Don't forget a transparency log visible to the person, where it would be possible to audit who requested what assertions and what authentications were made, etc. This may even be public information (some statistics on what companies request what assertions) - to put pressure on not requesting needless crap.
You would also need a GDPR requirement that the user doesn't have to provide info he doesn't want to, and that is not a reason to deny service (e.g bar doesn't get to demand your age, only above 21 or not).
It also assumes that users providers will be forced to store information on your behalf (such as the knowledge that the user has been banned).
Re:Identity Is Dead
by miki123211 on Saturday June 15, 2019 @05:36PM
(#20192310)
This should be part of authorization, as I've said before. ANy provider proved of commutting fraud in that aspect would need to be banned, immediately. THis wouldn't even need to be a law, simple, app Store like guidelines would suffice.
1. ANyone with a public key can become an identity provider. Services will only work with a list of authorized providers, though. The list should be supplied by the govt, or some external, trusted org (like Visa for credit cards). When authorizing, data management policies and security should be reviewed, and policies should be enforced, i.e. how claims are verified, ability to port out to a different provider etc.
2. Organizations like the government would have some number or token, and the provider used by every citizen. Information about them, like their age, them being convicted, having unpaid depts etc. would be sent as cryptographically signed claims to the provider. To be authorized, a provider must promise to not reject any valid claims.
3. When authorizing with an external service, a request should be sent to the user's provider. Then, the user should be authenticated to it, shown what the service wants, and, upon approval, the request should be fulfilled.
4. Services would usually request assertions (fail if the conditions I've just sent you aren't true). Assertions could include:
- The user must have an age claim signed by the govt where age > 18.
- The user must not have a valid "has some credit problems" claim.
- The user has a citizenship claim from the state of California or the state of Nevada.
- The user doesn't have a "convicted" claim where date of conviction >= 2010.
- the user doesn't have a "banned" claim, signed by me. As a blog author, I could use that to not identify users across visits, but block spammers easily. - The user has a "personalInfo" claim from a government. This would be used to ensure that, in case this user does something really bad, a court could force the provider to link the token given to us to a specific, living person.
5. Services could also request capabilities, like the capability to send information to the user (without getting their email address), to get the same token across visits (which wouldn't be the default), to transfer $15 every month from their account for the Netflix subscription.
6. If there was no other way, services could also request access to information, like the user's home address for a pizza delivery service, or the user's location for Uber.
7. All requests could be one time or continuous.
8. All services would need central authorization for getting any sensitive data.
This model wouldn't make the user experience suck, provide the companies with what they need, and npt expose too much data unnecessarily.