10 ms·

The problem isn't that our data has become public; it's that businesses accept data as identity. They mostly just mindlessly automated manual paperwork processe

The problem isn't that our data has become public; it's that businesses accept data as identity. They mostly just mindlessly automated manual paperwork processes that were slow, but also less efficient to defraud. By only looking at costs, and not at risks, business has built our ecommerce infrastructure on sand. The notion of identity as it relates to business transactions needs to be reworked from the ground up.

bogomipz 9y ago
Well said. I'm curious what are your thoughts on how that could or should be reworked.
- jstanley 9y ago
  We should use public key cryptography to prove our identity.
  - Faaak 9y ago
    For example with certificates on a national card, like spain or estonia.
    - mcny 9y ago
      > For example with certificates on a national card, like spain or estonia. There is so much wrong with a national identity card. For example, who will pay for it? I don't want to pay for it. I don't want my taxes to pay for it. Even if you find some way to pay for it, I don't want it. What's next? Will you require me to carry a identity card on me at all times? "Random" cavity search for people walking down the road?
      - heavenlyblue 9y ago
        But then you seem to be willing to pay for the fraudulent debt in your name due to identity theft.
        mcny 9y ago
        > But then you seem to be willing to pay for the fraudulent debt in your name due to identity theft. We can solve this problem by requiring lenders to be responsible for the debt they issue. Their word against mine? Debt is invalid.
      - Cyph0n 9y ago
        > Even if you find some way to pay for it, I don't want it. Sounds like you are not open to discussing this. Also, what does a national ID card have to do with "cavity searches"? Edit: I understand the American insistence on reducing the reach of the federal government. What I don't understand is how many of those same people are fine with allowing Congress to screw us all over on important issues like healthcare and taxation...
        mcny 9y ago
        > Sounds like you are not open to discussing this. Should I be open to discussing everything? Why? Personally, as long as this Congress is in session I think we should block every single new legislative idea because I can't trust it to do anything right. > What I don't understand is how many of those same people are fine with allowing Congress to screw us all over on important issues like healthcare and taxation... I don't either. Which is why I think they will manage to mismanage this. Remember, getting health care dot gov up and running took heroic efforts of a lot of people. Just something simple as getting a dot gov website (department of education to be exact) took years. The Path station at World Trade Center was 100% over budget at FOUR BILLION DOLLARS. Nobody cares. It isn't my problem, right? We talk about net neutrality and how we gave over $400B to telecoms to deploy fiber across the nation (which to their credit, they did but what about the last mile?). And about health care, I am sorry but Obamacare doesn't even go far enough to call it an achievement. Apparently, even Germany spends less (as a portion of its GDP) on healthcare than we do. This is insane. The main point of the matter is costs have to come down. People get mad when I say while minimum wages should go up, wages and salaries in general should come down. Credits and deductions should go away when it comes to taxes. Yet, the people who want a "simplified" tax code get up in arms when they can't deduct their house or their car from their income... Why can't I deduct my rent? Why can't I deduct my cost of commute? Why should I? There is no rhyme or reason when it comes to taxes. It seems like it is just about who can push their way through...
        sillysaurus3 9y ago
        Should I be open to discussing everything? Why? Why not? If an idea can't withstand a debate, that says a lot about the idea.
      - ChrisClark 9y ago
        If you're in the US, you already have a national ID. The SSN. Because everyone uses it like that. This would just be a much more secure way of having a unique number for your person. And if keeping citizens secure is not the job of the government and thus paid for with taxes, then what is?
      - Faaak 9y ago
        You seem to be talking emotionally instead of rationally. But I suppose you already have a passport or a drivers licence (what if you don't drive ?). Then you just add a chip to it. This chip generates its own keys and then you can authenticate yourself with it.
        lyndonjohnsonbe 9y ago
        Passport has an RFID chip in it. State DL typically do not though.
        marksomnian 9y ago
        European ID cards do as well.
      - pbhjpbhj 9y ago
        What relationship does providing citizens a way to identify themselves, sign documents, to having cavity searches ... can you show how providing a nationwide digital certificate scheme leads direct to random cavity searches?? It's like if someone says "I fancy Chinese takeaway" and you don't want any you say "enjoy your cavity search" as if that's a natural outcome. Explain. Moreover, how is identifying yourself to the police bad? Sure if you live in a fascist dictatorship, but in a Western democracy?
        mcny 9y ago
        > Moreover, how is identifying yourself to the police bad? Sure if you live in a fascist dictatorship, but in a Western democracy? Do we even live in the same country? https://en.wikipedia.org/wiki/Stop-and-frisk_in_New_York_City https://en.wikipedia.org/wiki/Stop-and-frisk_in_New_York_Cit...
        pbhjpbhj 9y ago
        No, we don't live in the same country; welcome to the internet. I genuinely can't see what your point is about Stop-and-Frisk?l
      - raverbashing 9y ago
        Thanks for proving most of the objections to a national ID card are mostly fallacies instead of actual arguments "I don't want to pay" is not a valid reason. I would not like to pay taxes but that's not how things work
      - deleted 9y ago
        [deleted]
      - gech 9y ago
        You don't get to choose what your taxes goes to.
      - vultour 9y ago
        I am from a country with national ID cards and yes people are required to carry it on themselves at all time if they are outside. It's mostly used to check your identity if the police stops you while driving, which is a little annoying because surely they could just check that electronically, but it's probably a legacy system. You also use it to verify your age when buying alcohol because driving license is not a valid form of ID. It's not really a problem, I have mine in my wallet and never take it out, it's been sitting there for years. You can only really get in trouble if you don't have it while driving, and in that case I probably won't have my driving license either because it's in my wallet as well.
        Koshkin 9y ago
        > people are required to carry it on themselves at all time if they are outside ... while in other contries there is an ongoing discussion about whether it is against the Constitution to (begin to) require to show an ID when voting!
    - 39387gjk34i 9y ago
      Are you being sarcastic? https://www.engadget.com/2017/11/04/estonia-freezes-resident-id-cards-security-flaw/ https://www.engadget.com/2017/11/04/estonia-freezes-resident...
      - closeparen 9y ago
        A cryptographic bug that potentially weakens key generation is a much better problem to have than a sequential shared secret.
    - ams6110 9y ago
      National ID card would be a non-starter in the USA.
      - Scoundreller 9y ago
        Don’t make it required. It’s your right to live without one. You just can’t get on a plane, get a drivers license, get your tax refund or get a student loan without it.
  - noncoml 9y ago
    How? It’s a chicken and egg problem. How do you map a public key to a person? You will have to have an Equifax like service that will do the mapping. But then how do you prove to them that you are who you say you are in order to map you to your public key? Back to, SSN, driving license and what not. Edit: I don't think having a governmental service dealing with thousands of people every day(lost keys etc..) is something that is going to happen in the US.
    - jstanley 9y ago
      Map a public key to a person (in cases where that is even desirable! Which is not most of them) using the web of trust.
      - IncRnd 9y ago
        Web of Trust systems only work in cooperative environments. In the presence of malicious parties they fail spectacularly.
        icebraining 9y ago
        How so?
        IncRnd 9y ago
        A malicious actor can utilize a botnet to skew the crowdsourcing of trust, for example. In other words, in a WOT for identification, one's identification can be invalidated or stolen by someone who purchases cloud time.
        icebraining 9y ago
        Web-of-Trust means there's a link between you and the other entity. The number of people who trust something is not really relevant, so crowdsourcing wouldn't matter. I know there was a service called WOT that relied on that, but in my opinion they were simply misusing the concept.
  - IncRnd 9y ago
    Are you sure of that? There is an almost finished call for algorithms right now from NIST, because RSA and elliptic curve are known to be broken by quantum cryptography. While you might not personally believe this to be true, it's not a good design decision to enforce upon the entire world a concept of identity that many security professionals will tell you is broken at scale. This doesn't even address key management issues such rotation, theft, loss, planting, etc.
  - anigbrowl 9y ago
    So your interactions with the other people in your life (which could be affected by breaches of privacy) are all going to be governed by public key cryptography? Look I like strong crypto but this is getting ridiculous.
- ibgib 9y ago
  "Reworking" identity from the ground up as OP suggests is actually one of the goals that I've been working on with ibGib. No one really cares, but I'm going to describe some of the more interesting (to me) aspects of it, to bounce it off of you and others here. First, ibGib's structure is like a block chain. I've been developing it for a long time, and I had no idea what a block chain was, and the like. But an ibGib's structure is like this: * ib - unstructured text, like a name. * often provides data or metadata for convenience per use case, i.e. data is just in the address, without loading entire record. * gib - hash of ib, data, & rel8ns, providing internal integrity. * ib + gib (ib^gib) is a "content address", but I think of it as like a memory pointer in an infinite memory space. * Currently sha256 but that is metadata and can be specified in the data section. * data - internal data, like a "value" or "content" of the record. * rel8ns - named "merkle" links to other ib^gib. * special rel8ns include... * "past" - provides a linked list of mutations * "ancestor" - provides linked list of forks * "dna" - provides event-sourcing-like complete history of how to build the record. You can see examples of this, e.g., in the info view at https://www.ibgib.com/as-file/ibGib%20Tutorials%5E1E371C4463D0EA08AEB4A65AC7A5C0805526B605587B869553E34DA5AAFFE4FF https://www.ibgib.com/as-file/ibGib%20Tutorials%5E1E371C4463... . Use the button in the bottom left to change your view, depending on your use case. So, it's effectively like a tree-version of a block chain, or a distributed (and scalable) block chain. Or if you're familiar with IPFS (which is where I learned the term "merkle"), it's like a merkle forest. (I've been working on ibGib for 15+ years though - had never heard of IPFS either, but I digress). Basically, you can think of the entire thing as self-similar git repos, but for anything - not just code (currently working on VCS use case for it, which is why I've taken the code off of GitHub. You can see my current "issue" for it at https://www.ibgib.com/as-chat/version%20control%20in%20ibGib%5E844EE4723567506053A4E54E2D96534F7004EB9C5CD10E4BE16C90CF02579D8C https://www.ibgib.com/as-chat/version%20control%20in%20ibGib...). So this works with identity in a different way, in that each record is internally associated with multiple identity ibGibs. For the above example, check out the "identity" key in the "rel8ns" section. So, each individual datum is associated with _multiple_ identities for multiple things: users, nodes, sessions, etc. The piece I'm working on right now (in the active process of whiteboarding/coding at this very second) is the public key infrastructure "replacement". Because the data has this entire integrity chain, you can do different things for verifying provenance. The way that you "prove" who you are is similar to the current SPHINCS algorithm (https://sphincs.cr.yp.to/ https://sphincs.cr.yp.to/ or ), which is an ever-expanding many-times hash-based signature scheme. In my algorithm though, you can create "keystones" which act similarly to public/private key pairs. Each stone has a list of hash challenges and the specs of the challenge difficulty. For example, if I have a stone of 100 challenges, the stone may say that a valid challenge requires a minimum of 5 challenges to be answered. The challenges are based on 1-way hashes (recursively called with a depth that is included in the params of the stone). So, when you first communicate between nodes, you provide a public global stone, that is replicated, e.g. to a "public key server" analog or wherever. In the initial contact between any two nodes this global stone is challenged, and if successful any future communications between the two nodes works on a private stone (created also in the handshake). Then, each transaction - in the form of ibGib data structures - is proven in the future using that private keystone. The ibGib internal integrity allows for integrity of the data exchange, as it's basically hashing the entire communication for verification. And so, identity is established among nodes, and all data is verifiable. It's very tricky to really try to "nail down" the provenance once you get multiple nodes involved, but even if there is a known mistake, that is where another aspect of the data comes into play: non-monotonic (append-only) data. Again, this is like a version control repository for your data. This leaves a full audit trail, yada yada yada, it's really neat. I've typed enough for people to ignore anyway. If anyone is interested, ask about how this affects identity with users AND IoT devices AND AI! Ah well. At the very least, the website is instructional for navigating around merkle forests.
- PeterisP 9y ago
  You can look at most first world countries outside the USA for inspiration, since the identity theft isn't a universal problem but one limited to USA and a few other places with similar policies. However, it's not a single change but requires a significantly different approach to things like credit. Key components of such an approach are: 1) strong consumer protection legislation that removes consequences from consumers - mainly, that if a transaction is disputed the lender can't report such transactions to credit rating agencies and the credit agencies can't use such transactions in the credit rating. In essence the dispute resolution is that if you claim that it's not you, then they can either drop the claim (and marking that claim on your credit rating would be libel) or press criminal charges on you for fraud, with the usual due process and level of evidence required. 2) A secure nationwide, centralized physical photo/biometric ID issued to everyone (which is a no-no in USA for political reasons), so that organizations who actually want to verify your identity have a reasonable means to do so in a manner that doesn't rely solely on "something you know". My brother knows all my personal information and would be able to impersonate me in any knowledge-based access; however, but passing an ID check would require either theft or forgery; he can't claim lost/stolen documents and get ID in my name since the face/prints/etc wouldn't match the ones on file. The immediate effect is that it makes it easier for fraudsters to operate in the current environment that relies solely on knowledge-based authentication (since one can simply take a loan and deny it, and get away with it since the lender now has no way of proving who was it if they followed processes currently popular in USA) so the next-to-immediate effect is that all the organizations "offering trust" either face huge costs or switch their policies to handle identity verification in a reasonable manner. It will mean a temporary slowdown in issuing credit - that's not an inherently bad thing, but it does mean that such a change has to be timed to occur during an economic boom/bubble (where a temporary slowdown in credit is useful) and not during a slump.
agumonkey 9y ago
It hit me a while back, what I saw a dog slow and absurd can be seen as more opportunities to fix shit when (and it will) happen.
joe_the_user 9y ago
It would be a rather different world if people's private data couldn't be used against them in some fashion or other. So the problem is both that money isn't locked by a more secure scheme than lots of data AND it is a problem that businesses are allowed/able to accumulate massive data on people wind-up being negligent with it.
fjsolwmv 9y ago
Data is identity. What else could be? The problem is which data is identity.
- neuland 9y ago
  That's not really true though philosophically speaking. Even if I forget everything about myself, my identity (as far as my creditors are concerned) is the same. I think that there should be some kind of hardware key or smart card system issued by the government, where if you loose it or get it stolen, you can go to the post office or DMV or something to get the old key revoked and a new one reissued. The post office or DMV would verify your identity by biometrics or N other forms of ID.
  - ng12 9y ago
    Ok, how do we use that to build a useful system? How do I open a credit card in this world such that my key can't be stolen/exploited?
    - warkdarrior 9y ago
      Public key cryptography.
      - ng12 9y ago
        Key-based cryptography falls apart once you have a manual component to it. Let's say hypothetically I have an ID card containing my keys -- how do I use it to pay a bill online?
  - ryacko 9y ago
    Facemask. Could voice act. Well, it's non-trivial for most people, but so is hacking. Everything about you is a data point that could be copied.
    - coldtea 9y ago
      You missed the parent's point. The kind of identity he alludes to is not copiable with a "face-mark". Think more of some uncrackable government issued id card, that anybody that wasn't to hack it should go to the police station to get one.
volgo 9y ago
The solution here is not technical - we already know the technical solution. The solution is to introduce a cost to the risk. Right now the "risk" has no cost - if you expose people's data there's not that much consequence besides bad PR. We should assign some dollar value to each person's identify leaked. That way, businesses can properly asses risk and reward when they start these types of projects Overtime, I think businesses would rather avoid the liability of storing people's info in the first place
- nautilus12 9y ago
  Exactly, there are best practices to avoid these scenarios. The engineers are just being pushed to produce so quickly that they end up doing things like this. The problem has been for faaar to long that doing tech right takes much longer than the business side of the company is willing to wait for.
- altharaz 9y ago
  This is exactly what will happen in Europe next year. With the General Data Protection Regulation, any leak of private data caused by a major cybersecurity gap in a company will lead to severe financial sanctions such as a fine based on 4% of the company turnover. This law will indeed give the risk a “cost” :).
  - closeparen 9y ago
    As I understand it, Europe does not generally suffer from the disease of banks and courts accepting knowledge of basic demographic data as proof of identity. GDPR is not really comparable to the mess of the US social security number situation. The risk we need is to introduce is to make banks (not customers) responsible when banks allow themselves to be tricked w.r.t. personal identity. This would motivate them to come up with identity verification schemes reflecting ~anything at all that the security community has figured out in 50+ years.
- enraged_camel 9y ago
  The other cost we can introduce into the equation is holding corporate leaders personally liable for these types of gross negligence. Once CEOs know that they can go to prison if their customers' data is stolen, I assure you that they will suddenly become very interested in making sure their underlings follow best practices.
px1999 9y ago
The biggest single problem is that businesses accept data as identity, but then are allowed place the consequences of that (improperly confirmed) identity on individuals. Currently they get the best of both worlds (all of the benefits of trusting random strangers with almost none of the consequences). This gives them no incentive to properly verify their customers are who they say that they are. The "rework" to the system would be minimal if the impact of identity theft was a business' responsibility to handle. Businesses would reshape their processes based on the risk that they'd be willing to accept. Instead, we have a system that's broken, where individuals are punished for companies' (deliberate) incompetence.
eighthnate 9y ago
> it's that businesses accept data as identity. Even worse. It's that businesses accept it and the individual bears some or all of the liabilities and hassles.

bogomipz 9y ago

Well said. I'm curious what are your thoughts on how that could or should be reworked.

jstanley 9y ago
We should use public key cryptography to prove our identity.
- Faaak 9y ago
  For example with certificates on a national card, like spain or estonia.
  - mcny 9y ago
    > For example with certificates on a national card, like spain or estonia. There is so much wrong with a national identity card. For example, who will pay for it? I don't want to pay for it. I don't want my taxes to pay for it. Even if you find some way to pay for it, I don't want it. What's next? Will you require me to carry a identity card on me at all times? "Random" cavity search for people walking down the road?
    - heavenlyblue 9y ago
      But then you seem to be willing to pay for the fraudulent debt in your name due to identity theft.
      - mcny 9y ago
        > But then you seem to be willing to pay for the fraudulent debt in your name due to identity theft. We can solve this problem by requiring lenders to be responsible for the debt they issue. Their word against mine? Debt is invalid.
    - Cyph0n 9y ago
      > Even if you find some way to pay for it, I don't want it. Sounds like you are not open to discussing this. Also, what does a national ID card have to do with "cavity searches"? Edit: I understand the American insistence on reducing the reach of the federal government. What I don't understand is how many of those same people are fine with allowing Congress to screw us all over on important issues like healthcare and taxation...
      - mcny 9y ago
        > Sounds like you are not open to discussing this. Should I be open to discussing everything? Why? Personally, as long as this Congress is in session I think we should block every single new legislative idea because I can't trust it to do anything right. > What I don't understand is how many of those same people are fine with allowing Congress to screw us all over on important issues like healthcare and taxation... I don't either. Which is why I think they will manage to mismanage this. Remember, getting health care dot gov up and running took heroic efforts of a lot of people. Just something simple as getting a dot gov website (department of education to be exact) took years. The Path station at World Trade Center was 100% over budget at FOUR BILLION DOLLARS. Nobody cares. It isn't my problem, right? We talk about net neutrality and how we gave over $400B to telecoms to deploy fiber across the nation (which to their credit, they did but what about the last mile?). And about health care, I am sorry but Obamacare doesn't even go far enough to call it an achievement. Apparently, even Germany spends less (as a portion of its GDP) on healthcare than we do. This is insane. The main point of the matter is costs have to come down. People get mad when I say while minimum wages should go up, wages and salaries in general should come down. Credits and deductions should go away when it comes to taxes. Yet, the people who want a "simplified" tax code get up in arms when they can't deduct their house or their car from their income... Why can't I deduct my rent? Why can't I deduct my cost of commute? Why should I? There is no rhyme or reason when it comes to taxes. It seems like it is just about who can push their way through...
        sillysaurus3 9y ago
        Should I be open to discussing everything? Why? Why not? If an idea can't withstand a debate, that says a lot about the idea.
    - ChrisClark 9y ago
      If you're in the US, you already have a national ID. The SSN. Because everyone uses it like that. This would just be a much more secure way of having a unique number for your person. And if keeping citizens secure is not the job of the government and thus paid for with taxes, then what is?
    - Faaak 9y ago
      You seem to be talking emotionally instead of rationally. But I suppose you already have a passport or a drivers licence (what if you don't drive ?). Then you just add a chip to it. This chip generates its own keys and then you can authenticate yourself with it.
      - lyndonjohnsonbe 9y ago
        Passport has an RFID chip in it. State DL typically do not though.
        marksomnian 9y ago
        European ID cards do as well.
    - pbhjpbhj 9y ago
      What relationship does providing citizens a way to identify themselves, sign documents, to having cavity searches ... can you show how providing a nationwide digital certificate scheme leads direct to random cavity searches?? It's like if someone says "I fancy Chinese takeaway" and you don't want any you say "enjoy your cavity search" as if that's a natural outcome. Explain. Moreover, how is identifying yourself to the police bad? Sure if you live in a fascist dictatorship, but in a Western democracy?
      - mcny 9y ago
        > Moreover, how is identifying yourself to the police bad? Sure if you live in a fascist dictatorship, but in a Western democracy? Do we even live in the same country? https://en.wikipedia.org/wiki/Stop-and-frisk_in_New_York_City https://en.wikipedia.org/wiki/Stop-and-frisk_in_New_York_Cit...
        pbhjpbhj 9y ago
        No, we don't live in the same country; welcome to the internet. I genuinely can't see what your point is about Stop-and-Frisk?l
    - raverbashing 9y ago
      Thanks for proving most of the objections to a national ID card are mostly fallacies instead of actual arguments "I don't want to pay" is not a valid reason. I would not like to pay taxes but that's not how things work
    - deleted 9y ago
      [deleted]
    - gech 9y ago
      You don't get to choose what your taxes goes to.
    - vultour 9y ago
      I am from a country with national ID cards and yes people are required to carry it on themselves at all time if they are outside. It's mostly used to check your identity if the police stops you while driving, which is a little annoying because surely they could just check that electronically, but it's probably a legacy system. You also use it to verify your age when buying alcohol because driving license is not a valid form of ID. It's not really a problem, I have mine in my wallet and never take it out, it's been sitting there for years. You can only really get in trouble if you don't have it while driving, and in that case I probably won't have my driving license either because it's in my wallet as well.
      - Koshkin 9y ago
        > people are required to carry it on themselves at all time if they are outside ... while in other contries there is an ongoing discussion about whether it is against the Constitution to (begin to) require to show an ID when voting!
  - 39387gjk34i 9y ago
    Are you being sarcastic? https://www.engadget.com/2017/11/04/estonia-freezes-resident-id-cards-security-flaw/ https://www.engadget.com/2017/11/04/estonia-freezes-resident...
    - closeparen 9y ago
      A cryptographic bug that potentially weakens key generation is a much better problem to have than a sequential shared secret.
  - ams6110 9y ago
    National ID card would be a non-starter in the USA.
    - Scoundreller 9y ago
      Don’t make it required. It’s your right to live without one. You just can’t get on a plane, get a drivers license, get your tax refund or get a student loan without it.
- noncoml 9y ago
  How? It’s a chicken and egg problem. How do you map a public key to a person? You will have to have an Equifax like service that will do the mapping. But then how do you prove to them that you are who you say you are in order to map you to your public key? Back to, SSN, driving license and what not. Edit: I don't think having a governmental service dealing with thousands of people every day(lost keys etc..) is something that is going to happen in the US.
  - jstanley 9y ago
    Map a public key to a person (in cases where that is even desirable! Which is not most of them) using the web of trust.
    - IncRnd 9y ago
      Web of Trust systems only work in cooperative environments. In the presence of malicious parties they fail spectacularly.
      - icebraining 9y ago
        How so?
        IncRnd 9y ago
        A malicious actor can utilize a botnet to skew the crowdsourcing of trust, for example. In other words, in a WOT for identification, one's identification can be invalidated or stolen by someone who purchases cloud time.
        icebraining 9y ago
        Web-of-Trust means there's a link between you and the other entity. The number of people who trust something is not really relevant, so crowdsourcing wouldn't matter. I know there was a service called WOT that relied on that, but in my opinion they were simply misusing the concept.
- IncRnd 9y ago
  Are you sure of that? There is an almost finished call for algorithms right now from NIST, because RSA and elliptic curve are known to be broken by quantum cryptography. While you might not personally believe this to be true, it's not a good design decision to enforce upon the entire world a concept of identity that many security professionals will tell you is broken at scale. This doesn't even address key management issues such rotation, theft, loss, planting, etc.
- anigbrowl 9y ago
  So your interactions with the other people in your life (which could be affected by breaches of privacy) are all going to be governed by public key cryptography? Look I like strong crypto but this is getting ridiculous.
ibgib 9y ago
"Reworking" identity from the ground up as OP suggests is actually one of the goals that I've been working on with ibGib. No one really cares, but I'm going to describe some of the more interesting (to me) aspects of it, to bounce it off of you and others here. First, ibGib's structure is like a block chain. I've been developing it for a long time, and I had no idea what a block chain was, and the like. But an ibGib's structure is like this: * ib - unstructured text, like a name. * often provides data or metadata for convenience per use case, i.e. data is just in the address, without loading entire record. * gib - hash of ib, data, & rel8ns, providing internal integrity. * ib + gib (ib^gib) is a "content address", but I think of it as like a memory pointer in an infinite memory space. * Currently sha256 but that is metadata and can be specified in the data section. * data - internal data, like a "value" or "content" of the record. * rel8ns - named "merkle" links to other ib^gib. * special rel8ns include... * "past" - provides a linked list of mutations * "ancestor" - provides linked list of forks * "dna" - provides event-sourcing-like complete history of how to build the record. You can see examples of this, e.g., in the info view at https://www.ibgib.com/as-file/ibGib%20Tutorials%5E1E371C4463D0EA08AEB4A65AC7A5C0805526B605587B869553E34DA5AAFFE4FF https://www.ibgib.com/as-file/ibGib%20Tutorials%5E1E371C4463... . Use the button in the bottom left to change your view, depending on your use case. So, it's effectively like a tree-version of a block chain, or a distributed (and scalable) block chain. Or if you're familiar with IPFS (which is where I learned the term "merkle"), it's like a merkle forest. (I've been working on ibGib for 15+ years though - had never heard of IPFS either, but I digress). Basically, you can think of the entire thing as self-similar git repos, but for anything - not just code (currently working on VCS use case for it, which is why I've taken the code off of GitHub. You can see my current "issue" for it at https://www.ibgib.com/as-chat/version%20control%20in%20ibGib%5E844EE4723567506053A4E54E2D96534F7004EB9C5CD10E4BE16C90CF02579D8C https://www.ibgib.com/as-chat/version%20control%20in%20ibGib...). So this works with identity in a different way, in that each record is internally associated with multiple identity ibGibs. For the above example, check out the "identity" key in the "rel8ns" section. So, each individual datum is associated with _multiple_ identities for multiple things: users, nodes, sessions, etc. The piece I'm working on right now (in the active process of whiteboarding/coding at this very second) is the public key infrastructure "replacement". Because the data has this entire integrity chain, you can do different things for verifying provenance. The way that you "prove" who you are is similar to the current SPHINCS algorithm (https://sphincs.cr.yp.to/ https://sphincs.cr.yp.to/ or ), which is an ever-expanding many-times hash-based signature scheme. In my algorithm though, you can create "keystones" which act similarly to public/private key pairs. Each stone has a list of hash challenges and the specs of the challenge difficulty. For example, if I have a stone of 100 challenges, the stone may say that a valid challenge requires a minimum of 5 challenges to be answered. The challenges are based on 1-way hashes (recursively called with a depth that is included in the params of the stone). So, when you first communicate between nodes, you provide a public global stone, that is replicated, e.g. to a "public key server" analog or wherever. In the initial contact between any two nodes this global stone is challenged, and if successful any future communications between the two nodes works on a private stone (created also in the handshake). Then, each transaction - in the form of ibGib data structures - is proven in the future using that private keystone. The ibGib internal integrity allows for integrity of the data exchange, as it's basically hashing the entire communication for verification. And so, identity is established among nodes, and all data is verifiable. It's very tricky to really try to "nail down" the provenance once you get multiple nodes involved, but even if there is a known mistake, that is where another aspect of the data comes into play: non-monotonic (append-only) data. Again, this is like a version control repository for your data. This leaves a full audit trail, yada yada yada, it's really neat. I've typed enough for people to ignore anyway. If anyone is interested, ask about how this affects identity with users AND IoT devices AND AI! Ah well. At the very least, the website is instructional for navigating around merkle forests.
PeterisP 9y ago
You can look at most first world countries outside the USA for inspiration, since the identity theft isn't a universal problem but one limited to USA and a few other places with similar policies. However, it's not a single change but requires a significantly different approach to things like credit. Key components of such an approach are: 1) strong consumer protection legislation that removes consequences from consumers - mainly, that if a transaction is disputed the lender can't report such transactions to credit rating agencies and the credit agencies can't use such transactions in the credit rating. In essence the dispute resolution is that if you claim that it's not you, then they can either drop the claim (and marking that claim on your credit rating would be libel) or press criminal charges on you for fraud, with the usual due process and level of evidence required. 2) A secure nationwide, centralized physical photo/biometric ID issued to everyone (which is a no-no in USA for political reasons), so that organizations who actually want to verify your identity have a reasonable means to do so in a manner that doesn't rely solely on "something you know". My brother knows all my personal information and would be able to impersonate me in any knowledge-based access; however, but passing an ID check would require either theft or forgery; he can't claim lost/stolen documents and get ID in my name since the face/prints/etc wouldn't match the ones on file. The immediate effect is that it makes it easier for fraudsters to operate in the current environment that relies solely on knowledge-based authentication (since one can simply take a loan and deny it, and get away with it since the lender now has no way of proving who was it if they followed processes currently popular in USA) so the next-to-immediate effect is that all the organizations "offering trust" either face huge costs or switch their policies to handle identity verification in a reasonable manner. It will mean a temporary slowdown in issuing credit - that's not an inherently bad thing, but it does mean that such a change has to be timed to occur during an economic boom/bubble (where a temporary slowdown in credit is useful) and not during a slump.

agumonkey 9y ago

It hit me a while back, what I saw a dog slow and absurd can be seen as more opportunities to fix shit when (and it will) happen.

joe_the_user 9y ago

It would be a rather different world if people's private data couldn't be used against them in some fashion or other. So the problem is both that money isn't locked by a more secure scheme than lots of data AND it is a problem that businesses are allowed/able to accumulate massive data on people wind-up being negligent with it.

fjsolwmv 9y ago

Data is identity. What else could be? The problem is which data is identity.

neuland 9y ago
That's not really true though philosophically speaking. Even if I forget everything about myself, my identity (as far as my creditors are concerned) is the same. I think that there should be some kind of hardware key or smart card system issued by the government, where if you loose it or get it stolen, you can go to the post office or DMV or something to get the old key revoked and a new one reissued. The post office or DMV would verify your identity by biometrics or N other forms of ID.
- ng12 9y ago
  Ok, how do we use that to build a useful system? How do I open a credit card in this world such that my key can't be stolen/exploited?
  - warkdarrior 9y ago
    Public key cryptography.
    - ng12 9y ago
      Key-based cryptography falls apart once you have a manual component to it. Let's say hypothetically I have an ID card containing my keys -- how do I use it to pay a bill online?
- ryacko 9y ago
  Facemask. Could voice act. Well, it's non-trivial for most people, but so is hacking. Everything about you is a data point that could be copied.
  - coldtea 9y ago
    You missed the parent's point. The kind of identity he alludes to is not copiable with a "face-mark". Think more of some uncrackable government issued id card, that anybody that wasn't to hack it should go to the police station to get one.

volgo 9y ago

The solution here is not technical - we already know the technical solution. The solution is to introduce a cost to the risk. Right now the "risk" has no cost - if you expose people's data there's not that much consequence besides bad PR. We should assign some dollar value to each person's identify leaked. That way, businesses can properly asses risk and reward when they start these types of projects Overtime, I think businesses would rather avoid the liability of storing people's info in the first place

nautilus12 9y ago
Exactly, there are best practices to avoid these scenarios. The engineers are just being pushed to produce so quickly that they end up doing things like this. The problem has been for faaar to long that doing tech right takes much longer than the business side of the company is willing to wait for.
altharaz 9y ago
This is exactly what will happen in Europe next year. With the General Data Protection Regulation, any leak of private data caused by a major cybersecurity gap in a company will lead to severe financial sanctions such as a fine based on 4% of the company turnover. This law will indeed give the risk a “cost” :).
- closeparen 9y ago
  As I understand it, Europe does not generally suffer from the disease of banks and courts accepting knowledge of basic demographic data as proof of identity. GDPR is not really comparable to the mess of the US social security number situation. The risk we need is to introduce is to make banks (not customers) responsible when banks allow themselves to be tricked w.r.t. personal identity. This would motivate them to come up with identity verification schemes reflecting ~anything at all that the security community has figured out in 50+ years.
enraged_camel 9y ago
The other cost we can introduce into the equation is holding corporate leaders personally liable for these types of gross negligence. Once CEOs know that they can go to prison if their customers' data is stolen, I assure you that they will suddenly become very interested in making sure their underlings follow best practices.

px1999 9y ago

The biggest single problem is that businesses accept data as identity, but then are allowed place the consequences of that (improperly confirmed) identity on individuals. Currently they get the best of both worlds (all of the benefits of trusting random strangers with almost none of the consequences). This gives them no incentive to properly verify their customers are who they say that they are. The "rework" to the system would be minimal if the impact of identity theft was a business' responsibility to handle. Businesses would reshape their processes based on the risk that they'd be willing to accept. Instead, we have a system that's broken, where individuals are punished for companies' (deliberate) incompetence.

eighthnate 9y ago

> it's that businesses accept data as identity. Even worse. It's that businesses accept it and the individual bears some or all of the liabilities and hassles.