Federation Trust Registry - Revision history

Tom: /* Problem */

2025-07-07T16:31:56Z

‎Problem

Tom: /* Self Sovereign Identities */

2025-04-17T16:28:57Z

‎Self Sovereign Identities

Tom: /* Problem */

2025-04-17T16:28:02Z

‎Problem

Tom: /* Europe */

2025-04-17T16:24:26Z

‎Europe

Tom: /* Europe */

2025-04-17T16:14:27Z

‎Europe

Tom: /* Europe */

2025-04-15T23:04:20Z

‎Europe

Tom: /* =Europe */

2025-04-15T23:02:41Z

‎=Europe

Tom: /* Accreditation Services */

2025-04-15T23:00:49Z

‎Accreditation Services

Tom: /* Is it Trustworthy */

2023-12-08T04:15:54Z

‎Is it Trustworthy

Tom: /* Is it Trustworthy */

2023-12-08T00:04:05Z

‎Is it Trustworthy

@@ Line 14: / Line 14: @@
 Standards must be implemented, potentially with a profile, to ensure that the result is "as consistently as possible, follows implementation guides and authoritative best practices published by the applicable standards development organization (SDO). Minimizing variation in how standards are implemented will make it easier for others to connect to Electronic Health Information. Further, to the extent possible, Electronic Health Information stored in health IT products should be structured and coded using standardized vocabularies."<ref name='tefca'></ref>
 ==Problem==
 *Users and participants in an [[Identity]] Federation need to understand in real-time whether any particular web site is conformant with federation rules. Or, in other words, the user must be aware of the rules that apply to their current activity.

@@ Line 30: / Line 30: @@
 ===Self Sovereign Identities===
-* [https://www.linkedin.com/pulse/ssi-illusion-why-crypto-identity-needs-governance-ott-sarv-rslue/?trackingId=WKi%2B7L4wVNZQ1r4XVOxqNA%3D%3D The SSI Illusion: Why Cryptographic Identity Can’t Replace Institutional Trust]
+* [https://www.linkedin.com/pulse/ssi-illusion-why-crypto-identity-needs-governance-ott-sarv-rslue/?trackingId=WKi%2B7L4wVNZQ1r4XVOxqNA%3D%3D The SSI Illusion: Why Cryptographic Identity Can’t Replace Institutional Trust] 2025-04-16 We gave users their keys. But we took away their rights. For decades, digital identity systems have swung like a pendulum—between centralisation, with all its institutional dependencies, and fragmentation, where interoperability becomes elusive. Into this equation came Self-Sovereign Identity (SSI), not quietly, but as a rallying cry. It promised something bold. Something human. Something free from institutional weight.
 ==Solution==

← Older revision		Revision as of 16:28, 17 April 2025
Line 28:		Line 28:

	One way to avoid [[Liability]] is for a sovereign state to require that some trust Registry must be accepted. The major problem with that is that means that security of the web would move at the speed of regulation, which is insufficient to keep the web secure.<ref>Vint Cerf, ''Concerns Regarding the Revised Article 45 of e-ID Draft Legislative Proposal'' https://storage.googleapis.com/gweb-uniblog-publish-prod/documents/Re__Concerns_the_Revised_Article_45_of_e-ID_Draft_Legislative_Proposal_xbnJTci.pdf</ref> While the particular problem described by Vint Cerf may not survive into EU law, the propensity of legislatures to mess with user's trust will surely continue to compromise the security of online commerce. See the wiki page "[[GDPR is a scam]]" for more examples.		One way to avoid [[Liability]] is for a sovereign state to require that some trust Registry must be accepted. The major problem with that is that means that security of the web would move at the speed of regulation, which is insufficient to keep the web secure.<ref>Vint Cerf, ''Concerns Regarding the Revised Article 45 of e-ID Draft Legislative Proposal'' https://storage.googleapis.com/gweb-uniblog-publish-prod/documents/Re__Concerns_the_Revised_Article_45_of_e-ID_Draft_Legislative_Proposal_xbnJTci.pdf</ref> While the particular problem described by Vint Cerf may not survive into EU law, the propensity of legislatures to mess with user's trust will surely continue to compromise the security of online commerce. See the wiki page "[[GDPR is a scam]]" for more examples.
		+
		+	===Self Sovereign Identities===
		+	* [https://www.linkedin.com/pulse/ssi-illusion-why-crypto-identity-needs-governance-ott-sarv-rslue/?trackingId=WKi%2B7L4wVNZQ1r4XVOxqNA%3D%3D The SSI Illusion: Why Cryptographic Identity Can’t Replace Institutional Trust]

	==Solution==		==Solution==

@@ Line 60: / Line 60: @@
 * QWAC = Qualified Website Authentication Certificates (QWACs), which are part of the EU's [[EIDAS 2.0]] regulation. QWACs aim to ensure that websites are genuine and legitimate entities, enhancing trust in the European Digital Single Market. There have been discussions between the EU Commission and browsers about the recognition and implementation of QWACs3. How are QWACs implemented in web authentication? Qualified Website Authentication Certificates (QWACs) are implemented as part of the EU's eIDAS regulation to enhance trust and security in online interactions. They authenticate websites by providing verified information about the identity of the entities behind them, ensuring transparency and legitimacy
 * [https://cabforum.org/uploads/20211014-ca-b-forum-entschew.pdf News about Qualified Certificates for Website Authentication] - Has the Gordian knot between QWAC and browsers been cut?
 * CAB Conformance https://certification.enisa.europa.eu/browse-topic/becoming-cab_en

@@ Line 59: / Line 59: @@
 ===Europe===
 * QWAC = Qualified Website Authentication Certificates (QWACs), which are part of the EU's [[EIDAS 2.0]] regulation. QWACs aim to ensure that websites are genuine and legitimate entities, enhancing trust in the European Digital Single Market. There have been discussions between the EU Commission and browsers about the recognition and implementation of QWACs3. How are QWACs implemented in web authentication? Qualified Website Authentication Certificates (QWACs) are implemented as part of the EU's eIDAS regulation to enhance trust and security in online interactions. They authenticate websites by providing verified information about the identity of the entities behind them, ensuring transparency and legitimacy
-* CAB https://certification.enisa.europa.eu/browse-topic/becoming-cab_en
+* [https://cabforum.org/uploads/20211014-ca-b-forum-entschew.pdf News about Qualified Certificates for Website Authentication] - Has the Gordian knot between QWAC and browsers been cut?
 ===Fraunhofer===

@@ Line 57: / Line 57: @@
 ===Accreditation Services===
 For high assurance Trust Registries, some sort of [[Accreditation Service]] is required to evaluate the members to assurance compliance.
-===Europe==
+===Europe===
-* QWACK
+* QWACK = Regarding "European QWAC," it likely refers to Qualified Website Authentication Certificates (QWACs), which are part of the EU's eIDAS regulation. QWACs aim to ensure that websites are genuine and legitimate entities, enhancing trust in the European Digital Single Market. There have been discussions between the EU Commission and browsers about the recognition and implementation of QWACs3. How are QWACs implemented in web authentication? Qualified Website Authentication Certificates (QWACs) are implemented as part of the EU's eIDAS regulation to enhance trust and security in online interactions. They authenticate websites by providing verified information about the identity of the entities behind them, ensuring transparency and legitimacy
 * CAB https://certification.enisa.europa.eu/browse-topic/becoming-cab_en

@@ Line 21: / Line 21: @@
 ===Is it Trustworthy===
-* There are schemes afoot across the globe by governments and organizations like [[Trust over IP]]. Evidence in 2022 is that the registries are not, in fact, trustworthy.<ref>Carsten Maple ''Exploring over-reliance on blind trust in digital IDs'' The Alan Turing Institute (2021-05-26) https://www.turing.ac.uk/blog/exploring-over-reliance-blind-trust-digital-ids</ref>
+* There are schemes afoot across the globe by governments and organizations like [[Trust Over IP]]. Evidence in 2022 is that the registries are not, in fact, trustworthy.<ref>Carsten Maple ''Exploring over-reliance on blind trust in digital IDs'' The Alan Turing Institute (2021-05-26) https://www.turing.ac.uk/blog/exploring-over-reliance-blind-trust-digital-ids</ref>
 * Can users get any signals from the federation that their interests are being supported?<blockquote>The [https://openid.net/specs/openid-connect-federation-1_0-28.html current OpenID federation spec] (2023-12) is designed to support the entities in the federation. While a Trustmark can be displayed to the user of one of federation's members with a link to some site, there is no way for the user to be sure of the actually identity of the site displaying the mark.</blockquote>