Mission
Implementing digital trust services the right way.
ALBeID was founded to implement Digital Trust Services the right way. The business aim is to become a Qualified Trust Service Provider under eIDAS. Until then the mission is more immediate: to show citizens the right way of implementing digital services, and the control over them they are entitled to hold.
Two principles at war
For one and three quarter centuries, since a locksmith opened London's "unpickable" locks in 1851, two opposite ideas of security have competed. Security by obscurity says a system is safe when its workings are hidden. Kerckhoffs's principle says a system must stay safe even when everything about it is known, except the key. ALBeID takes a clear side.
- 1851The lock that could be picked
The locksmith Alfred Charles Hobbs was criticised for showing in public how locks thought unbreakable could be opened. His answer was that criminals already knew more than he could teach them. Secrecy only kept honest people in the dark.
- 1883Kerckhoffs's principle
Auguste Kerckhoffs wrote that a cipher system must not require secrecy, and must be able to fall into enemy hands without harm. Only the key stays secret. In 1949 Claude Shannon restated it at the foundation of modern cryptography: the enemy knows the system.
- 1990sLinux against Windows
The dispute moved to software. Open source bet that many independent eyes find flaws faster than any closed team. Closed software relied on keeping its code secret, and its critics called that security by obscurity.
- 2000sOpenness prevails
The encryption that protects today's internet, AES among it, was chosen in an open public competition, and every serious protocol is published for anyone to attack. Even Microsoft now supports Linux and publishes much of its code in the open.
Why openness enforces security
A design that depends on being hidden protects nothing. Its flaws remain, and only those who find them in secret can use them. A published design invites independent experts, critics and opponents to look for the flaws first. Every flaw found in the open is a flaw that can be fixed.
The only secrets ALBeID keeps are the ones that must be kept: private keys, which never leave the device of the person who owns them, and personal data. Design, code, policies, the versions actually running, the rules of governance and the tools to verify them are meant to be public.
European rules, and the risk of concentrated control
The European rules on digital identity, eIDAS and the EU Digital Identity Wallet among them, are inspired by human rights, citizen sovereignty and transparency. At the same time there is a visible tendency for large technology companies to use the same rules as instruments of concentrated, mass-scale control.
The pattern is not new. In the US antitrust case against Microsoft at the turn of the century, a phrase came to light that described the company's strategy towards open standards: embrace, extend and extinguish. Adopt the open standard, extend it with proprietary parts, and let the open version fade once users depend on the extensions. Open European standards for digital identity could meet the same fate: embraced by large platforms, extended with closed components, and turned into instruments of control.
The rules alone do not decide which future arrives. Implementation does. ALBeID follows the European standards to the letter, but compliance is not where its strength lies. Its strength is that every part of its work can be checked, evaluated, audited and confirmed, or rejected, without asking anyone's permission.
What the mission means in practice
- Publish the work. Design, code and rules are open to review by anyone, without arbitrary authorisation.
- Say what is proven and what is not. Every system states plainly what it guarantees and where its limits are.
- Separate compliance from recognition. No status such as qualified, certified or accredited is claimed before it is obtained.
- Declare concentrated control. Where power is still concentrated, including in the founder's hands, it is stated openly, together with the plan to delegate it.
- Welcome the critic. An auditor is not required to be a friend. An observer who verifies the same result strengthens it.
A note from the founder
I find the EU rules, eIDAS and the EUDI Wallet among them, inspired by human rights, citizen sovereignty and transparency. But I also feel the tendency of Big Tech to use them for concentrated mass control. Keeping things secret with the justification that it keeps them secure does not stand, in my view.
I know that this is the belief of many people around the world. By making my work public I hope many will join, and that, when the time comes, this page will change from the first-person singular to the first-person plural.
Armando Vrushi, founder of ALBeID OÜ
The principle
Nothing is accepted because it is declared.
Every person has the right and the real possibility to judge whether a declaration matches reality. The civic project behind ALBeID's work exists to make that principle ordinary.