Subject: [apps-discuss] Initial inquiry: P2P identity authentication

From: DataPacRat <[email-masked]>
Date: Sat, 29 Jun 2013 23:27:38 -0400

Over on the vcarddav and pkix WGs, I'm in the middle of proposing a
"signed vCard" extension to the current vCard format. I'm hoping to
use that as the basis for a distributed, peer-to-peer identity
authentication system; one that doesn't rely on email addresses as
personal identifiers, or on any particular third-party authorities.

The webfist extension to webfinger would be just about ideal, save for
its reliance on DKIM-verified email addresses. Would I be correct
that, as this WG seems to be the home of webfinger, this would be the
mailing list to start discussing an upgrade or fork of webfist? If
not, might I ask for a recommendation of where I should go instead?

Thank you for your time,
--
DataPacRat
"Then again, I could be wrong."

---

From: DataPacRat <[email-masked]>
Date: Sat, 29 Jun 2013 23:58:11 -0400

On Sat, Jun 29, 2013 at 11:48 PM, Melvin Carvalho
<[email-masked]> wrote:
> On 30 June 2013 05:27, DataPacRat <[email-masked]> wrote:

> Sounds amazing.  We desperately need identity that does not rely on email.
>
> Do you have a pointer to your proposal?

At the moment, not really. At this stage, I'm still focusing on the
signed vCard format, and am paying attention to infrastructure mostly
to have a better idea of what needs to be included in the vCard
extension. (My three most recent messages to vcarddav -
https://www.ietf.org/mail-archive/web/vcarddav/current/msg02758.html ,
 https://www.ietf.org/mail-archive/web/vcarddav/current/msg02760.html
, and https://www.ietf.org/mail-archive/web/vcarddav/current/msg02761.html
- cover the rough outline of what seems to be required there, though I
welcome any and all constructive criticism.)

Thank you for your time,
--
DataPacRat
"What can be asserted without evidence can also be dismissed without
evidence." -- Christopher Hitchens

---

From: Nat Sakimura <[email-masked]>
Date: Sun, 30 Jun 2013 13:14:23 +0900

So it sounds a bit like X.509 or ID Token in OpenID Connect (JWT + JWS) in
a different format.

Through what kind of user interface t the user is going to use it?

2013/6/30 DataPacRat <[email-masked]>

> _______________________________________________
> apps-discuss mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/apps-discuss
>

-- 
Nat Sakimura (=nat)
Chairman, OpenID Foundation
http://nat.sakimura.org/
@_nat_en

---

From: DataPacRat <[email-masked]>
Date: Sun, 30 Jun 2013 00:27:41 -0400

On Sun, Jun 30, 2013 at 12:14 AM, Nat Sakimura <[email-masked]> wrote:
> So it sounds a bit like X.509 or ID Token in OpenID Connect (JWT + JWS) in a
> different format.

At least one main difference between what I'm hoping to achieve, and
what X.509 currently does, is that X.509 relies on Certificate
Authorities which are implicitly trusted. I'm trying to lay the
groundwork to allow anyone and their grandmother to act as ad-hoc CAs,
with a few Bayesian tricks to allow easy evaluation of the
trustworthiness of any such authority or the certificates so
authorized.

> Through what kind of user interface t the user is going to use it?

One of the use-cases I hope to accomplish is for an end-user to click
on a link leading to a signed vCard file (or possibly the JSON
variant, jCard) stored somewhere, which fires up their preferred
contacts/email software, which then works through the authentication
hash, the authority's authentication hash, and so forth, to arrive at
a final trustworthiness score to present to the user. (For a few
mathematical reasons, I favor using a logarithmic unit called
'decibans' for that score, which in most practical cases, can be an
integer between -127 and 127.)

Another of the use-cases is for somebody participating in a Tor-hosted
chat forum to be able to easily assert their identity over a
Tor-hosted IM client, such as by pasting a signed vCard (linked to the
forum identity, rather than an email address) inline in the chat
window, which the contact software can evaluate as above.

Thank you for your time,