How is this fundamentally different than something like KeyBase other than the aspect of centralizing issuance control into the hands of large entities?
Auth0 Verifiable Credentials
111–120 of 134 posts
Re: Auth0 Verifiable Credentials
#112Earlier quoted context omitted.
We did quite a bit of research into this. If you need mostly B2C features I would have a look at Clerk [0] and Supertokens [1] If you are more interested in B2B features we found Ory [2], FusionAuth [3], and good old Keycloak [4]. None of them are fully comparable yet however, which might be the reason why they might get away with their current behaviour. [0] https://clerk.dev/ [1] https://supertokens.com/ [2] https:…
Thanks for the mention (I work for FusionAuth). I'm curious what solution you ended up determining best fit your needs?
that landing page should point to docs instead of commands for me to run on my machine.
I'm someone looking for auth/security products. you won't reel me in like that.
Re: Auth0 Verifiable Credentials
#113Earlier quoted context omitted.
> The government site doesn't have to know anything about you either, other than you requested a beer token. That's the 7th beer token you've requested this week, citizen. For your own good, we've denied your request.
That's not how it works. You would just request a VC that states personal information about you from the government, including age (like an ID card which most countries have)... then, when you're required to prove you're a certain age, you can create a presentation object which only contains your age, nothing else. You can present that as many times as you want without the government knowing you did that (unless the…
It very much can be.
Gov might require that on each sale, company re-verify identity (just like they demand you check ID on each sale).
That results in a network request to `proof.verificationMethod` on each sale, which contain a URL to the age verification for that one user.
Done. Gov now have records on how many times you bought beer. They might also request that the number/description of items be included on the verification request. but that is not necessary since credit cards are already being replaced with central bank issued payment systems (see india, brazil, etc)
Re: Auth0 Verifiable Credentials
#114It'd be nice if you could just assert facts on a verifiable credential without giving over all the information, like I want to request from my bank that they assert I have regular income > $x/mo or a savings account with at least $y. Not like financial institutions will actually adopt this unless they're forced to by regulation but I basically want to give people exactly enough to provide the service requested and no…
This is possible currently with zero knowledge proofs.
There are mainly two different types one is "selective disclosure", where the verifier require some fields but it is up to the Holder to select which one to disclose.
The other one allows the Holder to create proofs about claims, like "I am over 18" without disclosing the birthday. The cryptography for this seems sound, but to be honest it is hard to grasp.
For a working example you could have a look at this:
https://github.com/mattrglobal/jsonld-signatures-bbs
Note: Auth0 currently doesn't support neither issuing or verifying this type of credentials.
Re: Auth0 Verifiable Credentials
#115VCs are typically used in conjunction with DIDs. Do they say anywhere whether they’re using DIDs and, if so, which methods?
This labs project appears to currently use did:web for the issuer, and did:ethr for the subject.
- When auth0 act as an issuer, it issue credentials with did:web
- when auth0 act as a verifier it can verify credentials and presentations issued with: did:web, did:key, did:ethr and did:ion
- The provided demo wallet at https://wallet.verifiablecredentials.dev/ supports did:key, did:ion and did:ethr
Re: Auth0 Verifiable Credentials
#116Earlier quoted context omitted.
Verifiable credentials (VC) It's a name that comes from: https://www.w3.org/TR/vc-data-model/
Funny how identity0.io (from the website example) was registered less than 24 hours ago
It’s likely that someone else registered that. When this was posted, domain was still not taken
Re: Auth0 Verifiable Credentials
#117Earlier quoted context omitted.
Funny how identity0.io (from the website example) was registered less than 24 hours ago
It’s likely that someone else registered that. When this was posted, domain was still not taken
That's a pretty egregious error from a company as large as Auth0/Okta.
Re: Auth0 Verifiable Credentials
#118Earlier quoted context omitted.
You will have all your email, postal addresses, other PII and (formerly physical) identification documents in a wallet app. Government websites AND private websites will be able to request data from that wallet for login and registration purposes. You will need to approve all requests to your wallet, in the majority of cases by using biometrics (e.g. faceId or non-apple alternatives of it). This has the potential to…
Just to clarify something important, though... and I hope you agree with me on that: the VCs that matter will be issued by whoever is the authority that takes care of the subject matter... as it's always been the case in the real world. For example: - date of birth: issued by your government and equivalent to your birth certificate. - Occuppational credentials: issued by the relevant, government-authorized organizati…
The government issues physical ids and might even issues a digital identity / verified credentials. But there are also private, non-governmental vendors that verify your physical ids and create verified credentials for you. In that case, the private DI vendor is the issuer of the verified credentials. The government might not be involved in anything besides providing the end user with a physical id.
But yes indeed, private companies do not have much valuable credentials to offer. There just aren't that many categories of personal data you'd ever want to have in a wallet.
Re: Auth0 Verifiable Credentials
#119Earlier quoted context omitted.
It’s likely that someone else registered that. When this was posted, domain was still not taken
That's a pretty egregious error from a company as large as Auth0/Okta.
Indeed! My initial thought was that they just misconfigured SSL, but other user here pointed out that it’s likely taken by someone else
Re: Auth0 Verifiable Credentials
#120Earlier quoted context omitted.
Thanks for the mention (I work for FusionAuth). I'm curious what solution you ended up determining best fit your needs?
that landing page should point to docs instead of commands for me to run on my machine. I'm someone looking for auth/security products. you won't reel me in like that.
Thanks for your feedback! Here are the docs: https://fusionauth.io/docs/v1/tech/
FusionAuth has a dual deployment model. You can either run it locally (or host it yourself) for free, or you can pay us to run it for you. Most devs want to kick tires and run it locally, which is why the downloads page has those commands.
There are features that do require a license, but we have plenty of people running with plenty of MAU on the free version (we call it the 'community' edition).
Sorry if it wasn't clear.