Digital Identity Bill - Harmless or the start of something sinister?

Coming back to this early on New Years day as everything is quiet across the house here and relaxing.

My understanding is the desire for wider uptake of RealMe across private enterprise rather than solely focusing on Government Agencies.

There are many constraints with RealMe as it stands today in regards to who can use it and how the data can be leveraged. These issues include (but are not limited to)

They only use SAML rather than moving to OpenID Connect for modern authentication providers even though they just went through a like for like migration from Forgerock to Microsoft B2C which natively supports OIDC.
Even after you are onboarded as an agency all you get in the SAML Response is a FLT aka random number which is meaningless and only really proves you were able to login via RealMe which anyone can do with an email address so you as a target agency still need to verify who the user is as all that RealMe has provided "A user was able to login" and potentially the agency has offloaded 2FA controls to RealMe. If you used RealMe to login to MyCovidRecord and weren't a Verified Identity you would notice you still needed to provide DL/Passport to MoH and MoH verified your identity on the spot instead of RealMe.
If you are going for the high level "Verified Identity" login in RealMe only a small percentage of the population have bothered to do it, granted with MoH supporting Verified Identity will have no doubt gone up, but the barriers for using Verified Identity is far higher than standard RealMe login.

The other problem is Banks and large utilities think they can get into the Identity game as they have the customer base which is really what this trust framework is all about, my concern has always been even with banks you have a mortgage with do you want them to know you have logged into various other sites. It's the same issue with Google / GMail or Social Providers. Plus in a true decentralised identity model you can't easily move between providers as it's all blockchain nonsense whereas that disregards that humans are inherently will forget their password so recovery of the account is always required so the private keys need to be kept somewhere.

IMHO the only option is RealMe, they could innovate more and potentially other orgs could adopt it but there is zero chance it will be mandated for access to NZ based services.

And if you ever wanted an examples of what the clearly deranged would do you just need to read the outdoors party response.

https://www.parliament.nz/en/pb/bills-and-laws/bills-proposed-laws/document/BILL_116015/tab/submissionsandadvice

gzt

David321

BarTender