Digital Identities: Here for the EU

More broadly, how do we manage the notion of readable digital identity?  Its use, misuse and maintenance?    Now and in the future.   Good piece.    

Europeans Wary of New Digital Identity    By Arnout Jaspers, Commissioned by CACM Staff, March 31, 2022

Europeans now need a digital QR code verifying their coronavirus immunization status in order to cross borders. Critics say the new European Digital Identity (EDI) framework tries to capitalize on that requirement to strangle the privacy of its citizens; others say the EDI could actually benefit privacy, if done right.

To buy alcohol in the European Union (EU), you need to prove that you are at least 18 years old, typically by handing a photo identification card to the cashier. But why should the cashier be able to read your full name, date and place of birth, and Social Security or driver's license number, before selling you a bottle of wine?

Unlike a physical ID, a digital ID can perform selective disclosure: it only shows the relevant attribute (in this case, verifying that the holder is 18 or older) and nothing else. 

This is how the European CoronaCheck app is set up: after scanning the QR code, the app displays a green flag if the app confirms the person being tested has been vaccinated, or was infected with the virus and can show proof of recovery, or detects proof of a recent negative PCR-test (or any combination of the three).  If none of those three conditions (or combination of them) is detected, the app displays a red flag.

A European Digital Identity, in the vision of the European Commission, would provide every EU citizen with a digital wallet ID that can perform selective disclosure on many more attributes. The wallet will contain personal data like one's fiscal number (in the U.S., this would be a Social Security number; in the Netherlands, it is the BSN number), but also detailed information on health and education; almost anything the owner wants to put in the wallet.

It will typically reside on the owner's smartphone, and the owner has to give permission for it to display specific attributes. A doctor might be allowed to see all the medical information, while a university in Italy would only be allowed to verify whether the owner really received her bachelor's degree from Oxford University.

In February, the European Commission released a call for proposals to develop an app for such a wallet ID. While the Commission does not have the authority to demand that all 27 EU member-states use the same app, it can enforce certain data and privacy standards.

The initiative has caused concern among privacy advocates, and an uproar among more-extreme anti-EU activists, who see the European Digital Identity as a decisive step towards total, CCP-style control of EU citizens.   .... '  

Pocket Identity Revisit

Unless something like face identity fails, as mentioned here previously.

The Identity in Everyone's Pocket   By Phil Vachon

Communications of the ACM, January 2021, Vol. 64 No. 1, Pages 46-55

Most every technology practitioner has a smartphone of some sort. Around the world cellular connectivity is more ubiquitous than clean, running water. With their smartphones, owners can do their banking, interact with their local government, shop for day-to-day essentials, or simply keep in touch with their loved ones around the globe.

It's this ubiquity that introduces interesting security challenges and opportunities. Not even 10 years ago, a concept like biometric authentication was a novelty, reserved only for specialized applications in government and the financial services industry. Today you would be hard-pressed to find users who have not had the experience of unlocking their phones with a fingerprint, or more recently by simply looking at the display. But there is more to the picture than meets the (camera's) eye: Deep beneath layers of glitzy user interfaces, there is a world of secure processors, hardware-backed key storage, and user-identity management that drives this deceptively simple capability.

Newer phones use these security features in many different ways and combinations. As with any security technology, however, using a feature incorrectly can create a false sense of security. As such, many app developers and service providers today do not use any of the secure identity-management facilities that modern phones offer. For those of you who fall into this camp, this article is meant to leave you with ideas about how to bring a hardware-backed and biometrics-based concept of user identity into your ecosystem.

The goal is simple: Make it as hard as possible for attackers to steal credentials and use them at their leisure. Let's even make it difficult for users to clone their own credentials to share with other users. In addition to this protection, let's ensure that adding extra factors such as biometric authentication provides a stronger assurance of who the user is. Bringing keys and other secrets closer and closer to something that is physically attached to the user provides a stronger assurance of the identity of the user who just authenticated to the device.

Back to Top

What Is a Digital Identity?  .... '

Identity in Your Smartphone

Working some related topics here. we have a considerable opportunity now to have a universal device that can provide identity.   Need to make the credentials secure in the context that the individual needs or wants.

The Identity in Everyone's Pocket     By Phil Vachon

Communications of the ACM, January 2021, Vol. 64 No. 1, Pages 46-55  10.1145/3424262

Most every technology practitioner has a smartphone of some sort. Around the world cellular connectivity is more ubiquitous than clean, running water. With their smartphones, owners can do their banking, interact with their local government, shop for day-to-day essentials, or simply keep in touch with their loved ones around the globe.

It's this ubiquity that introduces interesting security challenges and opportunities. Not even 10 years ago, a concept like biometric authentication was a novelty, reserved only for specialized applications in government and the financial services industry. Today you would be hard-pressed to find users who have not had the experience of unlocking their phones with a fingerprint, or more recently by simply looking at the display. But there is more to the picture than meets the (camera's) eye: Deep beneath layers of glitzy user interfaces, there is a world of secure processors, hardware-backed key storage, and user-identity management that drives this deceptively simple capability.

Newer phones use these security features in many different ways and combinations. As with any security technology, however, using a feature incorrectly can create a false sense of security. As such, many app developers and service providers today do not use any of the secure identity-management facilities that modern phones offer. For those of you who fall into this camp, this article is meant to leave you with ideas about how to bring a hardware-backed and biometrics-based concept of user identity into your ecosystem.

The goal is simple: Make it as hard as possible for attackers to steal credentials and use them at their leisure. Let's even make it difficult for users to clone their own credentials to share with other users. In addition to this protection, let's ensure that adding extra factors such as biometric authentication provides a stronger assurance of who the user is. Bringing keys and other secrets closer and closer to something that is physically attached to the user provides a stronger assurance of the identity of the user who just authenticated to the device. ... " 

Emergence of Trust Tokens

Google buys in, likely create more acceptance.

Google’s ‘trust tokens’ are here to take cookies down a peg
The company plans to eventually phase out third-party cookies in the Chrome browser

By Kim Lyons in TheVerge

Google said earlier this year it would join other web browser companies to block third-party cookies in Chrome, and today, developers have their first chance to test a proposed alternative to tracking users across the web: trust tokens.

Unlike cookies, trust tokens are designed to authenticate a user without needing to know their identity. Trust tokens would not be able to track users across websites, because they’re theoretically all the same, but they could still let websites prove to advertisers that actual users — not bots — visited a site or clicked on an ad. (An explainer on GitHub suggests that websites could issue multiple different kinds of trust tokens, though.)  ... " 

BioAcoustic Signatures

Very novel approach.  Repeatable and low error rate?

The Bioacoustic Signatures of Our Bodies Can Reveal Our Identities
IEEE Spectrum   By Michelle Hampson

Researchers at the Electronics and Telecommunications Research Institute (ETRI) in South Korea have developed a biometric system that uses a transducer to generate vibrations and sound waves that can be used to identify individuals. After the sound has passed through the skin, bones, and other tissues, a sensor picks up the person’s unique bioacoustic signature. Analysis of the distinct signatures of individuals is boosted by modeling, which allowed the researchers to infer which structures of the human body actually differentiated people. The method, however, does not yet match the accuracy of fingerprints or iris scans for the identification of individuals.... " 

Seeking Digital Identities

Who are we?   In Quartz:

".... Microsoft thinks blockchain tech could solve one of the internet’s toughest problems: digital identities

Elitzer isn’t alone in his thinking. His firm is part of a group, including Microsoft, Accenture, and several startups, that launched the Decentralized Identity Foundation at the Consensus blockchain tech conference in New York May 30, with the goal of developing a system to reliably identify things on the internet. They think they’ll succeed because they’ll use blockchain technology, that same system catching the imagination of banks, corporations, and libertarians.

Blockstack, one of the foundation’s startup members, has released a set of programming tools and a handful of pre-made apps that would create a decentralized internet. Greater decentralization of the internet would place more control in the hands of the user—or more specifically, the user’s devices, instead of relying on clouds operated by the likes of Google or Amazon. “Every character you type is literally going to Google,” says Muneeb Ali, Blockstack’s co-founder. “But your device is almost like a supercomputer. We just need to upgrade the internet infrastructure to be more user-friendly.” .... "