3 ms·

Trying to make it easier to prove your identity online. Essentially by creating an ID for use on the web. When signing up for services that require real identi

Trying to make it easier to prove your identity online. Essentially by creating an ID for use on the web. When signing up for services that require real identities (banking, insurance, etc.) the standard currently is to require a picture of a passport, a video of yourself, or copies of some paperwork. These methods are all high-friction and provide dubious security and privacy. This is already a solved problem in some countries and I'm working on the equivalent on a larger scale, without the geographical restrictions. If there is anybody else here working in this space then feel free to reach out!

jr394u 7y ago
Would you mind sharing some of the implementations of how this is solved already, i.e. protocols or related specifications which dictate how this is achieved? This is a great problem and I'd love to know more.
- fabianlindfors 7y ago
  Hi! Sorry about the late reply, your comment was marked as dead before. I'm from Sweden where basically every single person has an app on their phone which functions as a digital ID, used by the government and a ton of companies. Every time we sign in to (or sign up for) services that handle taxes, banking, insurance, benefits, payments, utilities, etc. we use our mobile ID. There are a few other countries that I know have similar solutions, for example Finland and Estonia but many still don't. You can read more about it here: https://en.wikipedia.org/wiki/Mobile_signature https://en.wikipedia.org/wiki/Mobile_signature The big problem is that these solutions are all different and it's close to impossible to integrate them all. This is the reason why many global startups that require identity verification fall back to less convenient and secure methods, e.g. Revolut, Monzo and N26, to name a few. I believe that for truly convenient identity online there needs to be a single digital ID which works for everyone. This is what I'm currently working to achieve. If you have any thoughts I'd love to discuss it further!
slx26 7y ago
With online fingerprinting, big companies seem to have the problem of "identity", bots and spam prevention decently solved, but at the cost of users privacy. There are many opportunities that could really use a good mechanism to uniquely identify users, know for sure they are real people. This is pretty hard to do (or outright impossible) without the collaboration of governments. But governments will f*ck it up in a number of ways if we leave it to them. We have to think bigger than what some countries have already solved. First, we need something like credit cards. A physical object (identity cards could work on many countries, but they tend to suffer from beyond horrible usability when it comes to their digital chips / functionality) with a password that can be changed. We would also need a place to see all the "transactions" or actions done with your identity, as we have with credit cards. India and their Aadhaar project has shown that biometric identification is not good. But it sounds very nice and sci-fi, so it sadly sticks. Nothing new yet. But what we really would need are manageable permissions, so you can always prove that you are an actual human, but not necessarily revealing anything else and being a completely anonymous user, or choosing to reveal some data (country, real name, etc). If something like this was global and effective, not only we would have many more opportunities through the internet, we could also come much closer to things like direct democracy. Password management and online identity management would also become much easier. Obviously there also are many problems. Starting with the access to the internet itself. And all this identification system does sound very dangerous from a privacy-minded perspective (but the alternatives will end up being much worse, and worse systems will be imposed on us). And I'm still completely ignoring the political will to do something like this.
- fabianlindfors 7y ago
  I think you really hit the nail on the head, thanks for sharing! Privacy is definitely at the center of what I'm building. My approach is to put full control of their own data in the users hands. Data is only shared with a service when a user explicitly allows it and the user is always aware of what that data is. Your idea of being able to share nothing at all is also something I've been thinking a lot about. Being able to verify an identity without leaking any PII is one of my main goals. I also agree with you on the issue of governments. There are very few who have managed to introduce a digital ID locally. A large amount of countries coming together and building a common solution seems very far-fetched currently. Where I'm from, Sweden, we have a well functioning digital ID used by everybody. Funny thing is that it was created by the private banks and only later adopted by the government. It's definitely a hard problem but judging by the evidence it's solvable, just hope I'm on the right path. If you have any more thoughts I'd love to hear them!
friendzis 7y ago
This is an almost* solved problem, depending on how low-friction solution you consider solved. Just use X509 PKI. Have your real world identity issuing agency (whatever that is in a specific country) become a CA, issue personal cert and store it in crypto-hardware. Smart-card interface is rarely present (generally requires specific hardware), USB requires drivers. Heck, the key can even live inside your SIM card if you prove your identity to mobile provider, which you have to if it is a contract anyway. Works well and is easy to use. Can be an attack vector for scams, though. https://en.wikipedia.org/wiki/Mobile_signature https://en.wikipedia.org/wiki/Mobile_signature
- fabianlindfors 7y ago
  From a technical aspect I agree that it's definitely solved! I'm building my service on top of PKI for this reason. The problem lies with the issuing and trust. Many countries do not issue e-IDs and it's not easy for a business to support all the ones that do. Take for example my country, Sweden. Basically every single citizen has an e-ID and it's used for everything. Yet I can't use it if I want to sign up for a non-Swedish service such as Revolut, N26, Transferwise etc.

jr394u 7y ago

Would you mind sharing some of the implementations of how this is solved already, i.e. protocols or related specifications which dictate how this is achieved? This is a great problem and I'd love to know more.

fabianlindfors 7y ago
Hi! Sorry about the late reply, your comment was marked as dead before. I'm from Sweden where basically every single person has an app on their phone which functions as a digital ID, used by the government and a ton of companies. Every time we sign in to (or sign up for) services that handle taxes, banking, insurance, benefits, payments, utilities, etc. we use our mobile ID. There are a few other countries that I know have similar solutions, for example Finland and Estonia but many still don't. You can read more about it here: https://en.wikipedia.org/wiki/Mobile_signature https://en.wikipedia.org/wiki/Mobile_signature The big problem is that these solutions are all different and it's close to impossible to integrate them all. This is the reason why many global startups that require identity verification fall back to less convenient and secure methods, e.g. Revolut, Monzo and N26, to name a few. I believe that for truly convenient identity online there needs to be a single digital ID which works for everyone. This is what I'm currently working to achieve. If you have any thoughts I'd love to discuss it further!

slx26 7y ago

With online fingerprinting, big companies seem to have the problem of "identity", bots and spam prevention decently solved, but at the cost of users privacy. There are many opportunities that could really use a good mechanism to uniquely identify users, know for sure they are real people. This is pretty hard to do (or outright impossible) without the collaboration of governments. But governments will f*ck it up in a number of ways if we leave it to them. We have to think bigger than what some countries have already solved. First, we need something like credit cards. A physical object (identity cards could work on many countries, but they tend to suffer from beyond horrible usability when it comes to their digital chips / functionality) with a password that can be changed. We would also need a place to see all the "transactions" or actions done with your identity, as we have with credit cards. India and their Aadhaar project has shown that biometric identification is not good. But it sounds very nice and sci-fi, so it sadly sticks. Nothing new yet. But what we really would need are manageable permissions, so you can always prove that you are an actual human, but not necessarily revealing anything else and being a completely anonymous user, or choosing to reveal some data (country, real name, etc). If something like this was global and effective, not only we would have many more opportunities through the internet, we could also come much closer to things like direct democracy. Password management and online identity management would also become much easier. Obviously there also are many problems. Starting with the access to the internet itself. And all this identification system does sound very dangerous from a privacy-minded perspective (but the alternatives will end up being much worse, and worse systems will be imposed on us). And I'm still completely ignoring the political will to do something like this.

fabianlindfors 7y ago
I think you really hit the nail on the head, thanks for sharing! Privacy is definitely at the center of what I'm building. My approach is to put full control of their own data in the users hands. Data is only shared with a service when a user explicitly allows it and the user is always aware of what that data is. Your idea of being able to share nothing at all is also something I've been thinking a lot about. Being able to verify an identity without leaking any PII is one of my main goals. I also agree with you on the issue of governments. There are very few who have managed to introduce a digital ID locally. A large amount of countries coming together and building a common solution seems very far-fetched currently. Where I'm from, Sweden, we have a well functioning digital ID used by everybody. Funny thing is that it was created by the private banks and only later adopted by the government. It's definitely a hard problem but judging by the evidence it's solvable, just hope I'm on the right path. If you have any more thoughts I'd love to hear them!

friendzis 7y ago

This is an almost* solved problem, depending on how low-friction solution you consider solved. Just use X509 PKI. Have your real world identity issuing agency (whatever that is in a specific country) become a CA, issue personal cert and store it in crypto-hardware. Smart-card interface is rarely present (generally requires specific hardware), USB requires drivers. Heck, the key can even live inside your SIM card if you prove your identity to mobile provider, which you have to if it is a contract anyway. Works well and is easy to use. Can be an attack vector for scams, though. https://en.wikipedia.org/wiki/Mobile_signature https://en.wikipedia.org/wiki/Mobile_signature

fabianlindfors 7y ago
From a technical aspect I agree that it's definitely solved! I'm building my service on top of PKI for this reason. The problem lies with the issuing and trust. Many countries do not issue e-IDs and it's not easy for a business to support all the ones that do. Take for example my country, Sweden. Basically every single citizen has an e-ID and it's used for everything. Yet I can't use it if I want to sign up for a non-Swedish service such as Revolut, N26, Transferwise etc.