Please keep me anonymous. The following is public information, but I
would prefer to not be identified. No need to read the whole thing on
the show, but feel free to do so.
I have
worked for a government agency in Canada in the field of digital
credentials for the last three plus years as a product manager. On the
last show you mentioned the hack and sale of social security numbers and
how this will lead to the implementation of a digital ID. You are
right, but it is already under way. Simply using a string of "secret"
numbers to identify yourself has become obsolete and it is far too easy
to carry out identity theft when certain easy to obtain information gets
into the wrong hands. What is needed now is a way to verify information
online, in other words to be able to send verifiable information from
one party to another, and assert your control over that information. ie
This is my identity because I control it via my digital wallet and no
one else does.
The solution that is being
pushed, that I also push, is called Verifiable Credentials, also known
as Digital Credentials. They are held in Digital Wallets on your
smartphone, and they leverage advanced cryptography to enable you to
prove your identity or other things about yourself either online or in
person. This is not one single digital identity, it is many different
credentials that could be issued from the government, a company or an
individual.Obviously, the government issued ID will be used most often.
There are a few different flavours, using different communication
protocols and credential formats and cryptographic signatures, but they
all generally follow the "W3C Verifiable Credentials Data Model"
standard.This is very different from the Smart Health Card QR codes that
were used for the vaccine passes. With the vaccine passes, the data was
encoded into the QR code itself. So if you took a picture of the QR
code, you now have the data.
With
Verifiable Credentials, you only use the QR code to connect to another
wallet or software agent to establish a peer-to-peer encrypted
connection. After that, you have a confidential and private conversation
and can request and send credential proofs based on credentials you may
hold. Critically, you don't use the digital wallet to visually show
your credential to someone in person. That is too easy to forge. And you
would never hand your digital wallet over to police officer. The
experience is more akin to a chat app, where instead of sending a GIF
you can send a proof of some verifiable information from your
credentials.
This is a superior concept
than the existing Mobile Drivers' License or Mobile ID which have been
rolled out in the last year or two. That is only practical right now
because it is an ISO standard (mDL). Verifiable credentials are still in
its infancy in terms of standards.
In the United States, DHS is leading the charge via the Silicon Valley Innovation Program. https://www.dhs.gov/science-and-technology/blockchain-portfolio. The link mentions blockchain and distributed ledgers, while those are commonly used they are not necessary for the solution.
Much
of this technology is open-source and many of these projects are hosted
within the Linux Foundation, and in Canada, we are pushing hard to
avoid relying on a single vendors or large corporations like Apple or
Google to make this work. We are, however, at the mercy of the App
stores for deploying digital wallets into smartphones.
Look
out for terms such as Zero Knowledge Proofs, Selective Disclosure,
Predicates, Non-linkability when hearing about the "privacy preserving"
features of this technology. Some forms of verifiable credentials are
more privacy preserving than others. And the most privacy preserving
cryptographic signatures (CL signatures) are not NIST approved, thus
federal governments will not use them.
Largely
this technology aims to mimic how we use physical credentials. There is
an Issuer, a Holder and a Verifier. You receive a credential from an
issuer, you put it in your wallet, and you use that credential with
whoever is willing to accept it. The party verifying your credential and
receiving the data you share can cryptographically confirm the currency
and authenticity of the credential without contacting the issuer. In
that way the issuer (usually government) does not have the ability to
surveil when you use it.
This is a
decentralized ecosystem by design. But, there are some places where
centralization happens, for example when your state government issues a
drivers' license or state ID credential and you rely on that for many
transactions. This ecosystem is also aimed towards using a common
protocol to enable everyone to participate and communicate equally. A
likely candidate is called DIDCOMM. This is similar to how email
protocols are common and everyone can equally use email regardless of
the service provider or software used. A big difference between these
protocols used for verifiable credentials is that connections are
mutually created (peer to peer) and unilaterally terminated. Meaning
that no one can spam you, and if you don't want to continue a connection
or contact, you can block it permanently.
Progress
is slow because development is largely government funded in the open
source community. There is little to no money to be made in this
industry other than helping organizations implement it with consulting
services. Once implemented, as an add-on to existing digital services,
it promises to cut service processing costs by being able to verify
information about users instantly rather than undergoing costly
verification steps. For users it can eliminate the need for passwords,
as well as enable users to prove things about themselves. Think
professional certifications, permits, ownership of assets, etc.
I
have been listening to No Agenda for maybe 1000 episodes and donated a
few times. I understand there is a general distrust of the concept of
digital ID. I don't blame you. There are many versions of digital ID
that are more easily abused for surveillance and coercion, for example
the Aadhaar system in India. Generally, the aim of verifiable
credentials and the people working in that field is to provide a modern
and privacy preserving method to interact online, where the interactions
are truly private and confidential and you have the option to
participate or not. Having this software as open-source is helpful in
obtaining the trust of the public.
I've
said a lot, let me know if you want to know more about any points. This
is a deep topic and after 3 years of learning it, I still consider
myself a novice.
Anonymous C