3 ms·

We are going to end up with something sooner or later. The fact is that we want (and can) enter into contracts on the Internet. In order to enforce contracts w

by rlpb 16y ago

We are going to end up with something sooner or later. The fact is that we want (and can) enter into contracts on the Internet. In order to enforce contracts we must have identities. Since the Government (specifically the judiciary) enforces contracts, this means that we must be entering into these contracts under Government-managed identities. Currently we acquire and prove this Government-managed identity using an ad-hoc, decentralised, system with much duplication. I can use a passport or my driver's license or my birth certificate or perhaps some utility bills or some combination. This causes various problems, including fraud and waste. If two parties mutually choose to enter into a contract over the Internet, and this contract is to be enforced by the judiciary, then it would be ideal for them to be able to verify each others' legal entities and authorisation. I think that properly implemented this could eliminate a large amount of online fraud. Nothing about the principle of such a system inherently creates privacy problems, since when parties enter into a contract they already expect to reveal their identities to each other, and nothing would necessarily be forcing people to reveal their identities in any other situation, just the same as is the case at the moment.T here is a risk of a slippery slope of course; I can't deny that. There's no reason such a system has to be centralised, though. X.509 certificates would work fine, for example, issued at the same time as a birth certificate, with each local office as a CA. Unfortunately, the problem is with implementation. I don't think that any government is competent enough to put a system together that does meet privacy requirements, and there are too many self-interested parties who would influence and corrupt the design of such a system.

dantheman 16y ago
>>We are going to end up with something sooner or later. I think this type of attitude really hurts in a democracy. Every year people push bad ideas, and we must fight back against them.
- rlpb 16y ago
  I'm saying that the principle is a good idea, makes sense and that's why it'll happen eventually. The problem is the implementation. I'm happy to fight bad ideas. Here in the UK we managed to fight off the first bad implementation they tried to push on us.
  - pilarternera 16y ago
    Yeah, way to go on the protests of late.
tarkin2 16y ago
Decentralized systems hold personal information about you, but a detailed profile requires merging them all = difficult. A centralized system requires hardly any effort to gain a detailed profile of you = dangerous.
rsingel 16y ago
Sorry the Engadget piece is full of FUD and light on details. I was at the event and covered it for Wired.com. This initiative is coming out of NIST inside the Commerce department, with smart folks there who know this 1) a tough problem, 2) needs to be an open standard and 3) that the feds role here is best as being the ones who convene the people in the room. http://www.wired.com/epicenter/2011/01/obama-strategy-for-online-id/ http://www.wired.com/epicenter/2011/01/obama-strategy-for-on... There's got to be a better way to prove you are real and legit, than giving some company the right to pull a sub-one dollar sum of money from your bank account and then confirming that to them online. OpenID is fine, so far as it has gone, but right now it looks like Facebook is winning the war for identity and authentication. Having the feds behind an open standard hardly means you are getting the Real ID of the internet. You've got a few choices of who's going to do this in the future. The feds, your bank, Facebook, PayPal or your mobile phone carrier. Personally, I'd prefer an open system where I have my choice of 10 providers all using open standards, than having to rely on multiple closed systems like giant bank or Facebook or Paypal.
- nowarninglabel 16y ago
  >"There's got to be a better way to prove you are real and legit, than giving some company the right to pull a sub-one dollar sum of money from your bank account and then confirming that to them online" I've never had any problem with this method, what are your objective quantifications for why a 'internet id' from the Commerce Department would solve this better? Why does taxpayer money need to be spent on a problem that is already solved to a sufficient degree by commercial forces?
  - feawgo 16y ago
    No intelligent person can look at the current system and think it's solved sufficiently. Right now enormous sums of time money and energy are spent fighting fraud, and lots of businesses simply aren't viable because of these flaws. We're all wasting lots of money because of these identity problems.
  - rsingel 16y ago
    There's literally nothing in the proposal about an internet ID from the Commerce Department. While I'm not thoroughly convinced we need better identification on the net, the proposal here is about creating standards for stronger identification -- something like OpenID with the weight of the federal government trying to get industry, privacy and security groups in the same room. The alternative, it seems to me, is to watch Facebook corner the market on consumer identity, while defense contractors or the banking industry wins government contracts, and the latter eventually create some very badly designed system for citizens to log in to government agency websites. While I'm also deeply opposed to any government-run program, that's not what's happening here. I'm also a bit disappointed here with Hacker News. Folks here could easily imagine an internet that is easier and safer with a better way for users to manage their identities, while retaining both privacy and the possibility of pseudonimity and anonymity. Instead, mostly what's shown up in the border here is a Reddit thread with people saying, "You can take my anonymous internet but you'll have to pry the keyboard out of my cold dead hands." HN is usually much better than this.
fleitz 16y ago
Contract enforcement happened long before gov't mandated ID. Also, contract enforcement can occur with out ID, look at bringing suit under a John Doe or Richard Roe. In the real world we have drivers licenses yet fraud still happens.
Strilanc 16y ago
I think it will eventually be necessary even for informal interactions. It will be the only way to reliably distinguish people from spam bots.
brc 16y ago
The current system is full of waste and inefficiency, and the possibility of fraud. As such people using it take great care and don't trust it. This is actually a hidden benefit of the system. If you introduce an ID that everyone 'trusts' implicitly (esp. relating to online commerce) then the scope for fraud widens greatly. You can assume the system will get corrupted because of the great benefits accruing to those who can breach it. The vast majority of contracts entered don't need much; if it does go wrong, usually little damage is done. As the risk profile increases, then so does the amount of verification, purchasing a business requires reams of documentation, an iPhone cover shipped out of hong kong can stay anonymous. As IT people, we all naturally love a world that fits into a relational model, one where all people have a unique ID. As citizens, however, we have to resist this because of the lopsided risk/reward profile for individuals. In cases if centralised ID, you gain a little but lose a lot.
deleted 16y ago
[deleted]
drdaeman 16y ago
> In order to enforce contracts we must have identities. In theory - no, we don't, except for ephemeral one-time identities which are actually anonymous. In real world - yes, (un)?fortunately we must. Still, there's no reason to require that anyone must have one and only one identity, and this identity must be state-issued.

by rlpb 16y ago

dantheman 16y ago

>>We are going to end up with something sooner or later. I think this type of attitude really hurts in a democracy. Every year people push bad ideas, and we must fight back against them.

rlpb 16y ago
I'm saying that the principle is a good idea, makes sense and that's why it'll happen eventually. The problem is the implementation. I'm happy to fight bad ideas. Here in the UK we managed to fight off the first bad implementation they tried to push on us.
- pilarternera 16y ago
  Yeah, way to go on the protests of late.

tarkin2 16y ago

Decentralized systems hold personal information about you, but a detailed profile requires merging them all = difficult. A centralized system requires hardly any effort to gain a detailed profile of you = dangerous.

rsingel 16y ago

Sorry the Engadget piece is full of FUD and light on details. I was at the event and covered it for Wired.com. This initiative is coming out of NIST inside the Commerce department, with smart folks there who know this 1) a tough problem, 2) needs to be an open standard and 3) that the feds role here is best as being the ones who convene the people in the room. http://www.wired.com/epicenter/2011/01/obama-strategy-for-online-id/ http://www.wired.com/epicenter/2011/01/obama-strategy-for-on... There's got to be a better way to prove you are real and legit, than giving some company the right to pull a sub-one dollar sum of money from your bank account and then confirming that to them online. OpenID is fine, so far as it has gone, but right now it looks like Facebook is winning the war for identity and authentication. Having the feds behind an open standard hardly means you are getting the Real ID of the internet. You've got a few choices of who's going to do this in the future. The feds, your bank, Facebook, PayPal or your mobile phone carrier. Personally, I'd prefer an open system where I have my choice of 10 providers all using open standards, than having to rely on multiple closed systems like giant bank or Facebook or Paypal.

nowarninglabel 16y ago
>"There's got to be a better way to prove you are real and legit, than giving some company the right to pull a sub-one dollar sum of money from your bank account and then confirming that to them online" I've never had any problem with this method, what are your objective quantifications for why a 'internet id' from the Commerce Department would solve this better? Why does taxpayer money need to be spent on a problem that is already solved to a sufficient degree by commercial forces?
- feawgo 16y ago
  No intelligent person can look at the current system and think it's solved sufficiently. Right now enormous sums of time money and energy are spent fighting fraud, and lots of businesses simply aren't viable because of these flaws. We're all wasting lots of money because of these identity problems.
- rsingel 16y ago
  There's literally nothing in the proposal about an internet ID from the Commerce Department. While I'm not thoroughly convinced we need better identification on the net, the proposal here is about creating standards for stronger identification -- something like OpenID with the weight of the federal government trying to get industry, privacy and security groups in the same room. The alternative, it seems to me, is to watch Facebook corner the market on consumer identity, while defense contractors or the banking industry wins government contracts, and the latter eventually create some very badly designed system for citizens to log in to government agency websites. While I'm also deeply opposed to any government-run program, that's not what's happening here. I'm also a bit disappointed here with Hacker News. Folks here could easily imagine an internet that is easier and safer with a better way for users to manage their identities, while retaining both privacy and the possibility of pseudonimity and anonymity. Instead, mostly what's shown up in the border here is a Reddit thread with people saying, "You can take my anonymous internet but you'll have to pry the keyboard out of my cold dead hands." HN is usually much better than this.

fleitz 16y ago

Contract enforcement happened long before gov't mandated ID. Also, contract enforcement can occur with out ID, look at bringing suit under a John Doe or Richard Roe. In the real world we have drivers licenses yet fraud still happens.

Strilanc 16y ago

I think it will eventually be necessary even for informal interactions. It will be the only way to reliably distinguish people from spam bots.

brc 16y ago

The current system is full of waste and inefficiency, and the possibility of fraud. As such people using it take great care and don't trust it. This is actually a hidden benefit of the system. If you introduce an ID that everyone 'trusts' implicitly (esp. relating to online commerce) then the scope for fraud widens greatly. You can assume the system will get corrupted because of the great benefits accruing to those who can breach it. The vast majority of contracts entered don't need much; if it does go wrong, usually little damage is done. As the risk profile increases, then so does the amount of verification, purchasing a business requires reams of documentation, an iPhone cover shipped out of hong kong can stay anonymous. As IT people, we all naturally love a world that fits into a relational model, one where all people have a unique ID. As citizens, however, we have to resist this because of the lopsided risk/reward profile for individuals. In cases if centralised ID, you gain a little but lose a lot.

deleted 16y ago

[deleted]

drdaeman 16y ago

> In order to enforce contracts we must have identities. In theory - no, we don't, except for ephemeral one-time identities which are actually anonymous. In real world - yes, (un)?fortunately we must. Still, there's no reason to require that anyone must have one and only one identity, and this identity must be state-issued.