Additional Scopes

[dickhardt]

We are exploring adding the following scopes:

Scope	Description
github	The user's GitHub profile url.
linkedin	The user's LinkedIn profile url.
ethereum	The user's ethereum address.

Would these be useful? Other scopes you would like to see?

[dickhardt]

We would prompt the user to link their GitHub, LinkedIn accounts, or their Ethereum Wallet.

Q: Would we require the user to complete the process before sending them back to your app? Or if they cancel, we would not include the requested scope in the scope claim in the ID Token? There is no simple way of indicating if a scope is optional vs required.

[ltd]

I'm +1 on this, and more in the future. It's huge value for the developer. Why not have dual flavors, required_github & maybe_github, for indicating if the scope is mandatory.

[dickhardt]

It seems you wanted a mandatory handle that could be either - ie one of GitHub or gitlab

To be spec compliant we would move to Json to express optional claims -- but I consider that a big step up for developers to understand

gitlab-optional was the scope format I was considering - but does not address the one or other use case

A simpler approach would be the app would offer the user to pick if they wanted to link github or gitlab - and then the scope is required at Hellō - ie user cancels or links a github account

[dickhardt]

We now support github, gitlab, twitter, discord where we return a JSON object

{
  "id": "<unique_user_id_from_service>",
  "handle":"<user_selected_handle_that_may_change>"  
}

[aslakg]

I'm trying to use this with rabbitmq, and it requires custom scopes: https://github.com/rabbitmq/rabbitmq-server/tree/main/deps/rabbitmq_auth_backend_oauth2

[dickhardt]

@aslakg you are wanting an access token (authorization) -- Hellō provides ID Tokens which represent who the user is, not what the user is allowed to do.

[aslakg]

Yes, unfortunately rabbitmq does both with the same mechanism. But I found a work around by aliasing the "openid" scope to their requirements. So feel free to delete my comments.

[dickhardt]

Glad you found a work around. Will leave your comment here for now as it may be useful to someone else.

[jimkleiber]

For years I've been wanting a way to verify the humanity of users on my platform. As AI takes off, I feel even more desire to be able to say "this account is matched to this verified human."

There are ways to verify identity through Stripe Identity and others, where they check one's passport or ID, but often these solutions provide all of the ID information to the platform.

I don't want all of that information, I just want to know if they're a verified human or not.

Is there any way to provide a scope for verified human? Or even verified name that matches their government ID?

I think some services would be interested in other information from that ID verification process, like verified 18+ age, or verified passport number for airline websites, but those aren't so important to me now.

If Hellō is to become an identity wallet, I think incorporating verified physical identities might help it stand out from the other SSO providers. I would trust Hellō with my passport info, not Google and Facebook and LinkedIn and less secure websites who ask.

What do you think?

[dickhardt]

Would you elaborate on the article you linked to?

Few people have an mDL on their phone, it is only available for iOS apps, and Apple heavily restricts which apps can access it -- so usage is nominal.

[jimkleiber]

For me it's not so much about Apple's current implementation of it, but rather a growing desire (by some) to have verified claims of identity on the internet. KYC has been there for a while in the banking sector, but there's growing desire in the UK and Europe for age verification and other verified claims.

I've seen other services that provide this, whether ID.me, Yoti, oneID.co.uk, etc., even providing claims like "over 18?" as a boolean.

I guess I just mentioned it because I remember you talking of verified claims before and I'm just curious/excited to see how the verified claims will work through Hellō. OneID, for example, charges 54p per identity verification and 16p per age verification, and as a developer, I could currently connect my app to OneID directly and pay that, or ideally, I could just go through Hellō and not have to deal with tons of OIDC providers or APIs.

[dickhardt]

Got it -- verified identity is on roadmap -- and we expect our pricing to be disruptive!

[jimkleiber]

I am very excited to hear that 🙂🙂🙂

And again, thank you for Hellō, I love it.

[jimkleiber]

Another (much simpler) request. Is there a scope for a short bio/description?

Almost every social media site uses short profile bios/descriptions and I think it'd be really nice to be able to manage that from my Hellō wallet.

Also I see Twitter and Github and would make a request for Instagram and LinkedIn. And if we're asking for a lot, then Bluesky and Threads as well.

The reason for the social media ones is to kinda do Keybase did back in the day: better prove one's identity by showing more proof of the accounts they control.

Lastly, in this vein, to maybe show if they manage a specific domain name. Not sure if this could be a scope tho.

[dickhardt]

We had bios when we were doing Mastodon -- the length of a bio and what goes in a given site sometimes are similar -- but people often have different ones for different sites

linkedin and instagram don't allow us to get a users handle unfortunately -- threads is in the same boat -- we might be able to do BlueSky -- but it social is not a priority at this time -- Twitter has yet to be asked for

[jimkleiber]

Hmm. I think with Clubhouse back in the day, when someone logged into Instagram thru Clubhouse, they were able to show the verified IG handle, but maybe I'm mistaken.

Really just trying to say "this Hellō account owns this IG account" but maybe that's not possible right now.

Yes bios can be different lengths and have different requirements, which might be annoying. And yes people can prefer different ones for different sites. But a huge benefit I see in Hellō is being able to write a few different ones and choose which one I wanna use and where I wanna use it. Just how nicknames and photos work right now.

What about preferred username?

Again, different sites have different requirements for this, too, but I'd hope some would standardize a bit over time, especially if Hellō takes off.

[dickhardt]

not sure why we are not exposing preferred_username as a scope -- we are gathering it