Poor Man Verified ID

Issue/Topic: Poor Man’s Identity Verification

Session: Wednesday 2G

Convener: Jon Webb

Conference: IIW-11 November 2-4, Mountain View, Complete Notes Page

Notes-taker(s): Jon Webb, Dan Miller

Tags:

Verified Identity, anonymity, delegated authority

Discussion notes:

Brainstorm format:

What do people want to verify? How to prevent account sharing that degrades quality of service for the network and other users?
 * Confirm address
 * Employment verification
 * Job role verification
 * Jon Webb Sony Playstation wants verification that the user is who they claim to be and that it hasn't changed since the last time seen (Playstation has 50mm+ users)

Q: did people consider delegated authorities?

A: People have less need to share account information since they can delegate use appropriately

e.g. edit timesheets on another’s behalf, manage parental consent for minors, allow trusted users to conduct banking activities Noted that systems to implement delegated authority have really only been deployed in the enterprise space, not much in the consumer space. UX in consumer space is a concern. Pat From Equifax. Studying parental consent issue. Verifying 1.5mm users per day. Community filtering of sex offenders is common. Allan from HP presented an interesting approach at last year’s IIW that had to do with provisioning with an unguessable URL Need to keep it low friction. You could put additional challenge response cycle Pat: You need very little info to verify ID. But it depends on the problem you're trying to solve, what kind of data and what do you need to verify, it comes down to what's the business case Verification generally happens out of band Password maps are hard to transfer between users. They are a personalized image where elements of the image are the password Multifactor to avoid How to assert ID without promoting a way for them to share the id Discussed credit cards as an imperfect form of identity