Re: Group Certificates and their utility or uselessness

Sorry,

I'm not sure if it came-across in my prior writings - so i figured i'd
follow-up with a more details overview.

The concept about using WebDHT within the context of leveraging the
social-relations of a person to secure their root identifiers; in the
manner I suggested may be developed as WebID-DHT | was to use produce a
methodology for the AUTH document that's similar to RAID [1], so the entire
AUTH data gets pulled in a decentralised way from a multitude of human
entities (running something akin to SoLiD [2] with an augmented AUTH
methodology, thereby decentralised storage authorities) who in-effect
cooperate as to provide the identity security layer that may support both
ID and Persona; in-turn, provisioning a sub-system that could be used at a
target in relation to Credential Documents, which provide external identity
validation attributes from other non-human agents.

I can envisage an array of ways to do this, and am currently working on
writing it up.  However, not being myopic - figured i'd flag it.  I can't
see a 'perfect' method, yet this seems to get into the philosophy area of
web-science; whereby the approach attempts to provide a flexible
methodology that allows a human to select how they wish to use it, subject
to UI and RWW Server (aka. SoLiD) Availability & Accessibility.  In-turn,
the methodology appears to relate to an issue that's recently been closed
on SoLiD[3] with an alternative resolution idea; yet, i'm not sure the
methodology utilised in that response effectively decentralises or provides
a 'human centric' solution to the underlying problem.

My considerations reflects work on this problem area for a while; some
feedback [4] was provided prior to credentials being established as a
separate group [5].  I think progress has been made via the credentials
works; yet i'm failing to see an integrated approach within the various
CG's and i also consider that the WebID group is perhaps most suitable for
amending existing works to be updated as to enhance solutions for these
problems.

I think it's also important to flag Melvin's work entitled WebCredits [6].
His basic ledger technology may have some application to this AUTH concept;
one consideration is that of a law-enforcement order (by the sovereign
government relating to the citizen, for example) where a request may be
made across the multi-factored social-framework storing access for a
persons data in a manner that is consistent with the rule of law for the
citizen subject to the court-request; being distinct from the concept of
access to any-such data being made available by default; via a global SNS
with a single "choice of law" [7] that beyond law-enforcement, seems to
have an array of other broader implications...

I also think it's important that any-such solution is made available under
a licensing scheme such as that employed by W3C; therein, the spirit of my
authorship of this document.

The UX experience i've considered looks like this:
http://webcivics.org/dev/ whereby
a user (where WebID-TLS, or some other 'quick' method isn't being used) can
enter their persona, the persona passcode, and the storage provider /
location.  Similar to an international bank transfer: which bank, what's
the branch, what's the account code.

What i'm not 100% in understanding is what happens if the SubjectAltName
notates a Machine (ie: Tim's Mac, or Holborn Family's TV) rather than a
person; where the person is identified by this proposed method, which is
then associated to the machine whether the machine (/machine account) is
owned by them or by someone else; nor do i understand what the implications
are to existing SoLiD Designs and whether this is a somewhat easy thing to
do, or whether it's going to be a major overhaul.

Beyond that; maybe i'm off-base - yet, i don't think we've figured out the
'human centric' WebID / AUTH mechanic yet.  I think it's important to have
a means that is provided support by physical contact with other humans and
other ID provider entities (i.e. post, banking, etc.); and i'm writing a
rather extensive piece on it, which i'm hoping to have produced to draft
within the next week or so.

In the meantime, if any feedback is available or interest in working with
me to flesh the concept out a little better, that would be thankfully
received.

Tim.H.
skype: sailing_digital

[1] https://en.wikipedia.org/wiki/RAID
[2] https://github.com/solid/solid
[3] https://github.com/solid/node-solid-server/issues/392
[4] https://lists.w3.org/Archives/Public/public-rww/2014Jul/0040.html
[5] https://lists.w3.org/Archives/Public/public-credentials/2014Aug/
[6]
https://lists.w3.org/Archives/Public/public-webpayments/2016Jun/0010.html
[7]
https://drive.google.com/open?id=1bHmB8_f7ASRHm97TwhZmmEQnTKU&usp=sharing

On Tue, 7 Jun 2016 at 00:09 Timothy Holborn <timothy.holborn@gmail.com>
wrote:

> On Fri, 3 Jun 2016 at 19:01 carmen r <_@whats-your.name> wrote:
>
>> > We need a human centric web. i see differentiators between that and our
>> service orientated heritage
>>
>> hi tim(h), sometime in past couple of years tim(bl) in an interview
>> (maybe TIME.com) mentioned work
>> yet to be done on social aspects of the web - with a brief mention of
>> identity or certificates,
>> also even more briefly noting the idea of family certificates.
>> as you know, software-support of even the basic user-certificate feature
>> is in-flux and incomplete in
>> shipped web-browsers. https://www.w3.org/Webauthn/ appeared, and there's
>> https://fidoalliance.org
>>
>> Yup.  I remember a confirmation email to that effect a few years ago, and
> i note it's in the SoLiD todo list.
>
> My thinking is to use Manu's WebDHT work, but incubate it in WebID.
>
> https://lists.w3.org/Archives/Public/public-webid//2016Jun/0001.html
>
> When Credentials was established, i remember a debate around the identity
> issues vs. what is now becoming 'verifiable claims', which is a constituent
> of identity; but obviously far less difficult from a situation of 'service
> orientated' design demands.
>
> I'm SO VERY interested in a Human Centric Solution - i don't think
> block-chain is it - I think leveraging the social-graph may offer
> alternatives, but i think that's beyond the scope of credentials - and it
> looks like the payments work has some sort of preference for the browsers
> to be the identity provider, or something like that...  Not entirely sure,
> but some disruption happened.
>
> _____
>> membership of a group could be based on possession of a certificate
>>
>> My thinking was to use a new type of 'virtualised layer' that tries to
> create something that's HTTP compatible, leveraging LDP, Linked-Data,
> HTTP-SIGNATURES, etc.
>
> In the model i'm thinking about; the WebID-TLS cert identifies the machine
> / machine account.  The identity chain is actually in the WebID-DHT Chain,
> which is decentralised across an entities social-graph, and can have varied
> permissions applied to the WebID-TLS certs located on various machines.
>
> But my models also suppose this concept of a 'knowledge banking industry'
> where an array of service providers store data on behalf of people, in a
> manner that allows them to move the data to another service provider if
> they're unhappy with the service qualities.
>
> http://bigthink.com/videos/what-is-emergent-thinking  kinda explains it.
>
> group-certs could be exchanged in person with mobile-devices via NFC
>> tapping or camera and QR-scanning,
>> after both members initiate a key-exchange session using their
>> cert-management UI. or cert is escrowed
>> online in a group's private space, which you could download into browser
>> as a member
>>
>> enhanced-security Solid daemons could store blobs only decryptable by
>> key-holders, ACL check becomes
>> pointless other than to avoid sending data that won't be decryptable
>> _____
>>
>>
> When we start looking to use the TLS Certs at that layer - i think it
> starts to get complicated and is vulnerable to browser-company desires
> influencing things in ways that produce delays / lack of functionality.  It
> seems more stable to work at the linux-server layer, then provide the
> presentation platform to the browser clients.
>
> bit like doing complex stuff behind the scenes then using word-press as
> the publishing engine..
>
>
>
>
>> unsure if you mean "service orientated" as in online service run by a
>> single company
>> as in to get "Group" features, everyone creates an account on a
>> particular online site
>>
>> Social-Network-Silos are an example of service orientated design, data
> goes in from humans.  The Idea is that the platform has a preference for
> incorporated entities rather than human entities (independent to their role
> as agents for incorporated agents or other forms of agent).
>
> We need a service provider to support human centric services.  that is,
> services designed to help the end-user primarily.  that is much the concept
> that i believe established banks, from the days when people kept their
> valuables under their beds. the bank securely stored, provided services
>
>
>
>> fancier next-of-kin, and power-of-attorney and delegated/proxy scenarios
>> are the kind of thing that
>> could potentially be enabled via shared group or family certificates.
>> none of this is shipping now,
>> instead major services are implementing things on an adhoc basis:
>>
>
> Many of those use-cases should be covered by verifiable claims.
>
>
>> “They listened to all the pundits and drew up the documents. Then the
>> bank says, ‘That’s very nice, but it’s not our form.’”
>>
>>
>> http://www.nytimes.com/2016/05/10/health/finding-out-your-power-of-attorney-is-powerless.html
>>
>> > Other situations may involve 'digital hostage' styled use-cases
>>
>> keeping in mind the classic https://xkcd.com/538/ when thinking about
>> keys is good
>>
>> will check.
>
>
>> a concensus system involving group-members could robustify against this
>> attack,
>> you can hold a wrench and point a gun at one person, but can you round up
>> enough
>> like-minded evil to do this to >50% of the group-members which would be
>> required to
>> do X where X is something like transfer ownership, add new members to
>> group etc
>>
>> i think social groups is better than hash-power.  if everyone walks from
> you, perhaps thats the worst thing; not the loss of ya data.  Energy cant
> help that, often money does, but i' prefer to see it made for the right
> reasons more often.
>
> Tim.H.
>