Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Auth0 Verifiable Credentials

verifiablecredentials.dev

Post reply on HN
Print view View original

121–130 of 134 posts

Re: Auth0 Verifiable Credentials

#121

Post by mooreds »

nailer wrote: post #102
robbie-c wrote: post #89

Tangentially, if you’re a B2C startup like an app, avoid using auth0. Their pricing starts out cheap but once you hit 10k MAU, it’ll go from $X00 a month to a 3 year contract for $X00000. It’s not designed as a business for that use case, and you’ll be paying for a lot of premium features that you’ll never use. If something like Firebase Auth suits your use case, use that instead.

Or just use your favorite oauth / oidc library. AuthZero is for people that need SAML or AD integration or some other legacy tech.

That's a great path for many folks. I think building on a framework is far far better than rolling your own.

However, often there comes a time when you have multiple applications that all need a shared user data store. (Note, I work for FusionAuth, so I am, to some extent, talking my book here.)

You then have some choices:

* run everything off of one app (both features and user management) and have other apps oauth/oidc into that app. This means that other apps are now dependent on one main app. Within that app, user data and feature data may get entangled

* hive off the user manangement and login data from the main app to a separate one and have other apps oauth/oidc into that second app. This lets you deploy/manage them separately and still have one user data store. Congrats, you've just invented an auth server! This can be a good option, but that refactoring may be a bit painful, and you're on the hook for maintaining the auth server (dependencies, adding workflows and functionality).

* stand up a separate auth server (or use a SaaS offering) and have apps oauth/oidc into it. In this scenario the auth server vendor is responsible for updates (adding new forms of MFA such as WebAuthn, for example) and your apps get the benefits from it. The issue here is that this is a core part of your app, so any downtime or integration issues due to an upgrade can cause major headaches. (At FusionAuth, we work around this issue with a single tenant model and by allowing you to pin your version.)

It's engineering, so there's no perfect solution. The above are some of the tradeoffs I've seen.

Re: Auth0 Verifiable Credentials

#122

Post by brabel »

Traubenfuchs wrote: post #118
brabel wrote: post #103

Earlier quoted context omitted.

Just to clarify something important, though... and I hope you agree with me on that: the VCs that matter will be issued by whoever is the authority that takes care of the subject matter... as it's always been the case in the real world. For example: - date of birth: issued by your government and equivalent to your birth certificate. - Occuppational credentials: issued by the relevant, government-authorized organizati…

The government issues physical ids and might even issues a digital identity / verified credentials. But there are also private, non-governmental vendors that verify your physical ids and create verified credentials for you. In that case, the private DI vendor is the issuer of the verified credentials. The government might not be involved in anything besides providing the end user with a physical id. But yes indeed, p…

> But there are also private, non-governmental vendors that verify your physical ids and create verified credentials for you. In that case, the private DI vendor is the issuer of the verified credentials.

But who's going to trust those vendors? This is the job of the government IMO, one of the few things you just can't rely on the private sector for. I definitely don't want my birth certificate credential tied to, say, Google :D the Government cannot , for example, remove my credentials because I said something polemic, while Google (and infamously Twitter) most definitely can and seem quite happy to do if they can.

Re: Auth0 Verifiable Credentials

#123

Post by brabel »

askldfjaliwejf wrote: post #113
brabel wrote: post #85

Earlier quoted context omitted.

That's not how it works. You would just request a VC that states personal information about you from the government, including age (like an ID card which most countries have)... then, when you're required to prove you're a certain age, you can create a presentation object which only contains your age, nothing else. You can present that as many times as you want without the government knowing you did that (unless the…

It very much can be. Gov might require that on each sale, company re-verify identity (just like they demand you check ID on each sale). That results in a network request to `proof.verificationMethod` on each sale, which contain a URL to the age verification for that one user. Done. Gov now have records on how many times you bought beer. They might also request that the number/description of items be included on the v…

No, the system just isn't designed like that, the whole point of VCs is that the system becomes decentralized. To check a credential is valid you absolutely don't need to hit the Government, you need to trust its public key, which you can easily get once (or keep updating using things like DID)... you are arguing about a different system design that just doesn't exist and has no reason to exist.

Re: Auth0 Verifiable Credentials

#124

Post by Traubenfuchs »

brabel wrote: post #122
Traubenfuchs wrote: post #118

Earlier quoted context omitted.

The government issues physical ids and might even issues a digital identity / verified credentials. But there are also private, non-governmental vendors that verify your physical ids and create verified credentials for you. In that case, the private DI vendor is the issuer of the verified credentials. The government might not be involved in anything besides providing the end user with a physical id. But yes indeed, p…

> But there are also private, non-governmental vendors that verify your physical ids and create verified credentials for you. In that case, the private DI vendor is the issuer of the verified credentials. But who's going to trust those vendors? This is the job of the government IMO, one of the few things you just can't rely on the private sector for. I definitely don't want my birth certificate credential tied to, sa…

> But who's going to trust those vendors?

We will find out in the coming years...

Re: Auth0 Verifiable Credentials

#125

Post by chrisweekly »

Spooky23 wrote: post #110
chrisweekly wrote: post #100

Earlier quoted context omitted.

I find it interesting that US states and a massive corporation are directly comparable entities (CA, NY, Walmart, MA) in this context.

Well states operate vaccine registries, but some states for political reasons chose to not really do a good job with them or not issue usable credentials beyond the CDC card. Also, rural states tended to rely more on larger entities like Walmart and pharmacies to deliver vaccinations — Walmart is often the most accessible place for healthcare, food, medicines, etc. When entities like Apple got in the mix the process…

Ok sure, thanks. I was just sharing a simple observation that I found [a relevant verifiable fact] interesting. States and corporations aren't usually peers like that. I'd hoped it might trigger discussion of post-national society or Citizen's United or something else ~interesting and not just silent downvotes. Anyway, thanks for your response, it makes sense and was informative.

Re: Auth0 Verifiable Credentials

#126

Post by pfraze »

jfroma wrote: post #115
dwaite wrote: post #77

Earlier quoted context omitted.

This labs project appears to currently use did:web for the issuer, and did:ethr for the subject.

- When auth0 act as an issuer, it issue credentials with did:web - when auth0 act as a verifier it can verify credentials and presentations issued with: did:web, did:key, did:ethr and did:ion - The provided demo wallet at https://wallet.verifiablecredentials.dev/ supports did:key, did:ion and did:ethr

Thanks (both) for the info!

Re: Auth0 Verifiable Credentials

#127

Post by jfroma »

dwaite wrote: post #75
woodruffw wrote: post #17

I wonder what the benefits of this versus e.g. OpenID Connect[1] are: OIDC is already semi-widely adopted, reuses a popular underlying envelope scheme (JWTs), and performs a similar type of proof (that some identity provider claims something about an identity). [1]: https://openid.net/connect/

As someone else pointed out, there is work in OpenID Connect to support this model. The difference is that traditional Connect is typically a two party model - an OpenID Provider which gives claims which can be used for registration/authentication, and a Relying Party willing to accept them. This is an active dance back and forth, with the OpenID Provider deciding how to implement privacy, what records to keep on usa…

Just to add to your excellent description, one can draw an analogy between the id_token and a VC.

But an id_token usually has an audience which is the RP, and a short expiration. A VC is issued for the user (aka holder), with long or no expiration to store in wallet.

A VC is bound to the user’s did (think pk thumbprint) and is useless without a proper presentation. A verifier does not expect just the VC but a V. Presentation signed by the user.

This is where using id_tokens as vcs will fall short. Once you give it to one verifier, you could assume is public.

The good thing about VCs is that is standard and easy to grasp. There are too many flavors though

Re: Auth0 Verifiable Credentials

#128

Post by dwaite »

Spooky23 wrote: post #110
chrisweekly wrote: post #100

Earlier quoted context omitted.

I find it interesting that US states and a massive corporation are directly comparable entities (CA, NY, Walmart, MA) in this context.

Well states operate vaccine registries, but some states for political reasons chose to not really do a good job with them or not issue usable credentials beyond the CDC card. Also, rural states tended to rely more on larger entities like Walmart and pharmacies to deliver vaccinations — Walmart is often the most accessible place for healthcare, food, medicines, etc. When entities like Apple got in the mix the process…

> If your doctor uses Epic, the Health app can usually create a SMART credential directly from your medical records instead of downloading a state app.

Slight correction here - the health record is already in the SMART format, e.g. already a signed JWT enveloping a FHIR vaccination record.

The Health App is turning encoding this into a custom URL scheme and tossing that into a QR code.

The reverse also works - I can scan the QR code and import it as a vaccination record into the health app.

Re: Auth0 Verifiable Credentials

#129

Post by 0x6c6f6c »

brabel wrote: post #123
askldfjaliwejf wrote: post #113

Earlier quoted context omitted.

It very much can be. Gov might require that on each sale, company re-verify identity (just like they demand you check ID on each sale). That results in a network request to `proof.verificationMethod` on each sale, which contain a URL to the age verification for that one user. Done. Gov now have records on how many times you bought beer. They might also request that the number/description of items be included on the v…

No, the system just isn't designed like that, the whole point of VCs is that the system becomes decentralized. To check a credential is valid you absolutely don't need to hit the Government, you need to trust its public key, which you can easily get once (or keep updating using things like DID)... you are arguing about a different system design that just doesn't exist and has no reason to exist.

> the whole point of VCs is that the system becomes decentralized.

You say decentralized, yet that Verifiable Data Registry seems like a central component to checking whether you are you. How is that not able to see that you checked your ID?

Re: Auth0 Verifiable Credentials

#130

Post by Spooky23 »

chrisweekly wrote: post #125
Spooky23 wrote: post #110

Earlier quoted context omitted.

Well states operate vaccine registries, but some states for political reasons chose to not really do a good job with them or not issue usable credentials beyond the CDC card. Also, rural states tended to rely more on larger entities like Walmart and pharmacies to deliver vaccinations — Walmart is often the most accessible place for healthcare, food, medicines, etc. When entities like Apple got in the mix the process…

Ok sure, thanks. I was just sharing a simple observation that I found [a relevant verifiable fact] interesting. States and corporations aren't usually peers like that. I'd hoped it might trigger discussion of post-national society or Citizen's United or something else ~interesting and not just silent downvotes. Anyway, thanks for your response, it makes sense and was informative.

Not from me :) it’s a relevant point!

This is a little out there, but this thread is old enough at this point. I would say that COVID was something that improved my outlook in the future. Some aspects of the political landscape seem frankly, pretty dark and depressing. As someone who had a unique vantage point on aspects of the pandemic, I have to say that I saw the best of us demonstrated.

I think that ultimately the difficult adjustment from a 1970s economy to the services economy of today has created unrest and dissatisfaction that has and will change the US for years to come.

It is weird that Walmart has the same standing as a state health department. But ultimately, technology and standards like SMART allow us to trust assertions made by Walmart. I personally have issues with that, but it’s reality. Verifiable credentials are imo probably going to be one of the more powerful tools out there for lots of consumer to government or consumer to business use cases.

Post reply on HN