We're live with Aktionariat! Join our  [/investors](/investors) and become part of the team that builds the sovereign web.

Try [SEAL](/seal/mail) for mail with your next message, just add _seal@vereign.com_ to **BCC** of your next e-mail.

Vereign_Logo_ICON_BLACK.png

## Berlin
### 7. - 8. September 2022 

Dr. Felix Greve, our COO, was delighted to participate at the GXFS Connect 2022: Von der Idee zur
Innovation mit Gaia-X». This German speaking event took
place 7 and 8 September in Berlin.

Around 500 people were on-site or joined the livestream as the key actors behind Gaia-X gathered.
Among the speakers were high-ranking officials from the economy and government. It was extremely
encouraging for us at Vereign to see what innovations are made possible with the hard work we put into
key components for the overall SSI software stack. Also it was very satisfying to see that political
officials of the German Federal Ministry of Economic Affairs (BMWK) took it on themselves to attend
and appreciate the organization, use cases and the technology behind it.

![gxfs2022-2.jpg](/uploads/gxfs2022_2_f62803d66b.jpg)


Just weeks ago **we concluded the first implementation phase of the Organizational and Personal Credential Manager** just as well as the necessary Trust Services ([https://gitlab.com/gaia-x/data-infrastructure-federation-services](https://gitlab.com/gaia-x/data-infrastructure-federation-services)). These previously missing SSI key functionalities were highly anticipated and appreciated by the technical community. A special moment for us was when even the official representatives of the German ministry mentioned, they heard that the code quality is very good.

#### We strongly believe in data sovereignty, to see how our contributions are enabling the mission of GAIA-X in an actual real-world SSI ecosystem is at the core of our company values and goals.


![gxfs2022-3.jpg](/uploads/gxfs2022_3_3ede735601.jpg)


**For further information**:
- [https://www.gxfs.eu/follow-up-report-gxfs-connect-2022/](https://www.gxfs.eu/follow-up-report-gxfs-connect-2022/)
- [https://www.gxfs.eu/de/gxfs-connect-nukleus-fuer-europas-datenoekonomie/](https://www.gxfs.eu/de/gxfs-connect-nukleus-fuer-europas-datenoekonomie/)
- [https://www.gxfs.eu/de/rueckblick-gxfs-connect/](https://www.gxfs.eu/de/rueckblick-gxfs-connect/)


gxfs2022-3.jpg

Vereign @ GXFS Connect 2022

### On Tuesday, the 10th of December we held our second Ask Me Anything (AMA) in our Vereign Telegram group. The AMA was hosted by our Community Manager, Ivan Dzheferov, and the questions were answered by Pete Herzog, who is the co-founder of ISECOM and one of our advisors. Below we have put together an overview of the main questions for you: 

## Please could you introduce yourself briefly Pete Herzog?
I am the Managing Director of a security research nonprofit. I do OSSTMM, Hacker Highschool, advising, presenting, and a little go-go dancing - but I am not good at the last one.

## During 2019 data breaches are still a growing problem. What should individuals and organizations do to protect their online identities?

Eeeeep! They are a growing problem. But the problem comes from 2 places: we are getting less effective at cybersec despite more tools being available and better. Secondly, identity is a really really hard problem because it is so weak. The weakest of all aspects of security. And it leads to most other security controls breaking like authentication, non-repudiation, and even subjugation.

How do we improve it? Improve how identity is stored and shared so it is much more accurate. And secondly, train people in security analysis to make them more effective with the products that do work well.

## What would you say to the global issue of identity when it nation states take it upon themselves to dictate what the identity can be? Looking at China in this case.

The global governments have ALWAYS controlled identity. It is a social construct and controlled by social construct they ALL dictate it. China is just getting a bad rap over it because, you know, the dictatorship, oppressive government thing in our news.

Identity needs to go back to the people.

_**How could Vereign help in that direction?**_
Vereign is a federated network built on open protocols and open systems using an open database (blockchainy-ish) to keep records. It falls in our hands to conserve our identity and the people we share it with to propagate that trust in a p2p fashion, much like we do in real society. You are only you because of the people around you who know you IRL. That makes who you are. Not because a card says so.

_**Sort of how GPG/PGP's web of trust tried to do?**_
Similar but with more modern understanding of communication protocols and controls. 

## Can people manage identity, though? Governments are managing identity not simply because they can, but because they are a natural "stamp of existence". Is there an independent, trustworthy way to confirm that person X is indeed person X, and not person Z? You need a sufficient amount of witnesses to confirm person X is X, but then these witnesses also need to be trusted. And in the end if you go to a bank that doesn't know you, or to request a driving license, will the bank rely on a) the word of a few strangers it doesn't know b) the stamp of a government.

We have to because the Government sucks at it. If they did not commit fraud it would not be the LARGEST problem we have. We cannot have centralized identity because we cannot have centralized trust. That is the biggest weakness in identity today. Your folks did not commit fraud when they named you. But you could still do so in reporting who you are to government census/offices.

The government identity thing only works for the people who think it works. For the rest there is corruption, fraud, black money, and a whole host of other unsolvable problems without better identification.

## In a world of synthetic identities, impersonation attacks, deep fake voice and video, how do we know who is real online?

Currently, we cannot easily. We like to trust that most is and most people are nice but that just is not really something proven. Actually, at this point there is no reason to just have your IRL identity online. I recommend you fracture it as much as possible and be many selves in many online places so that you cannot be centrally tracked and doxxed. At least until we have a valid identity system in place and non-repudiation can hold people accountable.

## Are digital identity and data breaches so intertwined, or are they separate problems? You can do a SQL injection to extract incorrectly stored credits cards without breaching someone's identity, government managed or not. And should not we solve the two problems separately.

Do not get me wrong, identity is not the solution to all problems nor is it the cause. Identity is just one of 12 necessary controls we know of and an integral part in at least half of all controls. So solving any one problem does bring us closer to solving others.

_Vereign_: Government identities are at the basis of a lot of the services we use necessary for modern day society to function. Identity checks are still necessary for some transactions, but in your private and professional life you only need to be sure you are talking to the same person or organization you have built trust with over time. We do add an aggregation of validations from trusted 3rd parties which can be reused across applications to verify details or aspects of the other side you are talking to to strengthen that trust.

What mechanisms are there (perhaps to be developed) to manage a 3rd party that goes rogue. Or is compromised in a manner that now is essentially sabotaging the system and perhaps bringing down the portion of the "web of trust". Since we can anticipate that, is there some thinking on how to address it?

_Vereign_: We currently have notifications and a tamper-proof audit log. You can see when someone is trying to misuse the functionality.

_Pete_: The best part of the audit logs is so that everyone else can see that we're not centrally capable of tampering with anything.

A 3rd party rogue happens all the time in the current system. We cannot address that if we do not have a federated system. With a central system it's impossible to manage or address in a timely manner. In a federated system it would be immediately rejected or marked as untrustworthy.

_**Interesting. It is not a byzantine general problem problem?**_
Kind of. The world is a trustless system and to be honest, I am not sure how much of it we can make trustworthy. I envision that, like in a real-world scenario, there will be huge swaths of untrustworthy identities who are trustworthy between each other but nobody else. We will not know until we grow the system.

Do you have more technical information on that (the tamper proof log)? E.g. is it using merkle proofs?
_Vereign_: You can read more about it in our White Paper "4. The Technical Solution"

## Speaking about identity: There is a saying “Nobody cares about backup, people only care about restore”. How do we secure our restoration mechanisms? They are a usual attack vector to all online identity systems.

That is a tough problem that requires maintaining the integrity of the stored data and the restored data while knowing if the data being replaced is legit newer data or garbage. There are so many kinds of attacks that restoration depends on intent— why are you doing this? We cannot secure it all so knowing the value of something, why is it there, allows us to apply specific controls and therefore actually have a shot of doing it well.

_**How does Vereign manage the restore?**_
_Vereign_: We use a "Social Recovery" mechanism. There are two or more trusted people from your verified live address book you can select to help you restore your access. Also there is a preventive mechanism for misuse of that functionality. There are also more features planned in the pipeline. It's not an easy thing to solve and there are not perfect solutions so far.

And what is that thing that you use to prove that you are you? A private key? How is it stored?
Pete: Part of the problem is that identity is both a human and physical thing that we need to tie to a "cyber" presence. For a lot of what needs to be done, globally the technology and the know-how is in its infancy.

_Vereign_: That is correct. It's stored on one or more devices you manage and protected with a second factor. Currently a PIN.

_**Isn't that hard from a usability perspective? People barely manage passwords.**_
_Vereign_: Keys are hard to manage, but in our case you do not really see them.

## One of the great improvements, but lately single point of risk on the internet are certificate authorities: How are they usually protected from attacks?

CAs have authority to sign on your behalf even backwards in time. Although secured to the best technological and organizational measures possible. 

_**You were part of co-creating an innovation with us on how to secure your signature, so only you can sign. Could you tell us more about it Pete Herzog?**_

Most commonly these are protected by authentication controls which are really weak. Sure, they layer the hell out of them but a broken identity will get through all layers at once. Which is generally how they're broken. In the last few years more is being done to add a physical layer and storing the keys physically away from the network in parts so that getting them requires the time to retrieve all the pieces and put them back together. That is actually a pretty sweet, innovative trick for protection.

First, they do not use the best security. It's not viable to do so neither monetary nor practically. Since CAs use a central trust, they can do whatever they want and clean up the logs. Good luck proving it was not you. Now you might think, why would they care to do that to me? Sure, you could think that. But there is a huge difference between risk and trust. They are selling trust but you are buying risk. That is the problem. Trust is what you have when you accept risk. You should not have to accept that much risk.

## In one of your initiatives “Hacker HighSchool” Pete, you teach kids cybersecurity skills and awareness. What are the top three things they learn applicable to us as adults?

Hackerhighschool.org was developed to teach teens to think for themselves. Hackers do that really well. They look things up they do not understand. They dig deeper. By understanding things you also see new perspectives. So the three things are: resourcefulness, empathy, and critical thinking. Probably not what you were thinking but really cyber safety and cybersecurity are a byproduct of those things. And the important fourth thing is the ability to learn from your failures. Perfect mix for any school child.

Vereign is also a community effort and we would appreciate your participation in our [Community](https://community.vereign.com/).

On Tuesday, the 10th of December we held our second Ask Me Anything (AMA) in our Vereign Telegram group. 

4402-Social-support-AMA-OG-1200x675-1-790x380.jpg

Ask Me Anything: with Pete Herzog Recap

georg-300x300.jpg

### On Thursday, the 6th of June we held our first Ask Me Anything (AMA) in our Vereign Telegram group. The AMA was hosted by our Community Manager, Ivan Dzheferov, and the questions were answered by one of our Co-Founders, Georg Greve, who is also the Chairman & Head of Product Development.

Below we have put together an overview of the main questions for you:

## When should we expect integration with Microsoft 365 and outlook?

We are slightly dependent on Microsoft in this because we would like to offer this as a supported option for existing Microsoft customers, such as the Canton of Zug, which wants to use Vereign. We have a contact at Microsoft who is currently finding the right people to work with on their end to make this happen in cooperation. Integration is not difficult. It only took Collabora a few days for LibreOffice. My guess would be sometime in Q3.

## Why did you first try to solve digital identity for email?
Digital identity is difficult. There are interesting pieces and approaches out there, but they often have a high failure rate. It boils down to an identity you cannot use for anything being quite useless. That sounds tautological but it seems to have escaped many people. We were looking for the most valuable use cases for a third party verified, self-sovereign identity with zero touch key management. Email was a clear winner: it was the only truly federated communication protocol out there. It is not dependant on a single company or group, there are multiple implementations, it is censorship resistant and much more.

Email is used by four billion people. Ninety-five percent of businesses depend on email as their primary means of communication. According to forrester, last year, more teenagers had email accounts than Facebook. This makes sense because email is the root identity for many other online identities by virtue of being used for password recovery. Therefore email is at the heart of most online identities. It is the world’s largest unverified identity database. That lack of verification brings some challenges, though. Business Email Compromise, invoicing fraud & co are at an all time high – and growing.

## Right now only email and phone can be validated in your beta app… How exactly are you going to verify other data in the live version, such as name, address, etc.?

We will be doing this via third parties as there is no “one size fits all” that would work globally. So you will be able to use your Zuglogin (the eID of the Canton of Zug), your SwissID, your RFID passport, or any other third party that can offer such verification and assurance levels. We are for instance already looking at the practicalities of integrating this with Yapeal.ch, a very cool challenger bank from Zurich. They have a great onboarding via mobile app. So you can start your onboarding via Vereign login with selective data disclosure to pre-fill the forms. You then receive the returned verified data into your Vereign identity.

_**What about other countries that don’t have access to this type of services? I assume you’ll be using KYC providers such as Onfido/Jumio?**_
Yes, we are agnostic in this because every country and culture may have its own ideas about how to approach this.

_**Will any of the scanned documents that users provide for this type of verification be retained somewhere?**_
That will in part depend on the verification provider. You could for instance even use existing functions, like a notary, to do higher level verifications. I believe they would usually keep a paper copy in their safe. Other 3rd party onboarding providers might also store such data for a limited time (GDPR applies, obviously) as part of the regulatory requirements the government has placed upon them. As for our solution: users will of course be able to retain a scan of their ID card or other document (potentially with verification) in their personal storage as that may be very useful.

_**Hmm, regulatory requirements would apply if the verification was being done by a regulated business, such as a financial services provider. They shouldn’t be required to keep the documents under any regulation as the verification is not done for a particular purpose… However, if using the Vereign identity for regulatory purposes is a potential use case, some framework for that needs to be put in place.. and negotiated with regulators I guess.**_

Yes, exactly. Banking is a very real use case for what we’re building. A lot of banks would love to be able to communicate with their customers over email. Because right now they are usually sending messages in online banking. Which most customers happily ignore as the message counter goes higher and higher. So the account managers have started sending text messages to the customers “please look at your online banking messages, I’ve left you something important.” Both customers and banks hate that currently approach.

Side note: It is even more complicated. You have two laws competing. One about retaining business records. The other one about deleting data as soon as possible as part of data protection. We’ve been looking at this in some detail – one of the perks of having a CISO of the world’s no 1 logistics company among the founders – but of course this won’t all be implemented in the Minimum (!) Lovable Product.

## What is the chance of digital identity to go deeper in real life and maybe replace the current monolithic ‘hardware’ ID cards?

That may happen at some point. In a way Vereign will make these hardware tokens (a.k.a. passports) portable in a sense, but knowing the speed at which politics moves, I think that may take a while to become “official”. This is not a terrible thing because there is a huge area for which “inofficial, but robust” is “good enough”. Just like you do not really need qualified electronic signature all the time. An advanced electronic signature with a solid identity grounding will be extremely useful already – and cover 90% of the cases.

## Why do you coin Vereign as a new service category? Why has nobody built something like this?
At this point, there are fragmented identities that are owned by the companies that provide them to us. Vereign puts user-data and control into the hands of the people. It is a useful, verified identity that allows users to take control of their identity in a way that you can take authentication and selective data disclosure toward third party services. If you combine that with the zero touch key management that creates one-time keys for every interaction, and you have a kind of function that has not existed before, which is why it is so hard to find a name for this. The true power becomes apparent once you realise this seamlessly integrates into any existing application or service. Peer-to-peer interactions create live connections between people – on equitable terms that are determined by the people as they connect, which creates a sort of “social fabric”. The first steps of that will be a magically, self-updating, verified address book of all the people and organisations you are interacting with, but a lot more will be possible on this basis. As to why nobody has built this yet… We have not had all the ingredients in the past. Things become more obvious only after someone has done them first.

## We would appreciate if you have any further questions to get in touch with us and also be part of one of the next sessions. Also, please feel free to join us on [Telegram](https://t.me/vereign) or in our [Community](https://community.vereign.com/) and ask questions.



On Thursday, the 6th of June we held our first Ask Me Anything (AMA) in our Vereign Telegram group. 

Vereign Blog | events

Vereign @ GXFS Connect 2022

Ask Me Anything: with Pete Herzog Recap

Ask Me Anything: Vereign Recap