19 KiB
| published |
|---|
| false |
Existing ID Standards Based Tech
Explainer
Identity not SSI
- FIDO: Everything You Need to Know About Fast Identity Online
- Directory of Products That Assess Identification Documents and Verify Identity Version 2.0
This Directory is designed to provide an overview of providers’ solutions which use government issued photo identification cards, combined with biometric facial scans, to establish Digital Identity.
Built on standards: OAuth 2.0 and JWT
See the presentation at https://self-issued.info/?p=2167.
-
101 Session: UMA - User Manged Access by Eve Maler and George Fletcher
-
Police in Latin America are turning activists’ phones against them
Experts say that seized devices have become a trove of information for authorities cracking down on social movements and opposition leaders.
“I want to sound a note of caution around approaches that are centered around user control. I think transparency and control are important. I think it is really problematic to put the burden on consumers to work through the markets and the use of data, figure out who has their data, how it’s being used, make decisions … I think you end up with notice fatigue; I think you end up with decision fatigue; you get very abusive manipulation of dark patterns to push people into decisions.
Few pause to think that their phones can be transformed into surveillance devices, with someone thousands of miles away silently extracting their messages, photos and location, activating their microphone to record them in real time.
Such are the capabilities of Pegasus, the spyware manufactured by NSO Group, the Israeli purveyor of weapons of mass surveillance.
-
NSO rejects this label. It insists only carefully vetted government intelligence and law enforcement agencies can use Pegasus, and only to penetrate the phones of “legitimate criminal or terror group targets”
We can’t solve identity. There will never be a single identity that we use across the web. Instead, there may be open protocols that allow us to auth with different providers.
Arizona, Connecticut, Georgia, Iowa, Kentucky, Maryland, Oklahoma, and Utah are among the first states to bring state IDs and driver’s licenses in Wallet to their residents
- Decentralized Finance & Self-sovereign Identity: A tale of decentralization, a new paradigm of trust
- How Social Engineering Has (And Hasn’t) Evolved Over Time auth0
In short: you can deploy all the technological measures you want, but unless you address the human element, an attacker can defeat your defenses with a simple phone call or email.
- My Take on the Misframing of the Authentication Problem Kyle Den Hartog
If you haven’t read this paper before you design an authentication system you’re probably just reinventing something already created or missing a piece of the puzzle
- [...]
can anyone point me to an academic research paper or even some user research that tells me the probability that a user’s password will be discovered by an attacker in the next year? What about the probability that the user shares their password with a trusted person because the system wasn’t deployed with a delegation system? Or how about how the probability will drop as the user reuses their password across many websites? Simply put I think we’ve been asking the wrong question
SMS (Short Message Service) messaging¹, despite a number of material challenges, has broad adoption, international regulations, and support across platforms.
Visa’s leadership in global payments and identity services as well as their longstanding commitment to standards will be of great value as we tailor our strategy to this moment.
- Self-Sovereign Identity Working Group European Blockchain Association in collaboration with the European Commission
Right now, many enterprises and organisations are building their own SSI solutions by implementing the existing standards and protocols. Since all these parties do similar work and have to face similar problems, it is critical for the community to share these learnings and experiences openly.
- Participate in Alberta's First Verifiable Digital Credentials Pilot ATB Ventures and Govt Alberta
As a part of the pilot, you will add your MyAlberta Digital ID as a verifiable credential to your mobile digital wallet (on your smartphone) and use this digital credential to open an ATB Pay As You Go Account - Digital Credential account with ATB Financial.
“OpenID Connect is one of the most adopted identity standards, providing essential functionality to core solutions across the industry,” said Vittorio Bertocci, Principal Architect, Auth0.
Magic Login Form represents a new onboarding experience for end-users, so we wanted to revamp our own onboarding experience for developers to match. Learning about auth can quickly derail any developer’s good day. Striking the balance between good UX and good security can just boggle the mind.
This article shows how to implement FIDO2 passwordless authentication with Azure AD for users in an Azure tenant.
- What is Knowledge-based Authentication (KBA)? Ping Identity
When you set up a new account, you are often asked to create a password and choose a security question and answer (e.g., What is your mother's maiden name?). Answering security questions based on personal information when you log in to an app or system is called knowledge-based authentication (KBA).
This is a story of a politician who cried “hacker” after a reporter informed a state agency that sensitive information was embedded in their website’s HTML source code1. While we wish this was a joke or fictional story it, unfortunately, is not. If the state of Missouri does move forward with the prosecution this state action would sound the alarm for researchers and reporters resulting in a chilling effect on the practice of responsible reporting.
The paper documents the international movement towards Open Banking, Open Finance, and secure, consent driven access to all user data. It describes the OpenID Foundation and in particular the Financial-Grade API (FAPI) Working Group’s experience with Open Banking ecosystems internationally.
-
Charting an Accelerated Path Forward for Passwordless Authentication Adoption FIDO
-
The paper introduces multi-device FIDO credentials, also informally referred to by the industry as “passkeys,” which enable users to have their FIDO login credentials readily available across all of the user’s devices.
-
Open Badges is now on the plateau of productivity Doug Belshaw
We’re no longer in the stage of “imagine a world…” but rather “here’s what’s happening, let’s talk about how this could be useful to you”.
Our understanding is that during January 2022, hackers outside Okta had access to an Okta support employee’s account and were able to take actions as if they were that employee. In a screenshot shared on social media, a Cloudflare employee’s email address was visible, along with a popup indicating the hacker was posing as an Okta employee and could have initiated a password reset.
The OpenID Foundation is pleased to share its new whitepaper, “Open Banking, Open Data and Financial-Grade APIs”. The paper documents the international movement towards Open Banking, Open Finance, and secure, consent driven access to all user data. It describes the OpenID Foundation and in particular the Financial-Grade API (FAPI) Working Group’s experience with Open Banking ecosystems internationally.
by definition, screen scraping requires storing a user’s financial system passwords in clear text. Nonetheless, you can bet that every system that integrates with payroll systems, and almost every system that integrates with banks (at a minimum), uses the technique. The US has badly needed open banking style standards for years.
Disasters in the World of Data
-
Facebook Is Receiving Sensitive Medical Information from Hospital Websites
-
Facebook and Anti-Abortion Clinics Are Collecting Highly Sensitive Info on Would-Be Patients
-
Tech on Juneteenth: Some tech firms perpetuate modern-day slavery by using prison labor
Women’s Rights and Technology Intersection feel very poinient this week
Democrats who have been misguidedly attacking Section 230 of the Communications Decency Act need to wake up now. If they don’t start listening to the warnings of human rights experts, sex workers, LGBTQ+ folks, and reproductive rights groups, Democrats could help right-wing zealots achieve their goal: mass censorship of online content about abortion.
- On Abortion and Data MyData
A basic insight of MyData is that the current systems of data are asymmetrical, imbalanced, and unfair. A basic motivation of MyData is to fix this by addressing business, legal, technical, and societal aspects of those systems.
Identity not SSI
- Fixing Web Login Phil Windley
Like the "close" buttons for elevator doors, "keep me logged in" options on web-site authentication screens feel more like a placebo than something that actually works. Getting rid of passwords will mean we need to authenticate less often, or maybe just don't mind as much when we do.
In this beginner-friendly guide, I'll give you all the tools and knowledge needed to integrate the Ceramic Network into your Web 3 dapps.
The Ceramic Network is a decentralized data network that aims to bring composable data to Web 3 dapps. There are many types of data that Ceramic can work with, but for this guide we can treat Ceramic like a decentralized NOSQL document database.
From our past work in this area, we have seen that slow and steady wins the race: for new policies, practices, and technologies to become part of workflows, staff need to be able to learn how to use new tools and incorporate them into their daily work practices — and be supported in doing so.
- WHAT WE’VE LEARNED THROUGH OUR SUPPORT FOR ORGANISATIONS WORKING ON BUILDING DIGITAL COMMUNITIES The Engine Room
Maintaining an online community is a lot of work, in both the short term and the long term. It requires setting aside time, human resources and tech infrastructure to keep things running smoothly. Here are some questions and ideas that can help you assess what it may take to maintain the online community you’re trying to build:
- How passkeys pave the way for passwordless authentication
- InfoCert has been recognized Representative Vendor in Gartner’s Market Guide for Electronic Signature 2022
- GBG: The State of Digital Identity 2022
- Security and satisfaction: Gaining from The Great Switch
- Digital identity’s next step: Mobile and alternative data
- Identity fraud: It’s a matter of when, not if
- Young adults: The biggest victims of identity fraud?
- Fraud and financial services
- Time to build trust in a digital world
Bad News
-
Widespread Okta phishing campaign impacts over 130 organizations
-
Security pros say the cloud has increased the number of identities at their organizations
-
Experian Joins iProov and Deloitte in UK’s Digital ID Program
-
Rohingya seek reparations from Facebook for role in massacre APNews
The platform, Amnesty says, wasn’t merely a passive site with insufficient content moderation. Instead, Meta’s algorithms “proactively amplified and promoted content” on Facebook, which incited violent hatred against the Rohingya beginning as early as 2012.
Under federal rules taking effect Thursday, health care organizations must give patients unfettered access to their full health records in digital format. No more long delays. No more fax machines. No more exorbitant charges for printed pages.