What is the pragmatic three-tier scheme for attribute quality, and what is a state-confirmed attribute worth on an identity of trust level 1?
Self-declared (unconfirmed) attributes such as a title; confirmed attributes such as a postal address confirmed by the post office, an e-mail address or a mobile number; and state-confirmed attributes such as the date of birth. On a level-1 identity, a state-confirmed attribute is worth little, because nobody knows whether the person logging in is the person it was confirmed for.
* An attribute can never be more trustworthy than the login that delivers it. *
| Tier | Examples | Who vouches |
|---|---|---|
| Self-declared / unconfirmed | Title or form of address | Only the subject |
| Confirmed | Home address confirmed by the postal service; e-mail address or mobile number confirmed by a code | A third party that checked it |
| State-confirmed | Date of birth | A public authority |
The trap is to treat the attribute in isolation. Suppose an account holds a date of birth that the state has confirmed, but the account itself is level 1: self-registered, one password, no identity check. Anyone could have created the account, or could have taken it over. The RP then knows that some real person was born on that date, but not that the person in front of it is that person. That is why attribute quality cannot be judged independently of authentication quality: the weaker of the two caps the value of the claim.