Single sign-on: What we learned during our identity alpha
Reading documents like passports with an NFC reader does indeed work, and does indeed produce verifiable material. Specifically the passport has proof (via a digital signature) that it was issued by a specific authority, and in turn, proof that the contents of the passport (name, date of birth, a picture and so on) are as issued.<p>But, the problem here is that the issuer is the British government, so, what are you proving? &quot;Here, you issued this passport&quot;. &quot;Oh yes, so we did&quot;. I presume the British government does <i>own</i> a database of the passports they issued, so this isn&#x27;t news to them.<p>A modestly smart device, such as a Yubico device, is capable of providing fresh proof of its identity. My Security Key doesn&#x27;t prove &quot;The security key that enrolled me with GitHub in fact exists&quot; which is redundant - but &quot;I am still the same security key that you enrolled&quot;. However the passport can&#x27;t do that, your passport is inert, and the fact that Sarah Smith existed isn&#x27;t the thing you presumably want to prove to a single-sign-on service. You want to prove that you <i>are</i> Sarah Smith, something the passport doesn&#x27;t really do.<p>I think the GDS ignores this problem, which is to be fair no worse than lots of other systems, but the result isn&#x27;t actually what it seems to be, all the digital technology isn&#x27;t actually proving anybody&#x27;s identity in this space.<p>It reminds me of the bad old days of the Web PKI where it was found that the &quot;email validation&quot; being used would accept automated &quot;virus checking&quot; of email. A CA sends the &quot;Are you sure you want to issue a cert for mycorp.example?&quot; message to somebody@mycorp.example and even though Somebody is on vacation in Barbados for two weeks, the automatic &quot;virus&quot; check reads the URL out of the email, follows it, ignores the page saying &quot;Success, your certificate has been issued&quot; and passes it to Somebody&#x27;s inbox... All the &quot;security&quot; is doing what it was designed to do, but, what it was designed to do isn&#x27;t what it <i>should</i> have been designed to do, and so it&#x27;s futile.