 Verifiable Credentials

#53

Post by lxgr »

encryptluks2 wrote: post #13
Aeolun wrote: post #8

Isn’t this just Json Web Tokens with a different name? (and an extra step to create a VP, presumably so the expiry on the VC can be longer).

It appears to be similar to regular public/private key encryption but with a fancy name to make it seem unique.

It seems at least one layer above public/private key encryption.

Re: Auth0 Verifiable Credentials

#54

Post by lxgr »

jameshart wrote: post #43
NovemberWhiskey wrote: post #31

Earlier quoted context omitted.

That's a transport problem - you would use TLS.

So, I go to cheapboozeforstudents.com, to buy some cheap booze, and they ask me to show my student ID to qualify for the cheap booze. I'm using TLS to ensure that I share the 'verifiable presentation' of my ID securely with, as I expected, cheapboozeforstudents.com. But what's to stop that website from taking my student ID and showing it to statestudentaid.gov as proof that they're a student, allowing them to apply f…

Digitally verifiable statements are usually of the form "z attests that x is a y", not "whoever presents this statement is x".

For digital ID, such a statement could be "only person Foo Bar knows the private key that corresponds to this public key, and they use that one for verifying their age, but not for voting or opening new bank accounts".

I do see the UX concern, though: The European digital Covid certificate works in exactly this way ("Foo Bar is fully vaccinated against Covid as of April 1st"), making no claim of the form "the person showing you this QR code is Foo Bar" or "the person presenting this code is vaccinated" – yet this is how it was and is unfortunately still often used.

Re: Auth0 Verifiable Credentials

#55

Post by coolestguy »

siliconc0w wrote: post #52

It'd be nice if you could just assert facts on a verifiable credential without giving over all the information, like I want to request from my bank that they assert I have regular income > $x/mo or a savings account with at least $y. Not like financial institutions will actually adopt this unless they're forced to by regulation but I basically want to give people exactly enough to provide the service requested and no…

https://blockheadtechnologies.com/zero-knowledge-proofs-a-po...

Re: Auth0 Verifiable Credentials

#56

Post by NovemberWhiskey »

jameshart wrote: post #49
hirsin wrote: post #46

Earlier quoted context omitted.

Yep,proof of possession - the ID contains a public key, you own the matching private key. You send them the ID with a matching assertion ("This is meant for cheapboozeforstudents.com"), signed by your private key. The website can't in turn generate an assertion for statestudentaid.gov because the whole envelope (ID, assertion, signature) is uniquely tied to them. It does rely on statestudentaid.gov actually validatin…

And... cheapboozeforstudents can't fool me into generating an assertion for statestudentaid.gov by showing me statestudentaid.gov's presentation request? But yeah, the issue here is that when you present your student ID to anyone, you are relying to some extent on every single other service that accepts student ID to be validating the audience assertion. That's not a great trust model.

The verifiable presentation is not just the credential; it should be signed by the holder, and that can include a 'domain' to specify the intended recipient and a challenge token to guard against replay.

https://www.w3.org/TR/vc-data-model/#concrete-lifecycle-exam...

It's always contingent on the recipient of an identity proof to verify that it's valid; I'm not sure I understand the criticism to be honest.

Re: Auth0 Verifiable Credentials

#57

Post by lxgr »

adontz wrote: post #6

I did not understand if this is somehow related to https://en.wikipedia.org/wiki/Self-sovereign_identity or not.

This seems to me like SSI minus the blockchain – which seems like a good idea. A widely used schema for verifiable statements seems incredibly useful.

Re: Auth0 Verifiable Credentials

#58

Post by lxgr »

NovemberWhiskey wrote: post #36
ShakataGaNai wrote: post #35

Earlier quoted context omitted.

Maybe this is a silly question. But wouldn't this just mean that the ID would need to be updated very regularly? Like at least every year if not more frequently? In the theoretical use case of drinking, I couldn't just goto the bar on my 21st birthday, provide my ID, and buy a drink. I'd have make sure that I did whatever process was required to update my Verifiable Credential first? I get the abstraction is great fr…

You don't update that property unless there would be a need to prove the age was above some other number. Otherwise I think you're on the right track. As you said, you'd update it when you turned 18 or 21 etc. In the US, 21 is the "prove you can buy liquor" age and there's seldom a need to prove anything higher, outside of some unusual cases like becoming a member of Congress or President or something. No-one cares i…

The DMV (or whoever issues widely accepted identity documents in your country) could also provide a service that can exchange precise assertions to more private ones, i.e. one that allows the following transaction:

You provide a document stating that "Mr. Foo Bar is depicted on this photo and was born on 1990-04-01" signed by them, and get one that just says "the person depicted on this photo is over 18/21", also signed by them.

This would save you a trip to the issuer.

Re: Auth0 Verifiable Credentials

#59

Post by nileshtrivedi »

jameshart wrote: post #49
hirsin wrote: post #46

Earlier quoted context omitted.

Yep,proof of possession - the ID contains a public key, you own the matching private key. You send them the ID with a matching assertion ("This is meant for cheapboozeforstudents.com"), signed by your private key. The website can't in turn generate an assertion for statestudentaid.gov because the whole envelope (ID, assertion, signature) is uniquely tied to them. It does rely on statestudentaid.gov actually validatin…

And... cheapboozeforstudents can't fool me into generating an assertion for statestudentaid.gov by showing me statestudentaid.gov's presentation request? But yeah, the issue here is that when you present your student ID to anyone, you are relying to some extent on every single other service that accepts student ID to be validating the audience assertion. That's not a great trust model.

There's also the possibility that cheapboozeforstudents and statestudentaid.gov are colluding - either directly or because of corrupt employees - against the ID holder. We have seen examples where banks issued loans in user's name against fake IDs/applications.

Re: Auth0 Verifiable Credentials

#60

Post by NovemberWhiskey »

lxgr wrote: post #58
NovemberWhiskey wrote: post #36

Earlier quoted context omitted.

You don't update that property unless there would be a need to prove the age was above some other number. Otherwise I think you're on the right track. As you said, you'd update it when you turned 18 or 21 etc. In the US, 21 is the "prove you can buy liquor" age and there's seldom a need to prove anything higher, outside of some unusual cases like becoming a member of Congress or President or something. No-one cares i…

The DMV (or whoever issues widely accepted identity documents in your country) could also provide a service that can exchange precise assertions to more private ones, i.e. one that allows the following transaction: You provide a document stating that "Mr. Foo Bar is depicted on this photo and was born on 1990-04-01" signed by them, and get one that just says "the person depicted on this photo is over 18/21", also sig…

Right - that's the "drinker's permit" concept I'm talking about here: https://news.ycombinator.com/item?id=33430005
Post reply on HN