{"id":10142,"date":"2024-11-22T02:44:01","date_gmt":"2024-11-22T02:44:01","guid":{"rendered":"https:\/\/banking40.ro\/?p=10142"},"modified":"2024-11-22T02:44:01","modified_gmt":"2024-11-22T02:44:01","slug":"i-am-a-person-the-bank-says-so-if-you-want-to-know-who-i-am-ask-someone-who-already-knows","status":"publish","type":"post","link":"https:\/\/banking40.ro\/archive\/i-am-a-person-the-bank-says-so-if-you-want-to-know-who-i-am-ask-someone-who-already-knows\/","title":{"rendered":"I am a person: the bank says so. If you want to know who I am, ask someone who already knows."},"content":{"rendered":"<p>When you go to a web site and are asked to distinguish between a moped and a motorcycle or some stairs and ladder in order to prove that you are an actual person (rather pointlessly, as it happens, since robots are already better at doing these puzzles than people are) don\u2019t you wonder if there might be a better way? I mean, couldn\u2019t someone just tell the social media site, the internet dating app or the online review service that you are actually a person?<\/p>\n<p><em>an article written by David Birch, author, advisor and world-class keynote speaker on digital financial services. He will deliver a keynote speech at\u00a0<a href=\"https:\/\/banking40.ro\/archive\/\">Banking 4.0<\/a>\u00a0with the topic: The Real AI Revolution: (Hint: it\u2019s not robots in branches).<\/em><\/p>\n<h2 class=\"wp-block-heading\"><strong>The Botnet<\/strong><\/h2>\n<p>Pretty soon people will be in a minority online, if they are not already. Nearly half of all internet traffic came from bots last year and for the fifth consecutive year, the proportion of web traffic associated with \u201cbad bots\u201d grew (<strong><a href=\"https:\/\/substack.com\/redirect\/dc07b748-4ace-49b8-b929-705b81d65730?j=eyJ1IjoiMmt2ZGNvIn0.G-bsAWfu9uwNAvz_GhD17Ty2o1w-zQVujG2c-zJb5ns\" target=\"_blank\" rel=\"noreferrer noopener\">it is now a third of all traffic<\/a><\/strong>) while traffic from real human people continued to fall. We\u2019ve been fighting hard with spam filters and firewalls and what not, but AI means that our defences are about to be overwhelmed and pretty soon the majority of internet traffic will be bots talking to other bots. Without some significant changes in the infrastructure the web will be unusable and fade from human attention.<\/p>\n<p>(The Canadian author Cory Doctorow has a nice turn of phrase around this. He notes that since \u201cbotshit\u201d can be produced at astonishing scale \u2014 Amazon has had to cap the number of self-published \u201ebooks\u201d an author can submit to a mere three books per day \u2014 we are facing a crisis of\u00a0<strong><a href=\"https:\/\/substack.com\/redirect\/367fbdd5-d5c7-4cc3-b490-90a78a37a4d7?j=eyJ1IjoiMmt2ZGNvIn0.G-bsAWfu9uwNAvz_GhD17Ty2o1w-zQVujG2c-zJb5ns\" target=\"_blank\" rel=\"noreferrer noopener\">\u201dcoprophagic AI\u201d<\/a><\/strong>.)<\/p>\n<p>Whether it is about writing books, submitting reviews, finding a date online or anything else, the problem of knowing whether a user is a person or not is a problem that has plagued the Internet from the earliest days and there are plenty of initiatives underway to try and do something about it from Mr. Musk\u2019s blue ticks to Worldcoin\u2019s eye scanners, but none have yet transformed the mass market.<\/p>\n<p>I think that the solution has been obvious for many years though. Why not have some kind of certificate that attests to the fact that you are a real person and that can only be used by you? This is what identity people call a \u201cverifiable credential\u201d and I am very much in favour of the use of verifiable credentials that contain important attributes that are necessary to allow transactions to occur but that do not contain any personally identifiable information. A simple virtual identity with the credentials IS-A-PERSON and IS-OVER-18 would\u00a0<strong><a href=\"https:\/\/substack.com\/redirect\/6a5b2958-5d00-4696-9024-4c1e54f45ffc?j=eyJ1IjoiMmt2ZGNvIn0.G-bsAWfu9uwNAvz_GhD17Ty2o1w-zQVujG2c-zJb5ns\" target=\"_blank\" rel=\"noreferrer noopener\">serve most people for most purposes most of the time<\/a><\/strong>.<\/p>\n<p>Given that there are good reasons for thinking that the existence of an IS-A-PERSON credential might be the trigger for the evolution of a more comprehensive identity infrastructure suited to the modern age \u2014 because for advertisers, journalists, voters, shopkeepers and to many others, the IS-A-PERSON credential will be an essential prerequisite for all kinds of transactions \u2014 you might imagine that the problem has already been solved, but it has not.<\/p>\n<p>I remember seeing identity guru Eve Maler, the former CTO of Forgerock, give a keynote at the Identiverse conference and say that IS-A-PERSON is the most important credential of all. She is, as you would expect, absolutely right. So who will provide this critical element of digital public infrastructure?<\/p>\n<h2 class=\"wp-block-heading\"><strong>Who Says?<\/strong><\/h2>\n<p><strong><a href=\"https:\/\/substack.com\/redirect\/44ecd9f8-237e-4670-b53f-c3d2cf8d6d6e?j=eyJ1IjoiMmt2ZGNvIn0.G-bsAWfu9uwNAvz_GhD17Ty2o1w-zQVujG2c-zJb5ns\" target=\"_blank\" rel=\"noreferrer noopener\">There are plenty of candidates<\/a><\/strong>. There is the Post Office I suppose. And customers. And my doctor. In fact, there are lots of people who could testify to my existence. But a rather obvious place to start in the developed world is with my bank. So, when I go to sign up for something online, instead of trying to work out whether I am real or not by showing me indistinct pictures of American school buses, the web site can bounce me to my bank (where I can be strongly authenticated using existing infrastructure) and then the bank can send back a token that says \u201cyes this person is real and one of my customers\u201d. In other words, cryptographically unforgeable testament to the attribute IS-A-PERSON that can be easily verified by checking the digital signature. The bank should not say which customer, of course, partly because that is none of the web site\u2019s business unless I choose to tell them and partly because when the web site gets hacked it won\u2019t have any customer names or addresses: only tokens.<\/p>\n<p>This resolves a fundamental social media paradox: now you can set your social media preferences against bots if you want to, but the identity of individuals is protected. X, for example, could mark my account as of being of unknown origin (ie, I might be a human or a bot army) until it sees this attribute. Of course, X will want to see it in the form of a verifiable credential signed by someone who they can sue if it turns out I am not a person after all, but you get the point. So, when I sign up to X I am \u201cunknown\u201d. When they get a valid IS-A-PERSON credential from me, then my status changes to \u201cperson\u201d.<\/p>\n<h2 class=\"wp-block-heading\"><strong>Personhood<\/strong><\/h2>\n<p>The potential here is why I was so excited to see that a broad coalition of researchers from Harvard, Microsoft, MIT, the Decentralized Identity Foundation (DIF), and other organizations has\u00a0<strong><a href=\"https:\/\/substack.com\/redirect\/dcf9ea85-e766-4d77-a94f-51d0970f9a2f?j=eyJ1IjoiMmt2ZGNvIn0.G-bsAWfu9uwNAvz_GhD17Ty2o1w-zQVujG2c-zJb5ns\" target=\"_blank\" rel=\"noreferrer noopener\">put forward a major new proposal<\/a><\/strong>\u00a0for a digital credential that would give human beings a powerful new tool for proving their authenticity online, while also ensuring strong privacy. Rather than my IS-A-PERSON suggestion, they call it the \u201cpersonhood credential,\u201d or PHC, but the functionality is the same: a service provider (eg, my bank) issues me with a credential that identifies me by a service-specific pseudonym and attests to my existence but nothing else.<\/p>\n<p>Instead of asking me to distinguish a grainy photograph of a cod from a grainy photograph of a dogfish, a web site can simply ask my browser to provide a personhood credential: maybe I would then see a pop up menu of the relevant credentials, choose one (eg, my bank) and then use my face or fingerprint on my phone to confirm that is it my credential and away we go. Now the site knows that I am a person and even has a unique identifier that they can use for CRM (ie, the public key in the credential), but does not know who I am, thus providing\u00a0<strong>both<\/strong>\u00a0security and privacy with no need to compromise either.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>When you go to a web site and are asked to distinguish between a moped and a motorcycle or some stairs and ladder in order to prove that you are an actual person (rather pointlessly, as it happens, since robots [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":10145,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":"","_links_to":"","_links_to_target":""},"categories":[1],"tags":[377,111,379,378],"class_list":["post-10142","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-david-birch","tag-digital-identity","tag-digital-public-infrastructure","tag-is-a-person-credential"],"_links":{"self":[{"href":"https:\/\/banking40.ro\/archive\/wp-json\/wp\/v2\/posts\/10142","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/banking40.ro\/archive\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/banking40.ro\/archive\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/banking40.ro\/archive\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/banking40.ro\/archive\/wp-json\/wp\/v2\/comments?post=10142"}],"version-history":[{"count":0,"href":"https:\/\/banking40.ro\/archive\/wp-json\/wp\/v2\/posts\/10142\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/banking40.ro\/archive\/wp-json\/wp\/v2\/media\/10145"}],"wp:attachment":[{"href":"https:\/\/banking40.ro\/archive\/wp-json\/wp\/v2\/media?parent=10142"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/banking40.ro\/archive\/wp-json\/wp\/v2\/categories?post=10142"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/banking40.ro\/archive\/wp-json\/wp\/v2\/tags?post=10142"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}