Episode 227: Trust in Digital ID Ecosystems

Across the planet, Digital ID Ecosystems are being built using technology from all of us in this community. They all face common questions that no technology can answer: “Once launched... How do we ensure that the participants across ecosystems trust each other and the system? What end-user protections can we establish and enforce? As Verifiers/RPs join, how do they know what is expected of their PII data handling? In real-time, how to software components provide cautions and approvals to end-users?” In this conversation, we’ll break down the concept of trust, survey the types of global ecosystems, and start to hand back control to Federation Operators so that participants in their ecosystem behave according to federation values.

#Speakers

• Host: Mike Schwartz, Founder/CEO Gluu
• Guest: David Kelts, Identerati at Large

#Homework

• Google Doc: Trust Management: The Challenge
• Video: Defining Six Trust Relationship Vectors
• Article What we expect of Wallets
• One standards org looking at agents + humans: https://tida.community/

#Takeaways

• Issuance != adoption. Digital credentials have little value until enough relying parties accept it and deliver useful services. Whether that's opening a bank account, paying your taxes, verifying your personhood for a dating site... it's the use of the cred that drives the ROI.
• Trust is multidirectional. Users, issuers, relying parties, wallets, and readers must trust one another—not merely validate a credential’s signature.
• Federations define the tools and rules. The "tools' are the technical bits like protocols, schema, and cryptography. The "rules" describe the legal agreements, business processes (like enrollment), compliance frameworks and other non-technical bits. Eve Maler likes to say the "BLT" - business, legal techincal... similar idea.
• Relying parties may fund the ecosystem because they gain the most value from the federation. Issuers might see adoption as ROI if the goal is to improve citizen's lives. Market expansion, lower liability, fraud reduction, and potentially lower insurance costs provide stronger incentives and may help catalyze an federation ecosystem.
• Data federations go beyond identity. It's not just about access. Data has strings--obligation, and privacy obligations. Most identity federations (post WiFi federations like EduRoam), have increasing complexity with regard to handing the data federation aspects.