philarcher
commented
1 month ago I have a real problem with the title of this effort. Not the effort itself, but the title, which gives an entirely false sense of security.
Within the world of barcodes and RFID tags (Automatic Identification and Data Capture, AIDC), verification means verifying that the data carrier meets the standard (the PDF417 standard, the QR Code standard, the RFID Gen 2 spec etc.). That means that the bars/modules are the right relative size, there's the correct white space around it and so on. That's not what you mean by "Verifiable Barcodes" (in AIDC terms, all barcodes are verifiable).
Barcodes and RFID tags contain simple data. They are neither secure nor insecure. They're as secure as a Post-It Note.
The security and the verification of the data, comes in the software that reads and processes the data. A bad actor can create an application that reads a 2D barcode that contains a VC and then present the user with false information. That is, it deliberately ignores or misrepresents the data it has read. It just recognizes that it has scanned something and then it acts in whatever way it wants.
Finally, there's nothing in the 2D barcode that confirms that the code is an electronic version of the other info printed on the physical item. That's the world of secure printing, holograms, special inks and all that. Without secure printing, you can have a genuine PDF417 code on a fake driver's license.
In the sense of the proposed work item, it's not the barcode that is verifiable. It is simply that a VC is encoded within a 2D barcode and therefore its payload can be verified with the appropriate software. There are good reasons for doing this. But please don't call it a Verifiable Barcode. It's a VC in a barcode.
Therefore, I would strongly urge you to rename this to something much closer to "Encoding Verifiable Credentials in 2D Barcodes".
msporny
dlongley
Wind4Greg
simoneonofri
TallTed
wes-smith
wip-abramson
yashns
longpd
peacekeeper
New Work Item Proposal
Verifiable Credential Barcodes
Include Link to Abstract or Draft
https://digitalbazaar.github.io/vc-barcodes/#abstract
This specification describes a mechanism to protect legacy optical barcodes, such as those found on driver's licenses (PDF417) and travel documents (MRZ), using W3C Verifiable Credentials. The Verifiable Credential representations are compact enough such that they fit in under 150 bytes and can thus be integrated with traditional two-dimensional barcodes that are printed on physical cards using legacy printing processes.
List Owners
Work Item Questions
We are securing the 2D barcodes found on physical documents such as Driver's Licenses, employment authorization documents, and permanent resident cards using W3C Verifiable Credential technology.
Most 2D barcodes found on physical documents today, such as driver's licenses, are not secured using cryptography. This means that anyone can generate a fraudulent barcode using commonly available technology and no mechanism exists to verify the data encoded on most identification documents.
We protect the information in the 2D barcode with a digital signature that can be verified using a commodity smartphone or other broadly available hardware and software. This enables valid documents to be identified far more easily than what is possible today.
We have involved the retail industry, as well as federal and state governments in the work. This includes policy analysis, technical analysis, privacy analysis, and accessibility analysis. We continue to seek engagement in these areas by making this a W3C CCG work item, which has many people, across many industries and countries, involved in the vetting of the work items. We do also plan to take this standards track to ensure further analysis before the technology becomes broadly available to global society.
We are providing websites that individuals can use to try out the technology and provide feedback. We are presenting the work at in-person conferences and teleconferences.