4 ms·

The average user is not savvy enough to sign consistently, but can keep a private key secure? That's a big assumption.

by satya71 6y ago

ryukafalz 6y ago
If the private key is in a smart card, why not? Some countries like Estonia include smart cards in their national IDs.
- paledot 6y ago
  I'm increasingly convinced that this is the way forward. Having a key verifiably tied to you as an individual goes a long way to enabling a broad range of governmental services. Digital voting, for one thing, but also no more need to rely on shady credit check companies for address verification, as I've seen on some (Canadian) government forms.
  - ryukafalz 6y ago
    Or social security numbers in the US, which are absolutely not fit for this purpose. For those in the US who don't want a national ID: it wouldn't have to be one if the states issued their own. Yes, this would mean they'd all need the technical capability to operate a CA securely. Fund them enough to do that.
    - XorNot 6y ago
      People opposing a national ID in the US have de facto caused social security numbers, completely inappropriate as a national ID, to be used as one by everyone. The US desperately, desperately needs a proper solution where "thing you give tons of people" isn't also "exactly enough to steal your ID".
    - BlueTemplar 6y ago
      National IDs have a pretty bleak history - from being initially used to keep tabs on criminals to Jews under Nazi occupation. This is why they often are not mandatory. As a curious factoid, in-between the world wars, it was popular for workers to have their ID number tatooed on their arm.
  - t0astbread 6y ago
    With software I'd be wary of making it the last line of defense, especially for very significant acts such as voting. A bug in the system would be totally fatal, not only for society but especially for the victim. Even more so if bugs aren't commonplace but only sporadic. Using cryptography in addition to "classic" means of attestation sounds a lot better to me. You could also make it an "optional feature" of people's citizenships (like 2FA on an account) to ease adoption.
- Pentamerous 6y ago
  In Portugal we have this. Each citizen identification card (called Cartão do Cidadão) has a unique certificate and the official Software allows you to sign any documents with it. Unfortunatly, I have never used this and never saw anyone using it. I never heard of any company accepting contracts signed with it. The technology is ready, but pen and paper are still the norm.
Forge36 6y ago
I can't do the former, i can attempt the later. I'm sure some service would figure out a way.
Edmond 6y ago
This is mainly an app design issue...Certify makes cryptography including the question of keys completely transparent to the user. The user just needs to learns how to perform some simple operations with the app, they never have to know about private/public keys.

The average user is not savvy enough to sign consistently, but can keep a private key secure? That's a big assumption.

ryukafalz 6y ago

If the private key is in a smart card, why not? Some countries like Estonia include smart cards in their national IDs.

paledot 6y ago
I'm increasingly convinced that this is the way forward. Having a key verifiably tied to you as an individual goes a long way to enabling a broad range of governmental services. Digital voting, for one thing, but also no more need to rely on shady credit check companies for address verification, as I've seen on some (Canadian) government forms.
- ryukafalz 6y ago
  Or social security numbers in the US, which are absolutely not fit for this purpose. For those in the US who don't want a national ID: it wouldn't have to be one if the states issued their own. Yes, this would mean they'd all need the technical capability to operate a CA securely. Fund them enough to do that.
  - XorNot 6y ago
    People opposing a national ID in the US have de facto caused social security numbers, completely inappropriate as a national ID, to be used as one by everyone. The US desperately, desperately needs a proper solution where "thing you give tons of people" isn't also "exactly enough to steal your ID".
  - BlueTemplar 6y ago
    National IDs have a pretty bleak history - from being initially used to keep tabs on criminals to Jews under Nazi occupation. This is why they often are not mandatory. As a curious factoid, in-between the world wars, it was popular for workers to have their ID number tatooed on their arm.
- t0astbread 6y ago
  With software I'd be wary of making it the last line of defense, especially for very significant acts such as voting. A bug in the system would be totally fatal, not only for society but especially for the victim. Even more so if bugs aren't commonplace but only sporadic. Using cryptography in addition to "classic" means of attestation sounds a lot better to me. You could also make it an "optional feature" of people's citizenships (like 2FA on an account) to ease adoption.
Pentamerous 6y ago
In Portugal we have this. Each citizen identification card (called Cartão do Cidadão) has a unique certificate and the official Software allows you to sign any documents with it. Unfortunatly, I have never used this and never saw anyone using it. I never heard of any company accepting contracts signed with it. The technology is ready, but pen and paper are still the norm.

Forge36 6y ago

I can't do the former, i can attempt the later. I'm sure some service would figure out a way.

Edmond 6y ago

This is mainly an app design issue...Certify makes cryptography including the question of keys completely transparent to the user. The user just needs to learns how to perform some simple operations with the app, they never have to know about private/public keys.