- Wg-pemc - mailman.kantarainitiative.org

Revolution of mDLs: the highest vertical in identity discussed at #IdentityWeekEurope 2023; book now for 2024! - Identity Week
by John Wunderlich 20 Feb '24

20 Feb '24

https://identityweek.net/revolution-of-mdls-the-highest-vertical-in-identit… Have a better than expected day, John Wunderlich LinkedIn: https://www.linkedin.com/in/privacycdn/ Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

FYI Identity Week
by John Wunderlich 20 Feb '24

20 Feb '24

https://identityweek.net/revolution-of-mdls-the-highest-vertical-in-identit… Have a better than expected day, John Wunderlich LinkedIn: https://www.linkedin.com/in/privacycdn/ Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

Fwd: An Instant Fake ID Factory
by John Wunderlich 05 Feb '24

05 Feb '24

Click bait or real issue? Have a better than expected day, John Wunderlich LinkedIn: https://www.linkedin.com/in/privacycdn/ Twitter: https://twitter.com/PrivacyCDN ---------- Forwarded message ---------- From: Joseph from 404 Media <404-media(a)ghost.io> Date: Feb 5, 2024 at 9:41 AM -0500 To: john(a)wunderlich.ca Subject: An Instant Fake ID Factory > The site, called OnlyFake, threatens to streamline everything from bank fraud to money laundering, and has implications for cybersecurity writ large. > > An Instant Fake ID Factory > By Joseph Cox • 5 Feb 2024 View in browser > View in browser > Image: 404 Media. > Hey there, Joseph here with something that will fundamentally shift crime and cybersecurity: I generated a fake ID with an online service in minutes, then used that ID to successfully bypass the identity verification check on a cryptocurrency exchange. In other words, realistic and convincing fake IDs are now just a mouse click away. I tested the service, called OnlyFake, with multiple IDs, and I spoke to the site's creator. I think we're only just starting to understand what this might mean for crime and security. I hope you enjoy the full piece below. > We can only do these sorts of investigations with the direct support of our paying subscribers. If you found this article interesting or helpful, and you want us to keep producing journalism like it, please consider subscribing below. You’ll get unlimited access to our articles ad-free and bonus content. > Subscribe > This piece was produced with support from The Capitol Forum. > An underground website called OnlyFake is claiming to use “neural networks” to generate realistic looking photos of fake IDs for just $15, radically disrupting the marketplace for fake identities and cybersecurity more generally. This technology, which 404 Media has verified produces fake IDs nearly instantly, could streamline everything from bank fraud to laundering stolen funds. > In our own tests, OnlyFake created a highly convincing California driver's license, complete with whatever arbitrary name, biographical information, address, expiration date, and signature we wanted. The photo even gives the appearance that the ID card is laying on a fluffy carpet, as if someone has placed it on the floor and snapped a picture, which many sites require for verification purposes. 404 Media then used another fake ID generated by this site to successfully step through the identity verification process on OKX. OKX is a cryptocurrency exchange that has recently appeared in multiple court records because of its use by criminals. > Rather than painstakingly crafting a fake ID by hand—a highly skilled criminal profession that can take years to master—or waiting for a purchased one to arrive in the mail with the risk of interception, OnlyFake lets essentially anyone generate fake IDs in minutes that may seem real enough to bypass various online verification systems. Or at least fool some people. > “The era of rendering documents using Photoshop is coming to an end,” an announcement posted to OnlyFake’s Telegram account reads. As well as “neural networks,” the service claims to use “generators” which create up to 20,000 documents a day. The service’s owner, who goes by the moniker John Wick, told 404 Media that hundreds of documents can be generated at once using data from an Excel table. > A fake ID generated by the service. Image: 404 Media. > To create the ID, I entered the information I wanted to appear on the card, uploaded a passport photo, and cycled through a series of automatically generated images that took the name I entered and turned it into a signature. Sometimes these made squiggles with the full name, other times with just the initials. “The neural network generates signatures very realistically,” Wick said. > Finally, I hit “generate photo.” Once the generation process started, the screen displayed updates on the system’s progress: “Generating PDF417 and Code128,” “Sending to Server,” “Replacing the Text,” before suddenly finishing and providing a preview of the finished product. I then clicked “download and pay,” which gave me access to two files, the front and back of my new fake ID laying on the carpet. That process took around one or two minutes. > On Telegram, OnlyFake has uploaded a wealth of other photos showing the high quality of their service. In one demonstration photo, what appears to be a U.S. passport card sits on a blanket. In another, a fake Arizona driver’s license lays flat on a hard surface. Another set shows a fake Swiss passport and identification card on a piece of fabric. Other photos show a Canadian passport and Austrian ID too. In all, OnlyFake offers generations of identity documents from more than two dozen different countries, but its administrator sometimes shows a particular interest in creating U.S. identities. > 💡 > Do you know anything else about these ID generation services? I would love to hear from you. Using a non-work device, you can message me securely on Signal at +44 20 8133 5190. Otherwise, send me an email at joseph(a)404media.co. > The backgrounds of the images—the fabric, the hard surface—appear to be real photos. 404 Media compared several different outputs from OnlyFake that showed different IDs laying on the same distinctive background. OnlyFake appears to be then using its technology to rapidly map whatever ID the customer wants onto one of those backdrops. > The appeal of a service like OnlyFake to fraudsters is that these allegedly AI-generated fake IDs could be used to signup to online services which ask for identity verification. It is very common for all sorts of sites—banks, cryptocurrency exchanges—or even individual professionals like lawyers or accountants to ask for, at minimum, a scan or photo of someone’s ID. Some social media sites also ask for identity documents in certain contexts. > 404 Media tested the identity verification process of the cryptocurrency exchange OKX with a fake British passport generated by OnlyFake. OKX has appeared in multiple court records in recent weeks, including in the case of a massive scam that may have netted around $40 million. In that instance, the identity documents the scammer provided to OKX as part of the verification process pointed to the real name of the alleged fraudster. This is the bottleneck of cryptocurrency—where converting cryptocurrency into fiat often requires giving up identifying information. More sophisticated criminals may hire others to act as a buffer in this step, while foolish ones use their own documents. But what if a service offered fake IDs at the click of a mouse? Could this make it harder for exchanges, banks, or other institutions to stop money laundering and fraud? > The process started with OKX asking me to snap a photo of the ID with a smartphone camera. This worked despite me not having a physical ID in my hand. I pointed the camera at the OnlyFake-generated photo of the fake ID displayed on my laptop screen, and the system successfully recognized the ID. It then asked me to take a selfie, which I did. > “Identity verified,” OKX’s website read. “Congratulations! You’ve completed your identity verification.” > The verification process for OKX. > OKX uses a company called Jumio for at least part of its identity verification process. Stuart Wells, CTO for Jumio, said in an emailed statement that the company’s “advanced ID verification process uses mobile or webcam document scanning tools that allow security teams to cross-check against trusted sources and mitigate the number of fake profiles and malicious activity. Ultimately, these added identity verification measures better protect users by deterring fraud attempts right from the user onboarding stage.” When 404 Media then explained we had successfully passed the identity verification process using a fake, generated ID, Jumio said it could only comment on Jumio’s own technology, rather than OKX’s processes. OKX did not respond to a request for comment. > Abhishek Mathew, a cybersecurity researcher who has followed the site, told 404 Media that real criminals are using OnlyFake in this way. “Many use this service for carding, creating fake bank accounts and also many use this service to unban their crypto accounts like Binance where they ask IDd proofs,” they said in an online chat. A Bitcoin address used by the OnlyFake service has received more than $23,500 worth of the cryptocurrency, according to blockchain records. The service accepts many other forms of cryptocurrency too, though. > OnlyFake’s owner, Wick, told 404 Media their service could be used to bypass verification at a host of sites, including Binance, Revolut, Wise, Kraken, Bybit, Payoneer, Huobi, Airbnb, OKX and Coinbase. In the same message they claimed, unconvincingly, “using our site for the purpose of forging documents is prohibited.” > Binance did not respond to a request for comment. A spokesperson for Coinbase said in an email that “At Coinbase we are working with dedicated research teams to combat the potential misuse of AI tools and are dedicated to incorporating the latest AI security features to help mitigate and prevent threats from bad actors using AI.” > A Kraken spokesperson wrote in an email that “Kraken continues to maintain strong crypto industry KYC [know your customer] and fraud checks. We have measures in place to uncover and prevent fabricated identification documents being used in an attempt to circumvent our robust identity verification processes. We also reserve the right, as part of our terms of service, to suspend or close accounts where clients have used questionable or stolen identification documents during our KYC reviews.” > Payoneer said in an email that “Payoneer is aware of underground websites that use AI to generate synthetic IDs and we work with multiple vendors to detect this type of fraud. While a user may try to submit a synthetic ID as part of registration, we have additional controls in place to determine the source of funds, location, and other risk-scoring mechanisms to prevent any financial activity taking place.” > Other companies either did not respond or provide a response in time for publication. ID.me, another verification service, did not respond to a request for comment. > Some of the IDs uploaded to the OnlyFake Telegram. Image: 404 Media. > OnlyFake offers other technical measures to make its churned out images even more convincing. The service offers a metadata changer because identity verification services, or people, may inspect this information to determine if the photo is fake or not. That includes fabricating what device allegedly took the photo—an Apple iPhone 11 Pro, a Huawei BKL-L09—the date and time of creation, and spoofed GPS coordinates. For my fake California drivers’ license, I set those coordinates to a location in Los Angeles, so it would roughly match the Californian address I printed on the ID itself. > As well as uploading their own photo, users can run through a mass of portraits from OnlyFake’ own archive; these are not AI-generated, the description of a YouTube video advertising the service says. But they still provide an opportunity to create an ID without the fraudster uploading a photo of themselves. > Wick told 404 Media they started creating document templates three years ago. The generator service itself, they wrote in another Telegram channel message, has been in development for “almost a year and a half.” They created this service by feeding it a large collection of images of identity documents. > Wick said that “it's necessary first to find a scan, preferably in very high resolution, such as 10,000 x 10,000 pixels. Such scans usually reveal microtext and any lines. In addition to this, it's preferable to have hologram photos from different angles to understand how they are superimposed.” > In one channel message, they offered to buy scans of identity documents from others, explicitly asking for samples of U.S. documents. “I will buy your scans 1200-2400 dpi. $100+ per scan. The priority is the United States, and the new documents of Europe.” > And with its corpus of data, OnlyFake has introduced generations of more recent types of IDs too, such as the New York State redesign of its drivers’ license from 2022, according to one Telegram message. “We developed a unique algorithm to generate DLs like New York, which have a window and complex curved text that no one else could replicate before us! 👏🎯,” one message read. This also includes generating serial numbers in such a format that are distinctive to that particular type of ID, which again was done by analyzing a large number of IDs. “Each passport, ID, etc., usually has various numbers. Each number has a unique algorithm, which often requires analyzing hundreds or thousands of originals to decipher,” Wick added. > A screenshot of the OnlyFake generation panel. Image: 404 Media. > OnlyFake also offers images that look like more traditional scans, with the fake passport or ID laying flat, with no background, and taking up the entirety of the frame. > While OnlyFake says it uses “neural networks” to create its fake IDs, 404 Media has not seen evidence that the service uses generative AI tools. “I don’t know exactly what is going on here but I suspect that they are using some tech to insert/replace the image into a template of a license/id,” Hany Farid, a professor at UC Berkeley and one of the world’s leading experts on digitally manipulated images, told 404 Media in an email. “If they were using genAI to create whole cloth the entire ID, they would have trouble dealing with inconsistencies in the background.” > Where things get a bit more tricky for fraudsters, and where some sort of other service or skill set would be required on top of OnlyFake, would be sites that ask for video or photo verification which ask the user to physically hold up their ID to the camera. That, obviously, is not really possible with an ID card that doesn’t actually exist. Other related sites have something of a workaround, or at least offer a helping hand. Users can purchase sets of photos from a choice of hundreds of people holding up blank pieces of paper, laptops, and plain passport-shaped objects to a camera, which they can then superimpose their fake documents onto. Presumably the photos would need to match, but multiple sites 404 Media visited offer a stream of real people ready to fulfill that role. Each set costs $45. It is not clear who exactly these people are, be they unsuspecting victims, direct accomplices, or perhaps people paid to be in the photos. > In my test, I used a photo of my own face for my fake ID. OnlyFake offers the photos of other real peoples’ faces to use, but I did not want to implicate a random and innocent person in this test. That means the test ultimately was a probing of OKX’s document recognition feature, and not so much its selfie one. Still, using a fake ID with a different name would provide a security benefit to a fraudster over simply using their genuine ID in their own name. And Wick says they plan to introduce a face and selfie generator soon. > Members of OnlyFake’s community also discuss the problem of video verification in associated chat rooms. A Russian language room has more than 1,100 members, while its English equivalent has just over 550. Here, members look to work together on scams or other fraudulent activities, and discuss how to create live video feeds of a person holding up a corresponding ID. People in these chat rooms appear determined to find a solution, and several have posted demonstrations of what look to be animated stills of people holding up IDs as a potential approach. > This isn’t the first time I’ve successfully demonstrated the power of AI-adjacent tools for fraud. Last year I created an AI-generated version of my voice using a tool called ElevenLabs. With that, I broke into my own bank account, bypassing the biometric voice verification with my AI clone. “My voice is my password,” I commanded my AI doppelganger to say at the time. > Others have toyed with the idea of using AI to circumvent identity verification services specifically. Recently a user on Reddit showed a photorealistic image they claimed to have created at least in part with text-to-image AI model Stable Diffusion. In the image, a woman smiles at the camera while holding a piece of paper with hand written text, in very much the style of a selfie someone may upload to an identity verification service. Another replaced that piece of paper with a fake ID and writing on the woman’s skin, creating what might be a convincing image of an entirely fabricated and artificial person proving they actually exist—a powerful paradox for fraud. In both cases, the creator later said they used Photoshop for the text. > But with technology like OnlyFake, maybe a future where AI selfies come complete with a fake ID is just around the corner. > Keep reading > Inside the Underground Site Where ‘Neural Networks’ Churn Out Fake IDs > The site, called OnlyFake, threatens to streamline everything from bank fraud to money laundering, and h… > Behind the Blog: Social Media's ‘IDGAF Era’ and Weather Clout Chasers > This is Behind the Blog, where we share our behind-the-scenes thoughts about how a few of our top storie… > Fake Bill Ackman and Jim Cramer Instagram Ads are Trying to Take My Money > Meta continues to profit by selling ads to scammers who are trying to fleece its users. … > 5101 Santa Monica Blvd Ste 8 PMB1405 Los Angeles, CA 90029 > 404 Media © 2024 – Unsubscribe > -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

4 3

PEMC Meeting Today at 2pm EST
by Christopher Williams 31 Jan '24

31 Jan '24

Hello Everyone, As a reminder we will have a working group meeting today at 2pm EST to continue discussing the privacy requirements. Call-in information is below. Thank you! Christopher *Teleconference info* *TIME*: 2:00PM Eastern Time (meeting is pinned to Eastern Time - use Time Zone Converter <http://www.thetimenow.com/time-zone-converter.php> to convert to other time zones) weekly on Wednesdays Join Zoom Meeting https://zoom.us/j/98664009878?pwd=Y1loWlQ5NlVvb3locFlReWpnMG8rQT09 Meeting ID: 986 6400 9878Passcode: 651020 One tap mobile +16465588656,,98664009878#,,,,*651020# US (New York) +16699009128,,98664009878#,,,,*651020# US (San Jose) Dial by your location +1 646 558 8656 US (New York) +1 669 900 9128 US (San Jose) +1 253 215 8782 US (Tacoma) +1 301 715 8592 US (Washington DC) +1 312 626 6799 US (Chicago) +1 346 248 7799 US (Houston) +353 1 653 3898 Ireland +353 6 163 9031 Ireland +353 1 240 8941 Ireland +353 1 536 9320 Ireland +353 1 653 3895 Ireland +353 1 653 3897 Ireland +39 021 241 28 823 Italy Meeting ID: 986 6400 9878 Passcode: 651020 Find your local number: https://zoom.us/u/aMF1STchU

1 0

Acceptance Networks for Self-Sovereign Identity
by John Wunderlich 30 Jan '24

30 Jan '24

You might find this interesting: https://www.technometria.com/p/acceptance-networks-for-self-sovereign Have a better than expected day, John Wunderlich LinkedIn: https://www.linkedin.com/in/privacycdn/ Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

3 2

For anyone interested in biometric privacy issues
by Tom Jones 30 Jan '24

30 Jan '24

https://www.nextgov.com/emerging-tech/2024/01/tsa-uses-minimum-data-fine-tu… thx ..Tom (mobile)

1 0

Understanding the bias of mobile location data across spatial scales and over time: A comprehensive analysis of SafeGraph data in the United States | PLOS ONE
by John Wunderlich 26 Jan '24

26 Jan '24

Geek alert: https://journals.plos.org/plosone/article?id=10.1371/journal.pone.0294430 Have a better than expected day, John Wunderlich LinkedIn: https://www.linkedin.com/in/privacycdn/ Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

Moving PEMC meeting time to 2:00 PM Eastern
by John Wunderlich 24 Jan '24

24 Jan '24

Hi; This request is to address two issues: 1. A number of times now our Zoom meeting couldn’t start because the prior meeting went overtime. 2. We have received a request from a regular attendee to move the meeting because of a conflict they now have Unless I hear otherwise by Friday I will request staff at Kantara to move the Zoom call in the Kantara calendar to 2:00 PM eastern Have a better than expected day, John Wunderlich LinkedIn: https://www.linkedin.com/in/privacycdn/ Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

4 4

rendering a mobile credential (aka vc).
by Tom Jones 20 Jan '24

20 Jan '24

[image: VC render methods.png] Here I am mostly drawing from a slide deck created by the MIT Credential Consortium of Universities throughout the world. The killer app turns out to be rendering the VC. So not only the subject, but others (like even the issuer) need to see the WHOLE THING in a format that is human readable. From a privacy perspective it is necessary (IMHO) for the subject and the holder to understand what a VC actually contains. Here are 2 proposed requirements. 1, The subject of any mobile credential can see the entire contents of the credential in a format that they can understand. (Note that this does not say they need all of the exact contents of the VC because it might make any sense to them. It does not need to be specified if the rendering occurs on the issuer or by the provider.) Now whether this is on the phone or as a PDF does not need to be what the PEMC requires. The other requirement I proposed at the last meeting. 2. If the holder gives the verifier access to the data that the verifier requested then the verifier MAY NOT ask for more data to meet the requirement specified by the initial request. This is designed to prevent a dark pattern of continued incremental requests for more data and more data. attachment is from a university in Mexico ..tom

1 0

Strengthening Trust in the Digital Ecosystem: Introducing the Digital Trust Conformity Assessment Program - Digital Governance Council
by John Wunderlich 19 Jan '24

19 Jan '24

FYI: https://dgc-cgn.org/strengthening-trust-in-the-digital-ecosystem-introducin… Have a better than expected day, John Wunderlich LinkedIn: https://www.linkedin.com/in/privacycdn/ Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

How Data Privacy Concerns Impact Firm Performance
by John Wunderlich 18 Jan '24

18 Jan '24

FYI https://knowledge.wharton.upenn.edu/article/how-data-privacy-concerns-impac… Have a better than expected day, John Wunderlich LinkedIn: https://www.linkedin.com/in/privacycdn/ Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

Alternate Zoom
by John Wunderlich 10 Jan '24

10 Jan '24

I’ve started a meeting with my own Zoom: https://us06web.zoom.us/j/7325916646 Join Zoom Meeting https://us06web.zoom.us/j/7325916646 Meeting ID: 732 591 6646 --- One tap mobile +16694449171,,7325916646# US +16699006833,,7325916646# US (San Jose) --- Dial by your location • +1 669 444 9171 US • +1 669 900 6833 US (San Jose) • +1 689 278 1000 US • +1 719 359 4580 US • +1 929 205 6099 US (New York) • +1 253 205 0468 US • +1 253 215 8782 US (Tacoma) • +1 301 715 8592 US (Washington DC) • +1 305 224 1968 US • +1 309 205 3325 US • +1 312 626 6799 US (Chicago) • +1 346 248 7799 US (Houston) • +1 360 209 5623 US • +1 386 347 5053 US • +1 507 473 4847 US • +1 564 217 2000 US • +1 646 931 3860 US Meeting ID: 732 591 6646 Find your local number: https://us06web.zoom.us/u/kc0oX3GRey --- Join by Skype for Business https://us06web.zoom.us/skype/7325916646 Have a better than expected day, John Wunderlich LinkedIn: https://www.linkedin.com/in/privacycdn/ Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

Zoom delay
by John Wunderlich 10 Jan '24

10 Jan '24

Trying to get the prior call ended. Have a better than expected day, John Wunderlich LinkedIn: https://www.linkedin.com/in/privacycdn/ Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

Reminder: PEMC Requirements Discussion
by John Wunderlich 10 Jan '24

10 Jan '24

Hello; Here is a link if you want to view or comment on PEMC Requirements: https://docs.google.com/document/d/1mACfcV4BGHClqaGXxfKCBRkgeO_AjvKv_lhPL8f… Today’s discussion will try and focus on item 1.1 in the report. Have a better than expected day, John Wunderlich LinkedIn: https://www.linkedin.com/in/privacycdn/ Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

FYI: How Do I Trust Entities? Different Levels of Identity & Credential Assurance - A Thought Paper
by John Wunderlich 09 Jan '24

09 Jan '24

A long-ish read by Guy, with a long list of references to his prior work. Recommended reading https://www.linkedin.com/pulse/how-do-i-trust-entities-different-levels-ide… Have a better than expected day, John Wunderlich LinkedIn: https://www.linkedin.com/in/privacycdn/ Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

Today’s mintues and an email ballot
by John Wunderlich 03 Jan '24

03 Jan '24

Hello; See the minutes from today’s meeting at https://kantara.atlassian.net/wiki/spaces/PEMCP/pages/322043905/2024-01-03+… We did not achieve a quorum, so we decided to have an email ballot for the leadership. Please respond to this email (including cc to myself and Christopher) indicating: > Yes/No to confirming John Wunderlich & Christopher Williams as Chair and Co-Chair respectively Please respond by the end of the day next Tuesday for your vote to be counted. Have a better than expected day, John Wunderlich LinkedIn: https://www.linkedin.com/in/privacycdn/ Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

Tomorrow’s call
by John Wunderlich 02 Jan '24

02 Jan '24

Happy New Year. I want to share with you that the leadership council vote has passed, and the Implementor’s Report should be published on the Kantara Reports and Recommendations site in the next day or so. Congratulations to all. We have a meeting scheduled for tomorrow, the main focus of which is the annual leadership election. Christopher Williams and I are standing again for the leadership. Others can self-nominate if they choose. If we don’t get quorum tomorrow, I suggest an email ballet. Also, the charter for the workgroup can be reviewed, but from my perspective, it is still valid. In any event, I look forward to seeing you on Zoom tomorrow for the call. We will commence the review and approval of requirements starting on Jan 10. Have a better than expected day, John Wunderlich LinkedIn: https://www.linkedin.com/in/privacycdn/ Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

Fwd: Call for Comments | EU-US TTC Digital Identity Mapping Exercise Report + Save the Date
by Tom Jones 23 Dec '23

23 Dec '23

i would think that both committees would have some comments with references to existing reports. thx ..Tom (mobile) ---------- Forwarded message --------- From: NIST Cybersecurity and Privacy Program < csrc.nist(a)service.govdelivery.com> Date: Fri, Dec 22, 2023, 7:38 AM Subject: Call for Comments | EU-US TTC Digital Identity Mapping Exercise Report + Save the Date To: <thomasclinganjones(a)gmail.com> [image: NIST] View As Web Page <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDAsInVy…> [image: Header] NIST Cybersecurity and Privacy Program [image: Calendar Announcement] *EU-US Digital Identity Mapping Exercise Report Now Open for Feedback…and Save the Date for a Webinar!* Following a successful round of government-to-government technical exchanges earlier this calendar year, in March 2023, the European Commission and the US Government, operating under the auspices of the US-EU Trade and Technology Council (TTC), publicly committed to undertake a transatlantic mapping exercise with the objective of finding commonalities between the EU and US approaches to digital identity. Released today, the jointly authored EU-US TTC *Digital Identity Mapping Exercise Report <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDEsInVy…>*, provides the preliminary results of an initial mapping centered on the definitions, assurance levels, and references to international standards included across Revision 3 of the NIST Digital Identity Guidelines (Special Publication 800-63, Revision 3 <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDIsInVy…>) and European Regulation (EU) No 910/2014 <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDMsInVy…> on electronic identification and trust services for electronic transactions in the internal market. The next phase of this project will include collecting feedback and selecting potential use cases for transatlantic cooperation that highlight the need for and value of enabling the cross-border use of digital identities. The EC and the US are actively seeking comments from communities with subject matter expertise in digital identity, privacy, human-centered design, and cybersecurity; organisations that have designed or implemented digital identity systems within the EU, the US, or in cross-border contexts; and others with equities related to the topic of digital identity. *Feedback is requested by 5:59 AM CET on March 1, 2024 / 11:59 PM EST on February 29, 2024 and can be submitted via dig-comments(a)nist.gov <dig-comments(a)nist.gov> and more information can be found on our website <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDQsInVy…>.* *Save the date* for the EU-US TTC Webinar: Unpacking the Digital Identity Mapping Results* Join NIST and the EC on February 22, 2024 for a webinar to: - Hear an overview of the US and EU's efforts to map their digital identity frameworks. - Provide feedback to NIST and the EC on the preliminary results of the mapping exercise. - Weigh in on use cases where future US-EU collaboration could accelerate progress on cross-border interoperability. **Webinar details are still being finalized. Registration information will be sent out and posted online soon.* *NIST appreciates your feedback, participation, and interest in our efforts. To learn more about our publications, news, and get the latest updates, please visit our website <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDUsInVy…>. * Read More <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDYsInVy…> *NIST Cybersecurity and Privacy Program* Questions/Comments about this notice: dig-comments(a)nist.gov CSRC Website questions: csrc-inquiry(a)nist.gov Connect with us [image: facebook] <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDcsInVy…>[image: twitter] <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDgsInVy…>[image: youtube] <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDksInVy…>[image: linkedin] <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMTAsInVy…>[image: flickr] <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMTEsInVy…> Received this email from a friend? Subscribe here <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMTIsInVy…> . [image: ITL NIST] <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMTMsInVy…> Subscriber services: Manage Preferences <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMTQsInVy…> | Unsubscribe <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMTUsInVy…> | Help <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMTYsInVy…> ------------------------------ If you have questions or problems with the subscription service, please contact subscriberhelp.govdelivery.com <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMTcsInVy…> . Technical questions? Contact inquiries(a)nist.gov. (301) 975-NIST (6478). This service is provided to you at no charge by National Institute of Standards and Technology (NIST). 100 Bureau Drive, Stop 1070 · Gaithersburg, MD 20899 · 301-975-6478 [image: GovDelivery logo] <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMTgsInVy…>

1 0

Call for papers fyi
by Salvatore D'Agostino 18 Dec '23

18 Dec '23

Get Outlook for iOS<https://aka.ms/o0ukef>

1 0

age verification
by Tom Jones 13 Dec '23

13 Dec '23

We were arguing about age from mDL, but it seems CA is ahead of us. They support TruAge AS A SEPARATE CRED already https://www.mytruage.org/ https://www.dmv.ca.gov/portal/ca-dmv-wallet/truage/#faqs SOOOO - if the wallet has both mDL and TruAge - the wallet should pick the least invasive method. ..tom

1 0

Fwd: NEW BLOG | Progress - NIST’s Digital Identity Guidelines
by Tom Jones 12 Dec '23

12 Dec '23

It looks like 63-4 is headed for another public response period. Note that they have switched to the issuer-holder-verifier format. Most of the responses from Kantara have been from the IA folk who are focused on the audit POV. Perhaps we needs something from the developer POV? ..tom ---------- Forwarded message --------- From: NIST Cybersecurity and Privacy Program < csrc.nist(a)service.govdelivery.com> Date: Tue, Dec 12, 2023 at 7:09 AM Subject: NEW BLOG | Progress - NIST’s Digital Identity Guidelines To: <thomasclinganjones(a)gmail.com> [image: NIST] View As Web Page <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDAsInVy…> [image: Header] Cybersecurity Insights a NIST Blog A Note on Progress…NIST’s Digital Identity Guidelines. In August 2023 the Digital Identity Guidelines team hosted a two-day workshop to provide a public update on the status of revision 4. As part of that session, we committed to providing further information on the status of each volume going forward. In fulfillment of this commitment, we wanted to offer a quick update on where we stand. Our goal remains to have the next version of each volume out by the Spring of 2024. With our gratitude for the robust and substantive engagement we received during the comment period, at this time we would like to announce that all four volumes of Special Publication 800-63-4 will have a second public comment period, which will last at least 45 days. - *NIST SP 800-63 Base Volume* <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDEsInVy…>. We are making substantive changes to the volume including updating the digital identity model to account for “Issuer, Holder, Verifier” frameworks of digital identity, new content... Read More <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDIsInVy…> Connect with us [image: facebook] <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDMsInVy…>[image: twitter] <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDQsInVy…>[image: youtube] <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDUsInVy…>[image: linkedin] <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDYsInVy…>[image: flickr] <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDcsInVy…> Received this email from a friend? Subscribe here <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDgsInVy…> . [image: ITL NIST] <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDksInVy…> Subscriber services: Manage Preferences <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMTAsInVy…> | Unsubscribe <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMTEsInVy…> | Help <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMTIsInVy…> ------------------------------ If you have questions or problems with the subscription service, please contact subscriberhelp.govdelivery.com <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMTMsInVy…> . Technical questions? Contact inquiries(a)nist.gov. (301) 975-NIST (6478). This service is provided to you at no charge by National Institute of Standards and Technology (NIST). 100 Bureau Drive, Stop 1070 · Gaithersburg, MD 20899 · 301-975-6478 [image: GovDelivery logo] <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMTQsInVy…>

1 0

Implementor’s report for workgroup vote
by John Wunderlich 11 Dec '23

11 Dec '23

Please find attached the Early Implementors Draft for workgroup vote: Next steps: 1 Workgroup Votes: • Vote Approve • Vote Approve with suggestions (include specific suggestions for final editing) • Vote Not Approve 2. Final Editing by leadership team (assuming majority of votes cast are Approve or Approve with suggestions) 3. Submit for publication On the agenda for tomorrow: 1. Developing a cadence and calendar for asynchronous development of requirement 2. Review of voting process Have a better than expected day, John Wunderlich LinkedIn: https://www.linkedin.com/in/privacycdn/ Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

2 2

SP 800-226, Guidelines for Evaluating Differential Privacy Guarantees | CSRC
by John Wunderlich 11 Dec '23

11 Dec '23

Some of you may want to comment on this: https://csrc.nist.gov/pubs/sp/800/226/ipd Have a better than expected day, John Wunderlich LinkedIn: https://www.linkedin.com/in/privacycdn/ Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

Governments have been and will remain a major threat to privacy.
by Tom Jones 10 Dec '23

10 Dec '23

We should probably review the threat posed by eIDAS to privacy. It would be good if our guidelines were clear that government mandated monitoring is banned. https://nce.mpi-sp.org/index.php/s/cG88cptFdaDNyRr Be the change you want to see in the world ..tom

1 0

which federal agency should create Identifier standards?
by Tom Jones 08 Dec '23

08 Dec '23

'TSA Is Not the Right Agency to Lead' REAL ID Implementation, Security Experts Say Security and identity management experts urged Congress to direct the National Institute of Standards and Technology to play a bigger role in developing standards for digital identity management ahead of a looming 2025 deadline for domestic air travellers to comply with security requirements outlined in the REAL ID Act. "While DHS does not create standards, DHS - or even better, the White House or Congress - should request that NIST lead a timeboxed, one-year effort to create the standards and guidance needed to accelerate the deployment of secure, privacy-protecting mDL apps that Americans can use to protect and assert their identity online," Grant testified. Jay Stanley, a senior policy analyst with the American Civil Liberties Union's Speech, Privacy, and Technology Project, warned that the TSA has proposed to adopt the ISO standards, which he said were "created behind closed doors by a secretive committee" and are "inadequate and incomplete when it comes to the protection of our privacy." Sounds like Jeremy Grant is involved somehow. ..tom

2 1