8 ms·

I believe these issues could be solved by actually taxing corporations and providing the service they clearly so desperately need. An /actual/ (inter)national

I believe these issues could be solved by actually taxing corporations and providing the service they clearly so desperately need. An /actual/ (inter)national ID and Identity verification service. One where disputes about identity and authorization can be escalated somewhere that makes sense, to the jurisdictions issuing these IDs. Ideally someone should be able to go to a police station (locally for local IDs, if on vacation/out of hometown in liaison between departments) and have their identity verified in a trusted way, and that verification reported as pass/fail to a third party whom is asking. This would also be the way of officially disputing fraudulent uses of identity; they would be reported via the same actions, but as a customer initiation (and statement of legal testimony taken in a case that would then be opened and reported to the involved parties). BTW, such a system SHOULD also include address resolution, for physical mail, voice, and electronic services (any sub-name actually). I would LOVE to only update my address in ONE place when I move, instead of trying to remember everyone I've ever given it to.

AnthonyMouse 8y ago
The problem with centralized identification is that it doesn't actually solve anything, it only outsources it to a less security-competent entity which would be an even bigger target for fraud and corruption. Creating one single place to change your address gives the attacker one single place to change your address. Compromise one system, bribe one police officer or DMV employee, get nation-wide root access to everything. And how does it even solve the problem? The problem isn't that Google doesn't know whether you're John Smith. It's that Google thinks John Smith is a scammer they won't do business with, and they aren't willing to spend their resources helping you to clear your name.
- lolc 8y ago
  Well, fraud would still happen. The problem from the fraudsters point of view are manifold though: They have to actually deal with the police in person. Sending copies of identity documents by mail is not as involved as personally going to a police station. The risks are very different. Similarily, you can have corruption at phone carriers and credit-card companies too. What matters is the audit-chain. If a police officer keeps id-ing fraudsters they won't be in the job for long. That public servants are more corrupt and less competent than the corporate employees one depends on is not a universal experience. Not for me anyway.
  - AnthonyMouse 8y ago
    > Well, fraud would still happen. The problem from the fraudsters point of view are manifold though: They have to actually deal with the police in person. Sending copies of identity documents by mail is not as involved as personally going to a police station. The risks are very different. Not really, because that isn't how fraud happens now, and nothing about that would change it. People don't commonly commit fraud by going to a government office to get an ID issued in your name, they do it by waiting for you to do that and then stealing it from you or otherwise convincing you to give them the information they need to authenticate using it. > Similarily, you can have corruption at phone carriers and credit-card companies too. What matters is the audit-chain. If a police officer keeps id-ing fraudsters they won't be in the job for long. That's assuming the audit chain is both secure and less susceptible to corruption than the original system. Audit logs don't help if they're compromised by the people with privileged access. Or you nominally have individual accounts but in practice they're shared or not secured against compromise by privileged users. And assuming that the corruption problem is specific identifiable people rather than a systemic issue where >=5% of police are corruptible so one getting caught only requires the fraudsters to use any of the thousands of others. > That public servants are more corrupt and less competent than the corporate employees one depends on is not a universal experience. Not for me anyway. The difference in this case isn't that the quality of the people is different, it's that the nature of the system is different. Whereas an individual company might have five employees with sensitive access, across an entire national government there would be a hundred thousand or more, so the attacker has a hundred thousand chances to find the lowest common denominator instead of five. And then when they succeed the scope of the vulnerability is not limited to that one company, it's universal.
marcus_holmes 8y ago
I don't have a physical address (I move approximately every 3 weeks). I don't have a phone number (I move country every 3 weeks and need a new SIM each time). I have so many problems with online authentication it's not funny. So yeah, I'd love a global system of identification, but please let's not tie it to an address or phone number
- toomuchtodo 8y ago
  Passport number along with cryptographic authentication similar to Estonia’s ID card. I believe this satisfies the need for authentication of all citizens at a global scope.
  - threeseed 8y ago
    Not everyone has passports let alone valid ones. And getting one for people can be difficult as many people especially older ones don't have supporting documentation e.g. birth certificates and so can't prove identity.
    - toomuchtodo 8y ago
      You can’t function as a citizen of a country without identity documents. Passport national ID cards, in my opinion, the optimal solution to the problem. Issuance can be streamlined, and cost can be absorbed for those who can’t afford it. Society requires foundations.
      - dragonwriter 8y ago
        > You can’t function as a citizen of a country without identity documents. Sure you can. Identity documents exist more to prevent (the “wrong") people from functioning as citizens than to enable people to do so.
        tooop 8y ago
        If you look young, how can you even buy alcohol or cigarettes (in my countries case even energy drinks) or get in a club? In my country each citizen must have an identity document - either a passport or ID card (drivers license doesn't count). I can't see it any other way as you need to ID yourself in stores (in the mentioned case if you look young and want to buy alcohol/cigarettes/energy drink), post office when receiving package, getting drivers licence, opening bank account, getting loans etc.
njarboe 8y ago
Many US states have this place where you get you ID. It's often called the department of motor vehicles and is notorious for being a huge pain to deal with. Most places where the government works well in this capacity probably doesn't have companies pulling this kind of shit. Any Germans in the audience?
behringer 8y ago
We already have this system in the US. It's called a notary public. It works pretty well. Google just chooses to not use it.
kalleboo 8y ago
Sweden has a personal identity number system, with an address/phone database that business can subscribe to. When you're shopping online, you can enter your ID number and it auto-populates your address. When you move, banks and others will automatically pull your new address from the database. The banks then created a digital ID system (BankID) on top of this which is now used by everyone for real ID verification. Your physical ID is checked by a bank teller, and after that you get either a digital certificate file or a 2FA token that you can then use online to prove your identity for signing contracts (insurance etc), filing your taxes, or just logging into bank accounts etc. Practically it works pretty well, even though I know philosophically an ID number like that would never fly in the US, and security-wise I'm sure experts have lots of objections.
- AnssiH 8y ago
  This works similarly in Finland. Form auto-population by ID is rare here, though.
- akimball 8y ago
  How well served are the unenumerated?
  - tomjen3 8y ago
    Dane here, we have mostly the same system. There are only really two groups that have issues: the very young (who are not used to checking up) and the very old (who are not used to computers). Nobody is unenumerated, everybody has our version of a social security number, you are mostly required by law to have a bank account (and banks are required to give you one, except in specific individual cases such as you acting in an inappropriate manor)

AnthonyMouse 8y ago

The problem with centralized identification is that it doesn't actually solve anything, it only outsources it to a less security-competent entity which would be an even bigger target for fraud and corruption. Creating one single place to change your address gives the attacker one single place to change your address. Compromise one system, bribe one police officer or DMV employee, get nation-wide root access to everything. And how does it even solve the problem? The problem isn't that Google doesn't know whether you're John Smith. It's that Google thinks John Smith is a scammer they won't do business with, and they aren't willing to spend their resources helping you to clear your name.

lolc 8y ago
Well, fraud would still happen. The problem from the fraudsters point of view are manifold though: They have to actually deal with the police in person. Sending copies of identity documents by mail is not as involved as personally going to a police station. The risks are very different. Similarily, you can have corruption at phone carriers and credit-card companies too. What matters is the audit-chain. If a police officer keeps id-ing fraudsters they won't be in the job for long. That public servants are more corrupt and less competent than the corporate employees one depends on is not a universal experience. Not for me anyway.
- AnthonyMouse 8y ago
  > Well, fraud would still happen. The problem from the fraudsters point of view are manifold though: They have to actually deal with the police in person. Sending copies of identity documents by mail is not as involved as personally going to a police station. The risks are very different. Not really, because that isn't how fraud happens now, and nothing about that would change it. People don't commonly commit fraud by going to a government office to get an ID issued in your name, they do it by waiting for you to do that and then stealing it from you or otherwise convincing you to give them the information they need to authenticate using it. > Similarily, you can have corruption at phone carriers and credit-card companies too. What matters is the audit-chain. If a police officer keeps id-ing fraudsters they won't be in the job for long. That's assuming the audit chain is both secure and less susceptible to corruption than the original system. Audit logs don't help if they're compromised by the people with privileged access. Or you nominally have individual accounts but in practice they're shared or not secured against compromise by privileged users. And assuming that the corruption problem is specific identifiable people rather than a systemic issue where >=5% of police are corruptible so one getting caught only requires the fraudsters to use any of the thousands of others. > That public servants are more corrupt and less competent than the corporate employees one depends on is not a universal experience. Not for me anyway. The difference in this case isn't that the quality of the people is different, it's that the nature of the system is different. Whereas an individual company might have five employees with sensitive access, across an entire national government there would be a hundred thousand or more, so the attacker has a hundred thousand chances to find the lowest common denominator instead of five. And then when they succeed the scope of the vulnerability is not limited to that one company, it's universal.

marcus_holmes 8y ago

I don't have a physical address (I move approximately every 3 weeks). I don't have a phone number (I move country every 3 weeks and need a new SIM each time). I have so many problems with online authentication it's not funny. So yeah, I'd love a global system of identification, but please let's not tie it to an address or phone number

toomuchtodo 8y ago
Passport number along with cryptographic authentication similar to Estonia’s ID card. I believe this satisfies the need for authentication of all citizens at a global scope.
- threeseed 8y ago
  Not everyone has passports let alone valid ones. And getting one for people can be difficult as many people especially older ones don't have supporting documentation e.g. birth certificates and so can't prove identity.
  - toomuchtodo 8y ago
    You can’t function as a citizen of a country without identity documents. Passport national ID cards, in my opinion, the optimal solution to the problem. Issuance can be streamlined, and cost can be absorbed for those who can’t afford it. Society requires foundations.
    - dragonwriter 8y ago
      > You can’t function as a citizen of a country without identity documents. Sure you can. Identity documents exist more to prevent (the “wrong") people from functioning as citizens than to enable people to do so.
      - tooop 8y ago
        If you look young, how can you even buy alcohol or cigarettes (in my countries case even energy drinks) or get in a club? In my country each citizen must have an identity document - either a passport or ID card (drivers license doesn't count). I can't see it any other way as you need to ID yourself in stores (in the mentioned case if you look young and want to buy alcohol/cigarettes/energy drink), post office when receiving package, getting drivers licence, opening bank account, getting loans etc.

njarboe 8y ago

Many US states have this place where you get you ID. It's often called the department of motor vehicles and is notorious for being a huge pain to deal with. Most places where the government works well in this capacity probably doesn't have companies pulling this kind of shit. Any Germans in the audience?

behringer 8y ago

We already have this system in the US. It's called a notary public. It works pretty well. Google just chooses to not use it.

kalleboo 8y ago

Sweden has a personal identity number system, with an address/phone database that business can subscribe to. When you're shopping online, you can enter your ID number and it auto-populates your address. When you move, banks and others will automatically pull your new address from the database. The banks then created a digital ID system (BankID) on top of this which is now used by everyone for real ID verification. Your physical ID is checked by a bank teller, and after that you get either a digital certificate file or a 2FA token that you can then use online to prove your identity for signing contracts (insurance etc), filing your taxes, or just logging into bank accounts etc. Practically it works pretty well, even though I know philosophically an ID number like that would never fly in the US, and security-wise I'm sure experts have lots of objections.

AnssiH 8y ago
This works similarly in Finland. Form auto-population by ID is rare here, though.
akimball 8y ago
How well served are the unenumerated?
- tomjen3 8y ago
  Dane here, we have mostly the same system. There are only really two groups that have issues: the very young (who are not used to checking up) and the very old (who are not used to computers). Nobody is unenumerated, everybody has our version of a social security number, you are mostly required by law to have a bank account (and banks are required to give you one, except in specific individual cases such as you acting in an inappropriate manor)