On Nov 22, 2023, at 12:03 PM, Prvu, Denny (He/Him/His) <denny.prvu@rbc.com> wrote:
I know sometimes I sound like disagree with Jay, but I’m fully on the same page with this one 😊 (with the exception that the distributed ledger model for storage is a risk officers nightmare 😉
This type of model does work and your right has been around a while. I know lots of FI’s that have looked at this and even more spaces in manufacturing or energy, but most of them from what I’ve seen don’t really have that level of trust defined. Back to the statements that someone said: bad in, bad out in my opinion.
I had a buddy that worked at Memberpass and their stuff is super cool and easy to integrate to.
Denny
There are many examples of an SSI model that is working in the field. The issue isn’t about whether it functions. Nor is the issue about distributed ledger data storage. The issue is the appropriate level of trust that the claimant is, in fact, the actual living human that was granted privileges by the issuing authority (the credit union in this case).
This screenshot from that system highlights the point. “Bad data in is bad data out”…if you don’t know who you’re enrolling, you can’t know who controls the SSI credential or the device the credential is bound to. Moreover, the system says it uses face and/or finger biometrics. I promise you they refer to “device-native” biometrics supplied by the device manufacturer. But these are “Anonymous Biometrics”, which are biometric data that’s not bound to verified identity data anywhere AND can be replaced with anyone’s biometric data, who has the device PIN.
In this system, the very best applicant identity verification is weak at best and provisioning can only be done in the credit unions office. It can’t be done remotely, because you have absolutely no idea of who is supplying the verifiable identity data and who is in control of the device the credentials will be provisioned to. This exact vector is being used to commit identity frauds and breaches today.
Under these circumstances, the system effectively enables fraud, by allowing for the enrollment of a fraudster in the system, as a legitimate customer. And then it will authenticate that fraudster as a legitimate customer every single time, because the claimants credentials are irrefutable.
Hi All,
Reading the info, looks like they may set up the account in a member branch, using a specific app based wallet to hold the credential, which can then be used in person or online (and I might think in the metaverse scenario too).
Say what you will about decentralized identity, but this is working and has been in production for years.
Bad in, bad out is certainly a useful way to frame it. As Pieter says, the challenge with the VCs is multifold;
- is the ID legitimate? Tons of good fakes, especially in the US
- is the person in the selfie being compared to the ID a real live individual?
- how to continuously authenticate the owner of the VC held within a device or wallet is the same one who enrolled?
--
~ The Future in Present Tense ~
_______________________________________________
A Community Group mailing list of KantaraInitiative.org
DG-DeepfakesIDV mailing list -- dg-deepfakesidv@kantarainitiative.org
To unsubscribe send an email to staff@kantarainitiative.org
List archives -- https://mailman.kantarainitiative.org/hyperkitty/list/dg-deepfakesidv@kantarainitiative.org/
______
Group wiki -- https://kantara.atlassian.net/wiki/spaces/DG-DeepfakesIDV
_______________________________________________________________________
If you received this email in error, please advise the sender (by return email or otherwise) immediately. You have consented to receive the attached electronically at the above-noted email address; please retain a copy of this confirmation for future reference.
Si vous recevez ce courriel par erreur, veuillez en aviser l'expéditeur immédiatement, par retour de courriel ou par un autre moyen. Vous avez accepté de recevoir le(s) document(s) ci-joint(s) par voie électronique à l'adresse courriel indiquée ci-dessus; veuillez conserver une copie de cette confirmation pour les fins de reference future.