Skip to main content

Using .gov Email Addresses For Age And Information Verification

Over the years we've experimented with ideas that leverage what can be thought of as civic trust infrastructure to address trust related problems on the Internet. 

Previously we created a browser extension and proxy service that allowed users to use access to their IRS Get Transcript ONLINE access as a way to procure trustworthy cryptographic ID certificates. 

Essentially treating access to the Get Transcript ONLINE service as automatic ID verification and using that to issue (via a web proxy) ID certificates. 

We also developed the trust relay protocol, a similar approach that leverages existing sources of trust as a means to address internet trust challenges.

These experiments ultimately lead to the development of the Certisfy app and service.

We have launched another significant experimental approach, leveraging .gov email addresses as a mechanism for bootstrapping a cryptographic trust chain. Think of this as a sort of web of trust implementation.

Ideally, organization level validation would be preferred over email validation but .gov email addresses come with robust vetting by the holder, thus one can think of them as a store of trust. 

We've enabled domain whitelisting on the Certisfy platform that allows holders of .gov email addresses to self-validate (via email or DNS) and procure a trust anchor certificate, thus enabling them to issue trustworthy certificates. 

In effect, if you have a .gov email address you can act as a certificate authority (CA) who can issue trustworthy certificates that can be used for information verification on the internet.

The process is simple:

  1. Create a trust anchor document (simple name/value pair) via the Certisfy app.
  2. Generate a certificate request (CSR) via the Certisfy app.
  3. Submit the request with email (or DNS) selected as your validation type.
  4. Check your .gov email for validation link and validate.
  5. If validation is successful, you will be able to download (via the Certisfy app) a trust anchor certificate that you can then use to issue (via the Certisfy app) trustworthy certificates.

Leveraging our existing civic trust infrastructure has an untapped potential for addressing all sorts of internet trust challenges. Consider these common internet problems:

  • Underage access to inappropriate content.
  • Ticket scalping.
  • Romance scams.
  • E-commerce scams.
  • Fake reviews.
  • Bot swarms. 

These are all problems due to the fundamental lack of an information trust infrastructure that is compatible with the internet. Internet compatibility has to include use-case coverage, technical scalability and a strong privacy profile.

The Certisfy platform implements an approach that has a strong privacy profile while facilitating information verification for virtually any type of internet/online use case, including even off-line use cases. 

Comments

Post a Comment

Popular posts from this blog

Trusted URLs Via Cryptographic Signatures

With Certisfy sticker functionality, ie the ability to publish cryptographic signatures as claims, users can share trusted URLs by leveraging the verification tied to trustworthy claims. URLs can be included in trustworthy claims and posted for anything for which a user wants to project trust. They can also be restricted to sources(ie referrer) so that the link can't be fraudulently reposted elsewhere. When you include links in a claim that you want to associate trust with, users will first be able to verify the link provider via the claim and then decide whether the link and associated information is trustworthy. In an AI saturated online space, there is significant value in a link/url being able to provide a strong signal of authenticity or trust. A trusted creator or a journalist can post links tied to a Certisfy verification as a means to project trust and expand reach. With verification links backed by high quality trust projection, we can have in essence a verified web. Here...
Post a Comment
Read more

Build Your Own Trust Chain

We have added the ability to create custom trust chains in Certisfy that are verifiable independent of the Certisfy PKI root. These trust chains will lack the identity component of trustworthy Certisfy certificate so owners of such chains are responsible for implementing their own identity procedures. Receivers of claims from such custom trust chains will have to whitelist (bookmark in Certisfy) the root certificate in order for claims from those certificates to pass verification. Use cases for custom trust chains are many. Software package supply chain trust There is currently an ongoing challenge around software supply chain security, ie developers integrate software libraries and components into their own applications and solutions are faced with the prospect of unwittingly including malicious vulnerabilities. The problem ultimately boils down to the difficulty of ensuring the people who have write access to these packages are trustworthy. This would remain an ongoing problem requir...
Post a Comment
Read more