5 ms·

Keybase.io has this problem solved in a way creditors, etc. could make good use of. Let the proofs be user/use driven.

by rrggrr 9y ago

craftyguy 9y ago
no, we don't need a proprietary, centralized service for this.
- orthecreedence 9y ago
  Proprietary, no. Centralized? Yes, please. Blockchains are great and all, but if you lose your private key you should not be barred from ever opening another bank account or getting insurance. The SSA should switch to using asymmetric crypto keys and publish a web service that lets companies grab your public key based on a set of information (name, DOB, etc). Then that public key can be used to verify things signed by the private key. In the case of a lost/compromised private key, the SSA can generate a new keypair, assuming the person can verify their identity.
  - gjmacd 9y ago
    Isn't that the same as if you lost your SSI number? In all seriousness, I remember my parents lost my sisters SSI number well after she was born (1970's). The amount of BS the had to go through to get that back and prove they had one, that she was who she was, etc. It nagged them for years. Wouldn't the fix be to easily protect and recall your private key? I mean, not to get all science fiction but if you use a private key to replace an SSI, why wouldn't we move to a simple "chip" that we use with pets in case we lose it? Big brother, but I have to imagine it will certainly solve the key issue.
    - orthecreedence 9y ago
      If your private key is compromised (discovered by someone other than yourself) then it needs to be regenerated, whether it can be easily remembered or not. Getting a new key should be a huge pain in the ass, and the tests to prove that you are who you say you are should be strict. Don't lose your key. I wouldn't be opposed to a chip, but I doubt Americans are going to let that happen because they'll think big government is tracking them (which they already are, and a chip doesn't change that or expand their capabilities, but we're not talking about the most rational bunch here).
      - TheAdamist 9y ago
        Estonia is having to through this now, all the digital ids they issued have cryptographic flaws and can be trivially cracked and must be reissued :(
        craftyguy 9y ago
        Didn't they choose a proprietary solution? If so, sorry, but shame on them.
      - drewbug 9y ago
        An "identity implant" could expand tracking capabilities if each use of a reader recorded your location.
        orthecreedence 9y ago
        Oh, I misread. I was thinking "chip" as in "chip and pin" (like an ID card). Implants would be kind of over the top. Not a fan of that idea.
  - craftyguy 9y ago
    If we go the centralized route, we're just creating another Equifax (walled garden). That has always worked out great in the past, right?
    - Spooky23 9y ago
      It depends on the scope. You already have 50+ walled gardens, also known as the “Bureau of Vital Statistics”. Any identity document you have in the US is either linked to a birth certificate in one of those registries, or with an immigration record maintained by the Federal government.
      - craftyguy 9y ago
        > You already have 50+ walled gardens, also known as the “Bureau of Vital Statistics”. This seems like the bandwagon fallacy. That's no reason to continue the insanity of promoting walled gardens as a solution.
        Spooky23 9y ago
        Your birth is when you become a human and your identity is created. What would be a more ultimate root of trust than the memorial of your birth, held securely by a trusted authority?
        craftyguy 9y ago
        Birth certificates are pieces of paper that literally anything identifying as a hospital can create 'offically'. It would be trivial to create a forged certificate, there are a ton of dark net sites offering them for sale. If the US $1 bill were this easy to create (it's not), it would be worth pretty much nothing.
        Spooky23 9y ago
        Yup, and that’s the anchor of trust. The walled garden doesn’t make that better or worse... we’re not going to having key signing parties at birth. That’s why police and public trust background checks look to confirm bona fides with real people over an extended period. You still don’t know that the birth certificate is real in many cases, but you can trace it back to grade school if need be, or if the birth record is from a suspect issuer.

Keybase.io has this problem solved in a way creditors, etc. could make good use of. Let the proofs be user/use driven.

by rrggrr 9y ago

Keybase.io has this problem solved in a way creditors, etc. could make good use of. Let the proofs be user/use driven.

craftyguy 9y ago

no, we don't need a proprietary, centralized service for this.

orthecreedence 9y ago
Proprietary, no. Centralized? Yes, please. Blockchains are great and all, but if you lose your private key you should not be barred from ever opening another bank account or getting insurance. The SSA should switch to using asymmetric crypto keys and publish a web service that lets companies grab your public key based on a set of information (name, DOB, etc). Then that public key can be used to verify things signed by the private key. In the case of a lost/compromised private key, the SSA can generate a new keypair, assuming the person can verify their identity.
- gjmacd 9y ago
  Isn't that the same as if you lost your SSI number? In all seriousness, I remember my parents lost my sisters SSI number well after she was born (1970's). The amount of BS the had to go through to get that back and prove they had one, that she was who she was, etc. It nagged them for years. Wouldn't the fix be to easily protect and recall your private key? I mean, not to get all science fiction but if you use a private key to replace an SSI, why wouldn't we move to a simple "chip" that we use with pets in case we lose it? Big brother, but I have to imagine it will certainly solve the key issue.
  - orthecreedence 9y ago
    If your private key is compromised (discovered by someone other than yourself) then it needs to be regenerated, whether it can be easily remembered or not. Getting a new key should be a huge pain in the ass, and the tests to prove that you are who you say you are should be strict. Don't lose your key. I wouldn't be opposed to a chip, but I doubt Americans are going to let that happen because they'll think big government is tracking them (which they already are, and a chip doesn't change that or expand their capabilities, but we're not talking about the most rational bunch here).
    - TheAdamist 9y ago
      Estonia is having to through this now, all the digital ids they issued have cryptographic flaws and can be trivially cracked and must be reissued :(
      - craftyguy 9y ago
        Didn't they choose a proprietary solution? If so, sorry, but shame on them.
    - drewbug 9y ago
      An "identity implant" could expand tracking capabilities if each use of a reader recorded your location.
      - orthecreedence 9y ago
        Oh, I misread. I was thinking "chip" as in "chip and pin" (like an ID card). Implants would be kind of over the top. Not a fan of that idea.
- craftyguy 9y ago
  If we go the centralized route, we're just creating another Equifax (walled garden). That has always worked out great in the past, right?
  - Spooky23 9y ago
    It depends on the scope. You already have 50+ walled gardens, also known as the “Bureau of Vital Statistics”. Any identity document you have in the US is either linked to a birth certificate in one of those registries, or with an immigration record maintained by the Federal government.
    - craftyguy 9y ago
      > You already have 50+ walled gardens, also known as the “Bureau of Vital Statistics”. This seems like the bandwagon fallacy. That's no reason to continue the insanity of promoting walled gardens as a solution.
      - Spooky23 9y ago
        Your birth is when you become a human and your identity is created. What would be a more ultimate root of trust than the memorial of your birth, held securely by a trusted authority?
        craftyguy 9y ago
        Birth certificates are pieces of paper that literally anything identifying as a hospital can create 'offically'. It would be trivial to create a forged certificate, there are a ton of dark net sites offering them for sale. If the US $1 bill were this easy to create (it's not), it would be worth pretty much nothing.
        Spooky23 9y ago
        Yup, and that’s the anchor of trust. The walled garden doesn’t make that better or worse... we’re not going to having key signing parties at birth. That’s why police and public trust background checks look to confirm bona fides with real people over an extended period. You still don’t know that the birth certificate is real in many cases, but you can trace it back to grade school if need be, or if the birth record is from a suspect issuer.