JWT is already a thing, as is X.509, OAuth/OpenID, WebAuthn... Just use a combination of these that best fits your use case.
"But this new standard will be the true unifying one". Nope, it will not. The most it will do is get some share of usage and add to the chaos.
VCs can be represented as JWTs (read the spec), issued with X.509-based PKI issuers, extended with JSON-LD, and further ride on top of exchange protocols defined at OpenID for issuance/presentation. So, indeed it is a combination that best fits your use case, this is just another tool in the belt.
This will turn the whole billion dollar kyc/identity verification space upside down.
I work in that space.
My country of citizenship has been issuing PIV(?)-based smartcards for more than a decade now, yet almost nobody could (and still can) verify them within the country, let alone abroad.
On the other hand, the EU digital Covid certificate project managed to get pretty widespread adoption in a short timeframe – with a vastly simpler technology stack backing it.
I'm really hoping the eIDAS project or a similar private initiative manages to use that momentum and bring (hopefully private) ID verification to the web. Whenever I "verify my identity" for a request to my bank by attaching a photo of my driver's license to an email, something in me dies...
That is most likely specific to your country and it's approach to deployment, your politics. Estonia mandated the availability of smartcard/PIV/mTLS authentication and it's now very widespread. Also really easy and free to implement.
> let alone abroad.
That is unwillingness to follow the EU standard from some EU countries and wish to reinvent the wheel (e.g. BankID and similar). I know that eIDAS-compliant PIV/smartcard implementations are cross-compliant e.g. Finland-Estonia-Latvia-Lithuania. But code-stealing Polish implementation for example isn't.
> On the other hand, the EU digital Covid certificate project managed to get pretty widespread adoption in a short timeframe – with a vastly simpler technology stack backing it.
Each country were given most of the stack required, they bypassed a lot of bullshit many countries have with software development.
> I'm really hoping the eIDAS project or a similar private initiative manages to use that momentum and bring (hopefully private) ID verification to the web.
When PSD2 required 2FA for banking, we had had it for more than five years at that point. So there is hope some EU legislation smooths these things out at some point, but it's going to be quite late.
Now they might not be running their own infrastructure, but they still have to be the one who authorized the credential to be minted. A faux digital National ID card issued from a random social network will likely not let you get access to government services or let you open a bank account, even if the data itself is all correct.
It is more likely that you'll have "trust frameworks" describing technical and logistical interoperability, and verifiers will accept any issuer that falls under that umbrella. In the US with driving licenses and state identification cards for example, that would likely be AAMVA.
This has the potential to eradicate several major avenues of fraud. The more of this is offered (for free) by governments the more it could majorly disrupt (=destroy) the industry around the topic.
Worldwide it seems there is a new, proprietary wallet each month, which naturally totally ruins this idea of having one wallet, but I see what is currently going on as a "storming phase" or almost "norming phase" already, that will eventually reach the "performing phase", with one or two wallets being the survivors. A big stumbling block here is that everyone involved wants a piece of the cake.
The European Union is actively (but slowly) working on this, e.g. with eIDAS. With eIDAS, you create a digital identity in your home country. If that home country DI offering supports eIDAS, you can use it to login to any other government AND private service implementing any DI offering that supports eIDAS.
> whether identity providers / VC providers are going to be 5 big firms
The big firms will provide the ecosystem (e.g. Microsoft Entra, mastercard-id-for-rp, ...), the real identity verification will happen through offerings like Onfido, Jumio and the 1000 other offerings in the space.
For example:
- date of birth: issued by your government and equivalent to your birth certificate.
- Occuppational credentials: issued by the relevant, government-authorized organization, like Engineers Australia or whatever.
- Driver's License: issued by the traffic authority in your country/state.
- Proof of Vaccination: this is interesting, as COVID showed... in my country, it was private organizations issuing that, but they had to be approve by the Government.
The only credentials the big social media companies can issue for you just prove you have a certain handle with them, I guess... which could be used for a more secure "Sign in with Google/Apple/GitHub" for example. But nearly all interesting credentials would be issued by real-world authorities, IMHO.
But yes indeed, private companies do not have much valuable credentials to offer. There just aren't that many categories of personal data you'd ever want to have in a wallet.
But who's going to trust those vendors? This is the job of the government IMO, one of the few things you just can't rely on the private sector for. I definitely don't want my birth certificate credential tied to, say, Google :D the Government cannot , for example, remove my credentials because I said something polemic, while Google (and infamously Twitter) most definitely can and seem quite happy to do if they can.
We will find out in the coming years...
https://www.w3.org/TR/vc-data-model/#json-web-token
The new thing about VC is that it introduces a mechanism for claims (which is what JWTs contain) to be made and presented in an interoperable way (requiring schemas for data, so multiple parties can make sense of claims without knowing each other), something JWTs cannot do by themselves.
Also, OpenID is being extended to support self-issued claims:
https://openid.net/specs/openid-connect-self-issued-v2-1_0.h...
VCs integrate with the existing specs, it doesn't compete with them.
Yes, you can get "partial" verification, like someone wants to know your age, and you can prove it without exposing all your other identifying information. With a centralised authority this is a pretty trivial thing. Nice to have it standardized I guess, but I don't see what's so exciting about it.
Cryptographic protocols are often defined in IETF/IRTF. You'll see things like Kerberos (authentication and attributes), OAuth (delegated authorization), and privacypass (anonymized authorization).
Many of these also have wire protocols too, such as OAuth describing HTTP API to get access tokens.
W3C has also defined some Web API for these concepts, for instance they have Web Crypto APIs as well as Web Authentication. But these concepts typically have split responsibility, such as Web Crypto being based on algorithms standardized in the IETF JOSE group, or Web Authentication being based on transports standardized under the FIDO Alliance.
So things tend to happen where they will be most successful, which means sometimes going to the place where all the right people are already participating.