How do we assure real-world impact of the OWF Safe-Wallet SIG

[Oskar-van-Deventer]

Hi Andy,

Great initiative, which clearly matches TNO's "citizen protection" objectives.

Question: how do we create real-world impact that goes beyond yet-another beautiful whitepaper? At this moment, the European activities (EUDI Wallet, ARF, PID) seem to be on a dangerous track, doing opposite of citizen protection. So far, alarming reviews by digital-privacy organisations have not been addressed. Why/how could this OWG SIG achieve the desired impact, where others are still failing?

Oskar

[andy-tobin]

Good question Oskar. Having looked at a number of options for highlighting issues with existing and planned wallets, I determined that the best approach is to provide people with a tool that they can use to compare like-for-like. Hence this SIG.

This SIG's main output is an easy-to-handle checklist for wallet "safety". There will be an accompanying Best Practices reference paper and a technical paper. It will also be accompanied by outreach, press release etc.

Once such a tool is available, it will be possible to "score" the eIDAS wallet just as you can with any other wallet. I'm sure there will be plenty of people and organisations that will do such comparisons and bring into the light a lot of issues that are currently only understood by a small number of people. Once the big consultancies and niche boutique advisors start using the checklist and publicising the results I think we can expect to see the real world impact you refer to.

Note that nobody is expecting any wallet to score 100/100 at this point.

[Oskar-van-Deventer]

Hi Andy,

I like the "tool" approach. Nevertheless, that does not fully answer my question. How do we convince parties to use the tool, or to act upon a low x/100 score from a tool-based analysis by others, while those parties even ignore alarming reviews by civil-rights organisations?

Oskar