Re: [WebCrypto.Next] Linking web identities with real-world identities

Nobody learns from history. Even the "need" to prove you are a child or an
adult means something darker is at work. There is no need for the user to
disclose anything to anyone across the web and no need for "idemix" style
services that demand you "prove who you are." It is one thing for a user to
voluntarily broadcast such information from keys stored locally (keybase
model) which can also be integrated with the web. It is another entirely to
demand that users be identified through protocols you would develop; this
calls to mind the Holocaust, as I have pointed out in the past.

The only standard if you were to proceed with one here should be completely
zero knowledge based. But based on the discussion I've seen thus far I
can't imagine any protocols will evolve that will protect the users since
your intent seems to be to identify them, group us, and yes, Holocaust us
for corporation-states. Therefore I cannot support these proposals.
On Feb 14, 2015 4:46 AM, "Anders Rundgren" <anders.rundgren.net@gmail.com>
wrote:

>  On 2015-02-14 11:31, Dave Raggett wrote:
>
>
>  On 13 Feb 2015, at 21:22, Mike O'Neill <michael.oneill@baycloud.com>
> wrote:
>
> I agree that an identity verification protocol based on explicit consent
> should be a standard component of the web platform, but I think it should
> be designed so there would no need for a fixed “real-world” identity.
>
> The third-party entities could validate an arbitrary set of attributes,
> some of which may identify a legal person i.e. passport or birth
> certificate, but others could be anonymous attributes such as membership of
> a club, a child’s age, an anonymous audience category, or any attribute
> that the parties need and agree to without the necessity to inform any of
> the parties, including the validating parties, of other identifying
> attributes.
>
>
>  These refer to additional use cases, e.g. to prove that I am a child for
> access to a safe site for children.  I would encourage you to describe the
> use cases, since this is important for justifying work on a standard. There
> are no major technical barriers to pseudo-anonymous identity verification,
> so this is mostly about consensus building.
>
>  I built a demo for this kind of approach some years back around a use
> case where you need to prove you are a current student at a given
> university to gain access to a site run by students for students. The demo
> uses a Firefox extension for idemix. More details are given at:
>
>       http://people.w3.org/~dsr/blog/?p=95
>
>
> This is an interesting example because it uses a browser-specific
> extension which I believe also has ceased to work (java) which again points
> to the need for a real (W3C) standard for extending browsers through calls
> to native applications.   Building on such a standard makes it much more
> realistic creating new standards of the kind you are interested in.
>
>
>  It might be easier, however, to start with work on a standard for simple
> comparisons against attributes, where the website/app already knows your
> name and address etc., and wants to verify that the web identity you are
> logged in with corresponds to that real-world identity. This doesn’t
> involve a loss of privacy since the website and the identity agent being
> asked to perform the verification already know your real-world identity.
>
>  —
>    Dave Raggett <dsr@w3.org>
>
>
>
>
>