Identosphere 200!: NIST 900-63-4 Digital Identity Guidelines for Final Review • Personhood credentials & AI• MyData Call for portability
newsletter.identosphere.net
Identosphere 200!: NIST 900-63-4 Digital Identity Guidelines for Final Review • Personhood credentials & AI• MyData Call for portability
You weekly guide to the latest news events and other info surrounding development and implementation of decentralized identity and verifiable credentials. Thanks for your continued support.
Learn what FediForum is all about Check out the session notes and demo videos from our March 2024, September 2023 and March 2023 events to see what FediForum is all about. The sessions agendas you see there were created democratically each morning, and then run by FediForum participants. (Learn more about unconferences.)
“Today’s draft revision from NIST highlights the Biden-Harris administration’s commitment to strengthening anti-fraud controls while ensuring broad and equitable access to digital services,” said Jason Miller, deputy director for management at the Office of Management and Budget. “By incorporating feedback from private industry, federal agencies, privacy and civil rights advocacy groups, and members of the public, NIST has developed strong and fair draft guidelines that, when finalized, will help federal agencies better defend against evolving threats while providing critical benefits and services to the American people, particularly those that need them most.”
SpruceID is participating in the National Cybersecurity Center of Excellence (NCCoE) Accelerate Adoption of Digital Identities on Mobile Devices Consortium. This initiative will help define and facilitate a reference architecture for digital credentials that protect privacy, are implemented securely, enable equity, are widely adoptable, and are easy to use.
What about as AI gets better? A new paper—co-authored with researchers from ~20 orgs, & my OpenAI teammates Zoë Hitzig and David Schnurr—asks this question: What are AI-proof ways to tell who’s real online? (1/n)
Think of it like an envelope for sealing and sharing digital information. The source of the envelope (the organization issuing the credential) can be cryptographically verified. The information in the envelope is digitally signed, which, in essence, means that any attempt to alter or tamper with the information breaks the seal and can be detected.
One of the key aspects of ensuring privacy in CBDC transactions is the management of users' identities. Traditional identity management systems often require users to share extensive personal information, which can be stored centrally, making it a target for cyberattacks. Hypersign tackles this issue with its Self-Sovereign Identity (SSI) framework, allowing individuals to maintain full control over their personal data.
The EU’s Digital Markets Act requires six big tech “gatekeepers” (Alphabet, Amazon, Apple, ByteDance, Meta, Microsoft) to provide continuous and real-time data portability mechanisms to users. We’re calling on the MyData community to help us test those tools and encourage improvements, to help drive real accountability and open up the field for consumer control and third-party services. Check out the below, and join us for a testing workshop on September 25.
The paper addresses a critical issue in implementing the Findable, Accessible, Interoperable, and Reusable (FAIR) data principles. While many research groups strive to make their data FAIR, they often encounter challenges documenting the context in which data was collected, processed, and analysed. This lack of machine-actionable, contextual metadata frequently renders data less reusable and visible outside the immediate research team.
The Community Group continues to progress with next steps to include OpenID for Verifiable Presentations, and a collaboration with the Open Identity Exchange that leverages OpenID Federation to enable the passage of Trust Framework metadata. There has been work on this already by a few of the members so this phase should have a flying start!
With the verifiable Legal Entity Identifier (vLEI), GLEIF has pioneered a new form of digitized organizational identity to meet the global need for automated identification, authentication and verification of legal entities across a range of industries. By creating the vLEI, GLEIF is now answering to this urgent and unmet need of pioneering a multi-stakeholder effort to create a new global ecosystem for organizational digital identity.
Organizations across diverse sectors, particularly those looking for a better, more secure user experience, should carefully consider integrating passwordless authentication into their security frameworks. By leveraging biometrics, mobile devices, or security keys, passwordless systems offer a robust and user-friendly alternative to traditional password-based methods, effectively mitigating the risks associated with phishing, password theft, and unauthorized access.
Adaptive authentication is changing how we verify digital identities. Instead of relying on passwords, this method uses AI to evaluate the risk of an access request in real time. It looks at factors like where the request is coming from, what device is being used, and what time it is.
While this is exciting, their technology, which is based on ERC-6551 (Token Bound Account) and ERC-721, is only a subset of W3C DID and Verifiable Credentials.
Not only that, but this platform uses W3C verifiable credentials to securely store digital educational certificates for their courses. The company is called Veriable, and here’s a thread on it
In 2021, we were selected as one of seven projects from 30+ applications to participate in the European Blockchain PCP, funded by the European Commission. The PCP aims to design new DLT solutions for Europe – first to be integrated into the European Blockchain Services Infrastructure (EBSI), an open, permissioned network of blockchain nodes across Europe that supports cross-border credential attestations for individuals and organizations; then as part of the next evolution of EBSI, the European Digital Infrastructure Consortium for Blockchain (EUROPEUM-EDIC), which will provide next-generation infrastructure to support scalable, energy-efficient, and secure blockchain applications.
The IOTA Foundation has successfully completed the final phase of the European Blockchain Pre-Commercial Procurement. [...] We are now in conversations with commercial partners to further support and drive this important European initiative in its new governance form as EUROPEUM-EDIC.
The Vidos Universal Resolver provides a scalable, reliable, and configurable DID resolution service. The W3C Decentralized Identifiers (DIDs) v1.0 standard-compliant service supports a comprehensive range of DID methods, ensures 99.95% SLA-backed uptime, and cost-effective operations. It's designed for seamless integration into enterprise systems and existing decentralized identity applications.
The expansion broadens the platform’s coverage, making it a more comprehensive solution for verifying individuals presenting mDLs across various states and international territories.
I will try to present a holistic overview of what the space of digital identity has to offer at the moment and what my ideal future would look like as the underlying technologies evolve and gain mass adoption. In the last couple of years, many new cryptographic primitives have emerged from different fields like zero-knowledge (ZK), fully-homomorphic encryption (FHE), trusted-execution environments (TEEs), and multi-party computation (MPC).
In Systems Thinking, one of the first steps is to draw a boundary around the system you’re examining. This boundary defines what is included within the system and what is considered external. It’s crucial because the way you set this boundary determines the scope of your analysis and influences the insights you gain.
The first step for planning an ActivityPub integration is to figure out how different aspects of your software map to the Activity Streams format. – Evan Prodromou, ActivityPub spec co-author.
I'm trying to think of an OAuth API that dishes out tokens which effectively let you spend money on behalf of your users and I can't think of any - OAuth is great for "grant this app access to data that I want to share", but "spend money on my behalf" is a whole other ball game.
