Re: Verifiable Barcodes

On Thu, May 30, 2024 at 4:54 AM Phil Archer <phil.archer@gs1.org> wrote:
> the "Verifiable Barcodes" title is misleading and inaccurate.

Alright, let's change it. Clearly, if the "barcode people" (GS1) have
concerns with the name, we should take those concerns seriously. :)

Thanks for raising the concern in the issue, I've responded there, but
also want to draw the renaming discussion more directly into the CCG
in the event that someone else has a useful suggestion for a rename.

> Within the world of barcodes and RFID tags (Automatic Identification and Data Capture, AIDC), verification means verifying that the data carrier meets the standard (the PDF417 standard, the QR Code standard, the RFID Gen 2 spec etc.). That means that the bars/modules are the right relative size, there's the correct white space around it and so on. That's not what you mean by "Verifiable Barcodes" (in AIDC terms, all barcodes are verifiable).
>
> Barcodes and RFID tags contain simple data. They are neither secure nor insecure. They're as secure as a Post-It Note.
>
> The security and the verification of the data, comes in the software that reads and processes the data. A bad actor can create an application that reads a 2D barcode that contains a VC and then present the user with false information. That is, it deliberately ignores or misrepresents the data it has read. It just recognizes that it has scanned something and then it acts in whatever way it wants.
>
> Finally, there's nothing in the 2D barcode that confirms that the code is an electronic version of the other info printed on the physical item. That's the world of secure printing, holograms, special inks and all that. Without secure printing, you can have a genuine PDF417 code on a fake driver's license.
>
> In the sense of the proposed work item, it's not the barcode that is verifiable. It is simply that a VC is encoded within a 2D barcode and therefore its payload can be verified with the appropriate software. There are good reasons for doing this. But please don't call it a Verifiable Barcode. It's a VC in a barcode.

Hmm, I get what you're saying but wonder if there is one detail that's missing.

The VC that's embedded in the 2D barcodes (PDF417 or QR Code covering
an MRZ), does cover information that is contained on the printed card.

For PDF417, the PDF417 fields are secured via the digital signature in the VC.

For MRZ, the QR Code covers the entirety of the printed MRZ information.

In both cases, the VC embedded in the barcode secures both information
in the barcode as well as information that is printed on the physical
document. I don't know if that's evident from the proposal?

> Therefore, I would strongly urge you to rename this to something much closer to "Encoding Verifiable Credentials in 2D Barcodes".

It goes a bit beyond the title you're suggesting, as described above.
Given the further detail I've provided above, would you provide
another suggestion for the title of the document? To be clear, given
your reaction (and your background), I expect others to have the
reaction that you had AND we don't want that, so we do need to rename.

Some alternates:

* Secure Barcodes
* Securing Barcodes using Verifiable Credentials
* Verifiable Credential Barcodes
* Barcode Credentials

Do any of those resonate? Does anyone else on here have other suggestions?

-- manu

-- 
Manu Sporny - https://www.linkedin.com/in/manusporny/
Founder/CEO - Digital Bazaar, Inc.
https://www.digitalbazaar.com/

Received on Thursday, 30 May 2024 14:43:12 UTC