The Evolution of the Digital Wallet: From Smart Cards to iPhone

The journey towards the modern digital wallet, culminating in solutions like Apple’s Wallet on the iPhone, has deep roots. Early explorations into digital identity and transactions can be seen in concepts like the Smart Card (see What is a Smart Card), and related ideas about digital cash and identity management explored in pages like My Wallet and CanDo. These concepts are connected to broader frameworks like the Prime Ontology, which deals with fundamental elements of identity and value exchange, predating and informing the architecture of today’s digital wallets integrated into platforms like the iPhone.

Passkeys the Future of Authentication

Several years ago I had the opportunity to sit on the FIDO Alliance Board. While there we debated the future of authentication and commissioned the work to develop FIDO 2. I walked away from that experienced convinced that multi-factor authentication should and now could replace the insecure use of passwords without a second factor like the use of our secure thing [device, card, or dongle], or our unique biometric(s).

Recent my colleague Jeff and I have been trying to understand how the various enhancements to Webauthn, FIDO 2, and CTAP will allow users to use multiple devices without having to register each device with its unique public private key pair.

As a result of our conversations and research, it is clear a single provider such as Apple can within their proprietary environment enable the ability to access a Relying Party RP from multiple devices with each challenge authenticated with one Public Key.

Concepts like Keychains and the use of secure chains enabled via BLE, Cable or QR code are clear. Ideas like Signed Assertions often appear as tools capable of proving the device knows of the existence of the Private Key resident in the secure element of one of the user’s devices.

the FIDO alliance is focused on solving these challenges

Fake truths the result of the digital no mans land

It is so easy to write blasphemous Tweets, or conspiracy nonsense. Our digital age has given those who cannot find love a channel to express anger and frustration. They expose their lack of empathy, and their inability to grasp the basic peace established Via love.

Tomorrow Immutability and Trustless is this what we want?

2 words immutability and trustless. 

Such big words. The idea something is once written can never be changed, altered, or deleted as well as elegant. Or that there is no need to worry about anything, what is presented simply is one instance of knowledge not until more than two can be found is there the possibility of trust. But if more than a few assemble and not sure then!

In a trustless environment, there is no single entity that has authority over the system, and consensus is achieved without participants having to know or trust anything but the system itself. A definition from one of the major institutions helping to establish this new.  New what?

https://academy.binance.com/en/glossary/trustless

It is the removal of relationships so they can be replaced by something, no someone new that is bothersome.  Words like usury invade reality, and a few get very wealthy as the mass spend to survive, always being driven to need more. 

We have lost the ability to commune.  We lost track if the responsibility to be good stewards of the garden we were given responsibility for .

Central Bank Digital Currency – Someday Soon

https://modernconsensus.com/technology/building-digital-dollar-requires-private-sectors-help-fed-chairman/
Clearly, I am a bit behind.

Van Buren v United States

Date & Time:
Tuesday, June 29th, 2021
10:30 AM PT | 1:30 PM ET

Explained: A Legal Perspective on the Future of Cybersecurity Research

The Supreme Court’s Van Buren decision earlier this month aimed to clarify the ambiguous meaning of “exceeding authorized access” in the Computer Fraud and Abuse Act, the federal computer crime law.
In the context of protecting critical infrastructure from hackers, this particular ruling will define how we manage, report, and handle unauthorized access.
It also raises some foundational questions that, if weighed carefully, have the potential to foster a collaborative relationship between researchers and companies. How should good-faith researchers conduct themselves? Does this redefine the relationship between companies and hackers? Is every researcher considered to be in violation of CFAA if they’ve not sought permission to access a system?
Jared L. Hubbard and Christopher Hart have followed this ruling closely and worked on amicus briefs to aid the Court in this matter. They will discuss the case and answer questions.

Speakers:

Jared L. Hubbard, Partner, Fitch LP
Christopher Escobedo Hart, Partner, Co-Chair, Privacy & Data Security Practice – Boston, FoleyHoag LLP


Register on Eventbrite


Follow us on Twitter and LinkedIn to stay in the loop with updates!
Copyright © 2021 Voatz. All rights reserved.

Digital Identity and Authentic Relationships

When we think of investing in various businesses the goal, of course, is revenue. One of the keys to such success is loyalty. Loyalty is all about the relationship companies create with their customers and the revenue these relationships assure.

If the buyer has something the seller wants, in exchange for the good or service they desire, then a transaction occurs. The challenge is simple, each party defines the value of what they are providing or exchanging and presto the trade occurs.

When society grows and the complexity of what each of us produces and when our needs are not aligned to this process called barter, a means of monetization is established. Society creates a trusted means of exchange – pebbles, coins, money, a promissory note or now even, some would argue, cryptocurrencies.

In other words, society created an answer to enable the exchange of goods and services between parties, who do not have the goods and services the other party seeks.

With cash, coins or other tangible representations of value, commerce is easy. When society does not develop a secure and trusted means of facilitating the exchange of things commerce, innovation and a good life cannot be achieved. To this end, paper money is imbued with ‘value’ based on the integrity of the party issuing the physical or now electronic ‘money’. The addition of the word ‘electronic’ brings technology, computers, and networks into the conversation. One network, typically referred to as the Automated Clearing House ‘ACH’ allows banks to electronic instruct the movement of ‘money from an account at one bank to an account at another.

The addition of the word ‘electronic’ brings technology, computers, and networks into the conversation. One network, typically referred to as the Automated Clearing House ‘ACH’ allows banks to electronic instruct the movement of ‘money from an account at one bank to an account at another. The use of an ach check processing system for business transactions between vendors and customers has become increasingly common in addition to banks. The advantage of this system is that it usually allows businesses to transfer money automatically between bank accounts so that their payments can be cleared out in a short period of time.

In the 1958 Bank of America created Visa Inc., in 1964 the Wallenberg family created Eurocard, and then in 1966 a collection of banks banded together to create the Interbank Card Association, Mastercharge and now MasterCard.

These payment networks, by necessity, add complexity. They create the need to establish a two sided market. On one side the relationship with the buyer, consumer, or cardholder. On the other side if this market the seller, merchant, or retailer.

Issuance and Acceptance. Two words to describe the two sides of a network. It’s only when the two sides of the market have sufficient participants. Only at the tipping point, when critical mass exists, can one claim to have created a self-sustaining network. A network of people promoting use to buyers and a network of merchants willing to accept payment based on the terms and conditions defined by the network. Beginning at this tipping point, the network and it’s Brand blossoms. If either side of the market does not achieve critical mass, the network collapses.

Relationships – The oil of commerce

Any two entities familiar and trusting in the Brand, or each other, can easily establish a temporary relationship with entities associated with the brand. If one or more of the entities require anonymity increases the level of trust and recognition the Brand must establish with these participants.

In a digital environment, we are in need of mechanisms to share and establish trust across trillions of electrons. The two sides of a relationship, in other words, the market, will not take the time to understand or appreciate the need for network and endpoint security; until the risk exceeds a threshold understood by the participants.

The Artifact of Trust

When a mutually trusted set of parties gives the citizen, consumer, employee or courtier a letter, card, device or any uniquely registered object, and provides every acceptor with a reader capable of recognizing the trusted thing. Then the two parties are in a position to establish “trust”. The consumer has a thing which is recognized and trusted by the acceptor. This is often referred to as “What You Have”.

Once the thing is recognized by the acceptor, then, the process of identification and authorizations (the transaction) can take place. The object – the artifact – carries an identifier. It possesses unique characteristics. The object also possesses a means of assuring the acceptor the presentation of that identifier represents a unique representation of that identifier.

The simplest artifact of establishing “trust” is a handheld thing, be it a key, fob, card, watch, pendant, phone, earpiece. It does not matter what it is, all that counts is that the merchant recognizes it and that the consumer is willing to carry and present it.

Trust, for the merchant, means they can, according to defined procedures, recognize and authenticate the thing. They are then in a position to pursue a temporary and trusted relationship. What can be achieved during the time the relationship of trusted is bounded, is constrained by an additional layer. In this layer the consumer, the acceptor and any third parties address which the rights and privileges are to be granted or pursued. This is when the exchange, sale, conversation, tranaction, event or access is granted.

Is Identity Dead – The answer is Authentication

Today 2019-12-12 I found my way to the following article and associated podcast.

https://diginomica.com/fall-event-highlight-steve-wilson-says-digital-identity-dead-so-where-do-we-go-here 

https://www.constellationr.com/blog-news/identity-dead

Below is a flow of thought as I read and listened. to Jon Reed and linkedin.com/in/lockstep Stephen Wilson discuss this most interesting topic.

Surveillance Capitalism – So many are taking advantage of our data!

We need to evolve through the pony express stage of data management, and get to a point where there are responsible data intermediaries who are being held to account.

Identity management, for me, is about proving things about myself. I want to log onto a bank and prove that I have a particular bank account. Sometimes I want to log on and prove that I am the controller of a multi-party bank account with my wife. And sometimes I want to log onto a health service and prove my health identity. So this is all about proving things about me in different contexts.

In the podcast, they beg the question “Why is the Digital Identity problem still any issue”?  This leads one to think about the scale and expectation so many have surrounding this idea of “DIgital Identity”!

They then go on to ask the question What is two-factor authentication and remind us that our phone is a two-factor device, exactly what the standards FIDO Alliance worked to develop.  They remind us of the reality that people look after their phones.  We know when our phone is not with us.

Why not simply bind my identity to my phone.

Mr. Wilson sees the phone as the second factor.  I would suggest our devices, bond to our identity, is the primary factor.

Mr. Wilson reminds us that Identity is all about Verifying Claims. We claim to be someone and the relying party seeks to confirm that I am who I claim to be.  Or, when I seek to log back into a website, the relying party needs to make sure it is I – the same person who the relying party originally proofed, registered and agreed on an identifier and an associated means of authentication.  

Attributes are more interesting than Identity

Attributes are what matters in the various relationships we have when we interact with another.  As we think about our data we need to think seriously about what other parties need to know about us and what we wish to share with them.  Efforts in Europe to institute GDPR and the efforts in California to implement CCPA

As I continued to read and follow the thread I ended up at a W3C working group working on “Verifiable Claims” and found the following:

Abstract

verifiable claim is a qualification, achievement, quality, or piece of information about an entity’s background such as a name, government ID, payment provider, home address, or university degree. Such a claim describes a quality or qualities, property or properties of an entity which establish its existence and uniqueness. The use cases outlined here are provided in order to make progress toward possible future standardization and interoperability of both low- and high-stakes claims with the goals of storing, transmitting, and receiving digitally verifiable proof of attributes such as qualifications and achievements. The use cases in this document focus on concrete scenarios that the technology defined by the group should address.

The truth is that Identity Providers, as imagined, can’t deliver. Identity is in the eye of the Relying Party. The state of being identified is determined by a Relying Party (RP) once it is satisfied that enough is known about a data subject to manage the risk of transacting with them.

We are expecting people to be better than smarter than the crooks.  This is an interesting thought that begs the question.

How do “we the people” trust anything we hear, read or otherwise come across.

How does each of us keep up with all of the various products, standards, specifications and other efforts to develop stuff capable of securing our “IDENTITY”?

I am a firm believer in the work the FIDO ALLIANCE and W3C’s work on Web Authentication and recommend its adoption and use based on authenticators capable of adhering to a level of security certification commensurate with the associated risk of the acts, transactions, information, and services offered by the relying party to the user.

It is time to move to Multi-Factor Authentication built on a Restricted Operating Environment

Passwords should become a thing of the past. Here’s why

This morning one of my Google alerts found a blog coming from the World Economic Forum.  It reminds us of the inventor of the password Fernando Corbato.  In an interview with the Wall Street Journal, he said passwords have become “a nightmare”.

The open question is how do we solve for the nightmare of password management we have created that is both effortless and secure.

This article calls for private enterprise and our governments to find answers.  I hope in finding these answers capitalism and profit do not become the reason to act.  I hope social responsibility and community action drive all to find answers that are affordable, convenient, secure and more importantly consumer-friendly.