Page Comparison

...

Tuesday, October 25

Agenda:

• Report writing – Sovrin Foundation questionnaire answers discussion

Attending: Eve, Thomas, Matisse, Kathleen, SteveO, Thorsten

Meeting logistics: Just a reminder: No meeting this Thursday. Also, when we take up meeting again next week, UK and Europe clocks will have changed, but US clocks won't have, and US Pacific is our normative time zone (see timeanddate.com for "summertime skew" details...). Please keep an eye on and/or subscribe to our calendar!

New book: Don't miss Thomas's new book, called Trust::Data: A New Framework for Identity and Data sharing! Wow. Congratulations!

Sovrin answers: You can find them in your inbox or in the email archive. See also the paper Thorsten mentioned in email.

Overall, Eve's question for each use case, differentially, is: How much does limiting the risk of a "pure public blockchain technology" approach impact the goals of the use case, and particularly in our case where the use case goals are for empowerment? E.g., for some fintech use case where you want to speed up business and protect against legal risk, maybe limiting the "distributedness" of the blockchain to your enterprise – that is, inside your firewall – could be fine. But for other use cases, that could seriously harm you goal. So for today, given that Sovrin has a goal of self-sovereign identity, have they been able to successfully mitigate risk while enjoying/providing the benefits of blockchain ("walked the line correctly")?

"Self-sovereign identity" sounds like an extension of the previous notion of "user-centric identity".

Thomas's CoreID paper caused some people to accuse him of being a communist  for proposing a blockchain identity system that enables anonymous credentials. Eve's question is: What ecosystem that involves both individuals and services could function without at least some (probably the lion's share of) use cases of identified sharing?

There are some "anonymous authorization" (Shibboleth) and "claims-based access control" (UMA) use cases, indeed. (And notice that these use cases didn't require blockchain to be solved) But quite often, (empowered) service operators do need to know who they're dealing with among (currently disempowered) individuals. See Latanya Sweeney's research on the ability to re-correlate individuals from a few attributes; hence Eve's skepticism about ZKP approaches (which Sovrin criticizes as well). Users also have real incentives to share data with services in many cases because otherwise the services can't function.

Are there any services accepting Sovrin credentials yet? These are apparently called "stewards".

We looked at the Technical Foundations paper. The observer/validator/governance paradigm seems well thought out. Thomas noted that the widening circles of nodes looks like what Ripple has. The governance model could perhaps be a model/template for other use cases as well.

Not depending on IdPs sounds like a big benefit. People have been become persona non grata on various services that function as IdPs (such as being shadowbanned or outright banned on Twitter), or have been monitored by government IdPs. However, the reality of many service providers is that they rely heavily on these 30 social IdPs for a lot of what they do, both the user population and the information provided by these service sources. ("Social login" is when they rely totally on the incoming IdP for information, and "social registration" is when they explicitly collect additional information and do separate login thereafter.) What is the value proposition for these RPs?

Also, how would legacy "federated SSO" work (a la SAML or OIDC) in this new world?

AI: Everyone please continue to review the questionnaire answers (two sections left to go) and provide thoughts in email. We can send our questions to the Sovrin folks after our review is complete.

Tuesday, October 18

Attendees: ScottS, Kathleen, Matisse, Thomas, JohnW

AIs for Report:

• Text from contributors
• Terminology and definitions

Report to dos:

Kathleen working on HL7. Jim Hazard has been talking in UMA legal, with many similarities with FHIR work. Question is what will the Smart Contract look like, what will it do. Adrian also writing up text.

Kathleen: reach out to Jim for text. Also Adrian has text from the ONC Blockchain Challenge.

Thomas: anything missing from the Report? Kathleen: need a definition of SC. Scott: yes, we’re not quite there. Also expand to a list/taxonomy of definitions and terminologies for the report.

Potential Liaisons: groups that members of BSC are involved and list of relevant orgs looking at SC

• HL7
• GA4GH: Global Alliance four Genomic Health
• CommonAccord
• GTRI: Georgia Tech Research Institute
• OTTO: Open Trust Taxonomy for OAuth
• Federated Authorization
• Smart Contracts Alliance
• Kantara’s liaison with JTC1/ISO (Identity Assurance & Management)
  • UMA WG
  • CIS WG
• New ISO group on blockchains (ISO TC307)
• Sovrin
• JLINC protocol – JSON-LD may be used for SC.
• BlockchainCanada.org

AI: Thomas: start email thread on definition of SC.

Thursday, October 13

Agenda:

...

Adrian: how can we start a SC withiout placing the policies (driving the SC) into the public domain. Policies means the riles of access: If I'm Alice and I don't want share my rules/policies (about accessing my resources), how to do this in SC? In the UMA case, the rules/policies are in the UMA-AS.

Jim: an SC does not need to public.  In this case, Bob could take a shot and see if it works.

Adrian: there are lots of similarities between SC and UMA. Jim: the SC record codifies the legal text and executable. Thomas: yes there should be commonalities between UMA-AS and SC/Blockchains.  SC has "if-then-else" which are like rules of access in UMA for AS, RO and requesting party. A node could in fact add UMA-AS capabilities.

Kathleen: for the BSC report, we need to express some kind of "future roadmap" on how to get from here to there. Thomas: may be suggest some recommendation points.

Marc: need a development methodology, just Jim/thomas paper at W3C blockchain conference in May: https://www.w3.org/2016/04/blockchain-workshop/interest/hazard-hardjono.html. People in France are also struggling on how to get from current legal model to SC in the future.

Thursday, October 6

Agenda:

...