4 ms·

Insufficient security at a national level has been frontpage of hnews all this week from various countries: Turkey, USA, Malaysia, Mexico, &c. From this and ma

by deepnet 10y ago

Insufficient security at a national level has been frontpage of hnews all this week from various countries: Turkey, USA, Malaysia, Mexico, &c. From this and many other leaks and breaches from companies, governments & institutions one could deduce security is imperfect & digitally massively so. Identity theft is rampant; Biometrics are irrevocable - yet the solution is used by most people everyday. Cryptography solves both the problem of identity and privacy simultaneously. It is establishable as persona via chains of trust, e.g. PGP signing. Apart from societal control there seems no good reason not to adopt a system whereby everyone is issued a private and public key - which signs every email, bank instruction, comminucation & vote. Akin to good practice being to store only password hashes so only the individual posses the secret. Ones identity would be ones own responsibility and huge leaks like this would reveal nothing but a list of public keys obtainable by crawling the web. One can imagine a dystopian future nation where individuals must fight to protect their basic fundamental rights from state level adverseries operating outside the law - punchline is the worst threat is their own government. Ever since Gibson the best science fiction is set in the present.

ghughes 10y ago
> Apart from societal control there seems no good reason not to adopt a system whereby everyone is issued a private and public key - which signs every email, bank instruction, comminucation & vote. Privacy and key loss are two reasons that come to mind.
- deepnet 10y ago
  I am not sure I follow your reasoning. Key loss would require re-issue - under the present system that uses real details or a biometric these cannot be revoked so cryptography seems better. The current system the UK uses is a Nation Insurance Number, which is just a key in a government database but once issued it is not revokable either. Solutions like a back up reissue key, or quorum of those who signed you key verify it is lost and then it can be resissued, or an trusted official like ones lawyer - or you have to take some ID to a post office. It may be inconvenient but less inconvenient than identity theft today. As for privacy this is solved by crytography too, so I don't follow your first point. If I wanted to message you privately, I encrypt the message with your public key and then you and only you can read it - just like PGP today. Of course this hypothetical system unbackdoored cryptography would be fully legal so we could have keys just for privacy between us / or verification. A bank could issue a key per account, the key ensures your banking cannot be eavesdropped and ensures the identity for this account.
icebraining 10y ago
Some countries are already implementing that - for example, in Portugal, the Citizen's Card is a smartcard with a private/public key pair, signed by the issuing department, and which one can use to login to certain governmental sites (like the IRS) and to sign documents. I hear Estonia has a similar system. While I think it's a good idea for services that already required official documents (governmental services, bank accounts, certain utility contracts), I fear that once the system is actually used by most people - right now it's still mostly ignored - more and more services that were once somewhat anonymous will start requiring the card, since the barrier is much lower than having to send an authenticated photocopy.
- deepnet 10y ago
  Cryptography is useful for anonimity in that it doesn't have to be tied to a real identity and PGP keypairs can be generated by anyone. This allows anonymous accounts that are also verifiable. National ID databases or Government Overreach can be enacted using an insecure system like Social Security Number as a database key, already. Certain private elements of ones file, such as credit card, or medical records, could be kept encrypted until the citizen grants a temporary access token.

by deepnet 10y ago

ghughes 10y ago

> Apart from societal control there seems no good reason not to adopt a system whereby everyone is issued a private and public key - which signs every email, bank instruction, comminucation & vote. Privacy and key loss are two reasons that come to mind.

deepnet 10y ago
I am not sure I follow your reasoning. Key loss would require re-issue - under the present system that uses real details or a biometric these cannot be revoked so cryptography seems better. The current system the UK uses is a Nation Insurance Number, which is just a key in a government database but once issued it is not revokable either. Solutions like a back up reissue key, or quorum of those who signed you key verify it is lost and then it can be resissued, or an trusted official like ones lawyer - or you have to take some ID to a post office. It may be inconvenient but less inconvenient than identity theft today. As for privacy this is solved by crytography too, so I don't follow your first point. If I wanted to message you privately, I encrypt the message with your public key and then you and only you can read it - just like PGP today. Of course this hypothetical system unbackdoored cryptography would be fully legal so we could have keys just for privacy between us / or verification. A bank could issue a key per account, the key ensures your banking cannot be eavesdropped and ensures the identity for this account.

icebraining 10y ago

Some countries are already implementing that - for example, in Portugal, the Citizen's Card is a smartcard with a private/public key pair, signed by the issuing department, and which one can use to login to certain governmental sites (like the IRS) and to sign documents. I hear Estonia has a similar system. While I think it's a good idea for services that already required official documents (governmental services, bank accounts, certain utility contracts), I fear that once the system is actually used by most people - right now it's still mostly ignored - more and more services that were once somewhat anonymous will start requiring the card, since the barrier is much lower than having to send an authenticated photocopy.

deepnet 10y ago
Cryptography is useful for anonimity in that it doesn't have to be tied to a real identity and PGP keypairs can be generated by anyone. This allows anonymous accounts that are also verifiable. National ID databases or Government Overreach can be enacted using an insecure system like Social Security Number as a database key, already. Certain private elements of ones file, such as credit card, or medical records, could be kept encrypted until the citizen grants a temporary access token.