Re: Web Payments and Identity

Manu,
Unfortunately, I will be on airplanes for 12 hours Tuesday and
incommunicado. The good news-for me at least-is that I'll be on my way to
Hawaii on vacation. :)

I can, however, summarize a bit about what I've been doing with identity
and Bitcoin.

Basically, Bitcoin Identity leverages bitcoin's public-key infrastructure
to authenticate web logins using message signing as opposed to shared
passwords.

My original motivation for this work was really to provide a means to
suppress so-called 'sockpuppet' identities in web applications. The
original concept was published as "Collateralized Identity - Using bitcoin
to suppress sockpuppets"<http://joecascio.net/joecblog/2013/03/25/collateralized-identity-using-bitcoin-to-suppress-sockpuppets/>.
But after attending "Inside Bitcoin" in NYC recently and talking with
various people, it seemed that the identity aspects of bitcoin addresses
were valuable in and of themselves.

I've built a very small proof-of-concept that demonstrates registration and
login to an example web site with a Chrome Extension and local http service
that communicates with the Bitcoin-Qt reference wallet application using
the standard bitcoin-json API.

The user's "username" or ID is a bitcoin address, which is quite simply the
public key of a public-private pair. Example:
1FrTHp5DR3hLAqCVmuzXLmTLkpJFKCAAgP

The most significant aspect of this work, in my mind, is to demonstrate
"passwordless" login". That is, a site that accepts Bitcoin ID does not
require, have to store or be responsible for a shared secret (ie, the
password). Authentication is performed by the Bitcoin ID user software
constructing and signing a message containing a nonce and sending it back
to the site which can verify the signature of the message using the public
key.

There has been discussion here about not conflating payments with identity
and I appreciate why. I don't think my work necessarily does that, it
simply leverages the same underlying PKI. Using bitcoin technology for
identity doesn't require one to use bitcoin for payments nor vice-versa,
but there are interesting and useful synergies that obtain if one does.

1. Development of a robust PKI, including facilities akin to certificate
authorities.
2. Development of strong key security techniques and products for
protecting one's bitcoin holdings and identities.
3. Mutual enhancement of the network effect for uptake of the technology.
If you could easily add on an ID authenticator to your local or web wallet,
or if it came built in, it would promote adoption of both, simply by
convenience.

I think the ideas put forth in this thread about using digital signatures
to endorse or testify to attributes of a person's identity (eg, age, place
of residence) are spot on.

I will catch up with the call transcripts as soon as I can.

Thanks,
Joe C


On Mon, Sep 30, 2013 at 5:39 AM, Melvin Carvalho
<melvincarvalho@gmail.com>wrote:

>
>
>
> On 30 September 2013 10:46, Dave Raggett <dsr@w3.org> wrote:
>
>>  In respect to knowing your customer, one approach is to use zero
>> knowledge proofs. I was part of the EU project PrimeLife which finished a
>> few years back and worked with IBM on a demo for their identity mixer
>> technology (idemix). Imagine that a national government issues its citizens
>> with a smart card attesting to a variety of  personal information, e.g.
>> your name, passport number, date birth, current address, and so forth.
>> banks and other institutions have trust in the processes used by the
>> government in providing these national identity cards.
>>
>> Now imagine a situation where you want to purchase let's say a box of
>> wine online, and are required to prove that you are 18 years or older.
>> Idemix would allow you to provide a crypographic proof backed by your
>> goverment *without* disclosing your data of birth or your national id
>> number! This is possible through a zero knowledge proof over expressions of
>> attributes on the government issued id.
>>
>> The approach lends itself to the creation of psuedonymous identities for
>> specific purposes and minimizes the loss of privacy, unlike conventional
>> approaches where privacy is not prioritized. Note that the customer's true
>> identity can be revealed by a court order if required. This involves a
>> computation to reveal the base identity (your national id in this example).
>> So your privacy relies on a trusted independent party, which could be part
>> of the judiciary.
>>
>> Idemix is available as an open source java library. My demo was based on
>> an extension to the Firefox browser and allows web pages running in the
>> browser to create a new pseudonymous id, and to ask the extension to
>> authenticate the user and provide a zero knowledge proof that the user owns
>> that pseudonymous id. The example is for a university where the student
>> union issues new students with a USB key stick this allows students to make
>> purchases and to participate in chat sessions without disclosing their
>> identity. See slide 38 on:  http://www.slideshare.net/iwmw/raggett
>>
>> Today, customer privacy is a low priority for businesses, who constantly
>> demand for personal information that they don't need to know. It is almost
>> a paradox, but STRONG identity can be used to underpin STRONG PRIVACY,
>> however, this will require concerted action by citizens to overcome the
>> reluctance of business and governments to do more than the very minimum.
>>
>
> +1
>
> There's also a concept of group membership.  "I am a member of the group
> of people over 18" and that group issues me a token.  But it doesnt say
> which member I am.  A similar form of "blinding".
>
>
>>
>> Further reading:
>>    http://people.w3.org/~dsr/blog/?p=95
>>    http://www.zurich.ibm.com/idemix/details.html
>>    http://en.wikipedia.org/wiki/Zero-knowledge_proof
>>
>> --
>> Dave Raggett <dsr@w3.org> <dsr@w3.org> http://www.w3.org/People/Raggett
>>
>>
>