<phil_long/t3/gu/csky...> Working through example use cases: starting with Issue First Aid Certificate. Not that far from what is currently done.
<phil_long/t3/gu/csky...> Walking through the use case...
<phil_long/t3/gu/csky...> Using a QR code contains the credential
<phil_long/t3/gu/csky...> Pre-conditions - instructor working for a company training first aid and Red Cross authorized
<phil_long/t3/gu/csky...> Red Cross has a website to take student info to generate a certificate that is embedded in a QR code and made available to the student
<phil_long/t3/gu/csky...> Instructor verifies the student; student passes the course is verified; this is uploaded and website generates the certificate with relevant detail.
<deb_everhart> the uploaded information could include the CTID for the course and the issuer for unique identifiers
<phil_long/t3/gu/csky...> Certificate could be emailed to Pat, or downloaded by the QR code.
<phil_long/t3/gu/csky...> Post-conditions - certificate received with expiry;
<dmitri_z> @IdentityWoman -- +1, good point. QR code credentials can be very useful, but it's definitely crucial to be aware of the downsides and limitations.
<phil_long/t3/gu/csky...> Points of Failure: Website must be available; Pat's gov ID not really checked and mis-issued to the wrong person.
<phil_long/t3/gu/csky...> Issue with QR codes is that the code is the credential. There isn't a differentiated verifiable presentation. Proof that sigs are there but not shared. The credential can be copied by anyone and hard to differentiate from the origina.
<phil_long/t3/gu/csky...> A bunch of problems with QR codes becoming the norm (as in the draft paper at the link above)
<phil_long/t3/gu/csky...> There isn't anyway to tell a QR code it "is" the credential, not individually verifiable at a given point in time (at presentation of it).
<phil_long/t3/gu/csky...> Digital to digital interaction was the original guide for verification processes. Never designed for the instance of QR codes and the challenges that paper credentials brings.
<eric_kuhn> We use QR codes to pass a URI that starts an issuance or presentation flow through SIOPv2 and OIDC4VP
<phil_long/t3/gu/csky...> Reminder Dimitri is working on DCC digital wallet using QR codes for getting credentials into the wallet and out of the wallet during presentation
<phil_long/t3/gu/csky...> Two types of QR codes. First, stuffing the entire credential in the QR code, and second, one that has just a URL, that starts a credential request flow.
<phil_long/t3/gu/csky...> The latter does address some of the static vs. interactive problems
<identitywoman> like snacks without the s! (so cute)
<phil_long/t3/gu/csky...> Dimitri is coordinator of TrueAge project, National Association of Convenience Stores (NACS), with underage purchase use case, using VCs to try and solve that.
<phil_long/t3/gu/csky...> One of the components of that does use QR codes. The use of QR codes in that program pairs with encrypted driver's licenses, photo IDs and other fraud detection methods.
<phil_long/t3/gu/csky...> Matthias - issue of the deadline by which VC-Edu need sthe use cases. They are needed here for VC-Edu by end of Nov.
<phil_long/t3/gu/csky...> There is a name change planned for EBCI (sp) but we'll address that another time.
<kerri_lemoie> Will follow up with Matthias re: EDCI name change
<phil_long/t3/gu/csky...> EK - use cases and QR codes discussion is being co-mingled. The later is more about the initiation of the transfer process of the issuance flows.
<phil_long/t3/gu/csky...> QR codes can be used for an use case initiation and flow.
<phil_long/t3/gu/csky...> For VC-Edu he is thinking more about what schemas are appropriate. Are we taking the schema of open badges and putting it into a QR code and leave interoperability to be solved later?
<phil_long/t3/gu/csky...> Looking to use cases to help the alignment of use cases to Verifiable Credential's data model so that edu use cases and credentials can be used as the VC Data Model requires.
<phil_long/t3/gu/csky...> PDL - Edu use cases in some examples use the data models of 'credentials' for things beyond the assertion of a capability and more in the context of providing guidance and on the progress through the achievement.
Matt Lisle: Re: picking my use cases up next week... sounds good to me ✪
<kerri_lemoie> Thanks @matt!
<phil_long/t3/gu/csky...> Use case first aid certificate a proof of a qualification.
<phil_long/t3/gu/csky...> Occupational qualification for work.
<phil_long/t3/gu/csky...> Goal of the primary actor is to qualify for promotion/raise.
<phil_long/t3/gu/csky...> Actor has a QR cert of a VC; company needs employee with that credential issued and valid; company recognizes the VC is appropriate to meet the work requirement
<kerri_lemoie> (Link to the First Aid proof use case)
<phil_long/t3/gu/csky...> Pat presents paper cert showing that they have met std first aid qualification is valid; canned QR code is recognized as representing the valid issuance; the system would recognize this into the HR system of the company, and the HR system would qualify the person as meeting the requirement for the raise and automatically update the payroll process to bump his salary.
<deb_everhart> thank you!
<phil_long/t3/gu/csky...> Points of Failure: pat has outdated certificate; smartphone app cant' scan the QR code; HR system cannot verify the VC on the cert; HR system does not recognize the cert claimed in the VC as meeting the qualification; Pat's name in the VC is not the same as the name of the employee in the HR system.
<phil_long/t3/gu/csky...> Is this subject to the same cautions re: QR codes as the last one?
<phil_long/t3/gu/csky...> Same cautions about the use of QR codes as the last one.
<phil_long/t3/gu/csky...> (aka first aide credential issuance)