[HN Gopher] Irma: Open-source, attribute based credentials
___________________________________________________________________
Irma: Open-source, attribute based credentials
Author : jeroenhd
Score : 53 points
Date : 2021-01-23 13:13 UTC (9 hours ago)
(HTM) web link (irma.app)
(TXT) w3m dump (irma.app)
| woutifier wrote:
| I had an Irma card for a while, with a supporting Android app,
| must've been about 7 or 8 years ago now. Seemed to work ok'ish
| then (as a proof of concept). You could use it at some places in
| the university, although I can't remember what the use case was
| exactly (it was definitely the same thing though).
|
| Anyway, since they already had that 8 years ago, I don't really
| understand what the roadmap for this project is. I see it popping
| up every now and again.
| jeroenhd wrote:
| Some Dutch healthcare institutions are using it, but as far as
| I know that's about it.
|
| There's some development effort and every now and then a new
| demo pops up, but I don't think the project advertises itself
| enough when it comes to uptake.
|
| I can see massive benefits to all kinds of businesses,
| especially now that restricted items such as alcohol and
| cigarettes are being ordered online because of COVID measures,
| but sadly the uptake has been minimal so far.
| coldcog wrote:
| Here [0] is a list of projects that use IRMA. Indeed there
| are several healthcare institutions, but there is also
| https://irma-meet.nl which features authenticated video
| calling, and there are several municipalities that are
| planning to allow their citizens to log in using IRMA.
|
| In addition, we are cooperating with several institutions and
| governments, including the Dutch national government, on
| future IRMA projects. Given the differences of IRMA from
| other mainstream authentication mechanisms, however, getting
| parties and their end users ready to use IRMA can be
| complicated and takes time.
|
| [0]: https://privacybydesign.foundation/usage/
| Freak_NL wrote:
| Is IRMA still going to be relevant for healthcare in the
| Netherlands with the Wet Digitale Overheid law making
| authentication by means of the government issued DigiD
| credentials mandatory and all but making access via the
| ToegangsVerleningsService (TVS) authentication platform
| offered by the government a requirement for any citizen
| accessing their medical data?
|
| It seems only a matter of time before municipalities will
| face the same requirement for authentication. Where does
| that leave IRMA?
| coldcog wrote:
| Although developments have slowed down due to the
| pandemic and now the collapse of the dutch cabinet, the
| Privacy by Design Foundation and SIDN, who jointly
| develop and run IRMA, have been in talks and developing
| pilots with the Ministry of the Interior of the
| Netherlands to become an accepted party ("toegelaten
| partij") under the WDO. That would mean that when the WDO
| comes into effect, the ministry issues basic personal
| data to IRMA apps, and IRMA becomes one of the ways in
| which citizens can authenticate to services alongside
| DigiD.
| radicalbyte wrote:
| It - or at least IDEMIX - is being actively investigated for
| use in COVID Vaccine passports by a number of countries in
| the open source community.
| coldcog wrote:
| Hello, IRMA lead developer here.
|
| Since then we have mainly moved from smart cards to a mobile
| app [0], and focused on getting the IRMA server and frontend
| software production-ready and developer friendly. Additionally
| we have worked on connecting existing institutions and
| companies on IRMA; you have to have parties that issue and
| verify IRMA attributes before the project can be of use to end
| users.
|
| As to development, we have a public roadmap here [1].
|
| [0]: https://irma.app/
|
| [1]: https://irma.app/roadmap.html
| GekkePrutser wrote:
| I don't like IRMA because it makes it too easy for sites to
| verify identity (even though they don't get more information than
| what they ask for, and in some cases only proof that the
| attribute exists rather than the information itself).
|
| I just think it provides a 'sliding scale'. With IRMA it becomes
| much easier to validate identity. Right now sites have to ask for
| a payment or ID card which people are obviously very hesitant to
| provide. So websites only do it if it's really necessary.
|
| With IRMA it becomes too accessible. I don't want to ID myself
| every time I sign up for some hobbyforum or whatever. The
| internet should remain as anonymous as possible. IRMA makes it
| possible for websites to ask for identity information in a quick
| and painless way and that makes the actual asking more prevalent
| ("drempelverlagend" as we say in the Netherlands). More and more
| sites will add ID validation as a result.
|
| Personally I like the internet as it is.. There used to be a
| saying "On the internet nobody knows if you're a dog". We
| shouldn't strive to change this IMO. The problem isn't just that
| I want to ID myself in a privacy-conscious way. I just don't want
| to ID myself at all.
| radicalbyte wrote:
| With the current discussions development vaccine passports this
| kind of technology could become really useful.
| themihai wrote:
| How is this different than openID connect? It would be nice to
| have a table with pro/cons/differences of different protocols on
| that page.
| radicalbyte wrote:
| The privacy properties. With OpenID connect you have
| traceability - for example if it was used for a vaccine
| passport, and said passport was required to enter shops, bars,
| sports venues.. then it would be very easy for the companies
| implementing the "point of check" devices to track your
| movements.
|
| With IDE mix that isn't possible.
| formerly_proven wrote:
| Attribute-based credentials refers to cryptographic systems
| where someone can produce a proof that they fulfill a certain
| attribute. Canonical examples are things like an employee ID
| card, where the ID card can produce a proof that they're an
| employee, have clearance level X or are part of group Y
| _without the proof containing any information beyond that_.
| Another example would be things like national ID cards, where
| you could make a check for "is older than 18 years" and the
| system only receives a cryptographically-verifiable answer to
| that question, without being able to infer anything else.
| coldcog wrote:
| Indeed the attribute-based nature of IRMA makes it more
| general than OpenID Connect. Users can collect all sorts of
| attributes in their IRMA app, and then selectively disclose
| any subset of those attributes, as appropriate to the use
| case. This includes authentication like OpenID Connect (e.g.
| the user could disclose a username attribute), but also other
| use cases such as indeed proving that you are older than 18,
| or anonymously proving membership of a group (using
| unlinkability, see below), or providing authenticated
| personal data such as your address or date of birth.
| jeroenhd wrote:
| It doesn't serve the exact same intention openID does.
| Authentication is part of the spec, but its real power lies in
| the privacy properties IRMA provides.
|
| You can find a better global overview of the protocol and why
| it was created on this page:
| https://privacybydesign.foundation/irma-explanation/
| coldcog wrote:
| In addition to this, a more technical overview of IRMA and
| its features can be found here:
| https://irma.app/docs/overview
___________________________________________________________________
(page generated 2021-01-23 23:02 UTC)