Trust Issues: Why We Should Handle ORCID Trust Markers with Care and How We Can Improve Their Trustworthiness Through More Secure Workflows in ORCID Integrations

Initially developed to facilitate author identification, ORCID (Open Researcher & Contributor ID) provides persistent identifiers (ORCID iDs) to researchers and since has become an elementary part in research and academic publishing. Being a community-driven effort, that allows user generated content, one of ORCID's core values is trust. This is also reflected in the trust markers, which are placed on every entry in an ORCID record to assert its data provenance. Trust markers are usually organizations, that an ORCID record holder has authorized to update their record and act as a trusted party. During the authorization process, an access token which is required to update the ORCID record, is issued to the trusted party. This paper examines the trustworthiness of trust markers: on the one hand, access permissions and tokens can be shared between multiple services, on the other hand, token breaches are a well-known threat. Breached access tokens allow to modify an ORCID record in the name of a trusted party, thus invalidating the credibility of trust markers. We propose a secure approach for institutions wanting to share access permissions with multiple services. This will enhance the trustworthiness of ORCID's trust markers and increase their value to researchers and organizations.