Verified Claims

From IIW
Jump to: navigation, search

Canonical use case: proving you are over 21, you are a frequent flyer gold member, etc. (see Dick Hardt's Identity 2.0 video)
University of Washington:

  • proving student status so that they can get deals from companies, e.g. download software from Microsoft
  • lots of other educational use cases: prove student graduated, transcript, faculty status
  • a bunch of universities have agreed on a common schema format
  • why not just verify email domain? Email namespace aren't all students, only a good approximation
  • how do you deal with appeals: i am a student, but the system doesn't verify me correctly. There are lots of edge cases, always need customer service.


Charles Schwab:

  • Want to see if they can accept openid or info card, but how can they trust claims? Worried about user's country of origin, credit history, terrorist list.
  • Can we leverage a charles schwab account (which has pre-verified a bunch of attributes) and use it elsewhere?
  • Can we make it easier to create a charles schwab account using verified claims elsewhere?


beenverified.com

  • example of a startup trying to intermediate verified claims
  • costly and unclear why RPs should trust this site


Other Topics:

  • How long should claims be valid for? Do we need continual audits (e.g. elevators / gas pumps audited regularly). Depends on cost model, e.g. if insurance is expensive, maybe can afford to do regular audits.
  • Assertions can be "local" -- institutions will be different depending on where the user is. (e.g. US has DMV, but other places may not.)
  • Some folks looking at leveraging trusted sources of social data. Allow user to e.g. claim linkedin profile, facebook profile, etc and generalize that to a credential.
  • Story about the lack of credentials in Wikipedia. SJ claimed to be professor of comparative religion and won a bunch of edit arguments. When he took up a job at wikia, he had to reveal himself (24yo).
  • How do we trust claims -- how do we know some party is authoritative? How do you verify security of the entire stack, down to network and device level?
  • We need common schemas for verified claims, to be used with openid/saml, etc.
  • We need out of band agreements between RP and authoritative verifier



- Vince Wu (vwu@google.com)