6 ms·

Here's yet another instance where a blockchain could possibly solve the identity crisis of Americans.

by 1-6 6y ago

2OEH8eoCRo0 6y ago
Nah. I think that companies need to verify identities better. All information about me is probably out there in some form but there is still only one "me". Verify "me" better. Companies who are tricked into doing things with stolen credentials should be held accountable.
eloff 6y ago
Or you know, a centralized database. The problem is not that your SSN can be leaked, the problem is that it shouldn't be trusted in the first place. How is it a thing that a bank can give a loan to anyone claiming to have my name and SSN, without verifying that, and then hold me legally responsible for their lack of judgment? And the court protects the bank? The problem here is the banks are being dumb, and rather than letting them suffer the consequences of that stupidity - the court makes it my problem. The legal system has seriously failed Americans here.
- adolph 6y ago
  How would a "centralized database" solve "a bank can give a loan to anyone claiming to have my name and SSN?"
  - eloff 6y ago
    How does a blockchain solve it in a way that a centralized db does not? The choice of db does nothing to address the underlying problems. Which was my point.
  - idiotsecant 6y ago
    In pretty much the same way that a decentralized database like a blockchain would. You interact with the centralized database to permit the transaction requested by the loan distributor, probably via 2FA. The only difference in the schemes is whether you need to trust the centralized database or not. Most people would much rather trust a large institution than have responsibility for managing their key.
- throwawayboise 6y ago
  > How is it a thing that a bank can give a loan to anyone claiming to have my name and SSN, without verifying that, and then hold me legally responsible for their lack of judgment? They can't. That's not to say that it doesn't happen, or that it might not be a PITA to sort it out. But in court they would need to have more than a name and SSN to prove that you took out the loan.
- jdsully 6y ago
  The problem is rarely with the courts most people don't lose lawsuits like that. The problem is when the real person goes to the bank for credit and can't get it because the bank thinks you are already in default.
  - eloff 6y ago
    And it could take up to a decade to sort out in the courts at your own expense. The courts and regulators have completely failed the people here. Why do they not slap the banks and credit rating agencies down for this behavior? They are failing egregiously to protect the little guy here.
- pmiller2 6y ago
  Or, how about we just don't publish everyone's legal identity in the same exact place? Sure, they won't be breaking into Geico to steal drivers' license numbers anymore, but just wait until this wonderful "centralized database" gets compromised....
  - eloff 6y ago
    I actually think we should do the opposite. Publish the name, birth date, email, ssn, etc of everybody in the country. Most of that is public knowledge by now anyway. But make one really good central db out of it open to all and companies will have to stop pretending it's a secret.
Guest42 6y ago
I would lean more towards better use of encryption and firewalls for the sake of simplicity and thoroughness. Can anyone with familiarity describe a solution/strategy?
trashcan 6y ago
I need to put my personal information in a public ledger, and then waste energy to prove it is correct?
- specialist 6y ago
  Yup, more or less. Misc central authorities issue you secure enclaves. Dept of licensing, health care system, banks, github, employer, etc. You then create key pairs as needed. Publish those public keys to misc web's of trust, as needed. Then use private digitally sign anything you think worth signing. Log those transactions to the misc blockchains, as needed. -- The alternative to authenticity is our current Freedom Speeches™ dystopia. Bots, sock puppets, identity theft industry, fraud, etc. For all the naysayers: Would you install unsigned, untrusted code? If you answer yes, then stuff like privacy and authenticity isn't really your priority. Choose wisely.
  - mindslight 6y ago
    The problem is that any such system needs to be designed such that an individual can't be forced to give up their ironclad identity to a grocery store for loyalty discounts, to a webstore simply to make a purchase, or even to an online discussion forum - eg through blinding, nyms, and legal restrictions. But we lack the political will to mandate this, because corporate interests will sponsor loopholes that eliminate any such protections. We have the current state of affairs precisely because the law failed to include any prohibition on companies demanding SSNs/DLs for arbitrary purposes. > Would you install unsigned, untrusted code? Yes. I trust javascript from https://google.com https://google.com the same as javascript from http://dodgywarez.example.com http://dodgywarez.example.com. Both get executed in a javascript VM, nested in a KVM VM, off of my main desktop machine. Security based on making sure that there is someone to sue just doesn't scale.
    - specialist 6y ago
      Somewhat sandboxed scripting vs operating system is like coupon flyers vs notarized legal documents. Would you bank online via HTTP (vs HTTPS)? When I was doing nodejs work, npm artifacts still weren't being signed. Sure, some people play in traffic. Doesn't mean we all should. People arguing against privacy & authenicity always remind me of a coworker who emphatically opposed password managers or any system whatsoever for managing secrets. Something something "single point of failure".
mindslight 6y ago
Exactly! Publish all the leaks of this needlessly-sensitive non-secret information into a blockchain, so that companies and governments are unable to ignore the obvious reality. Right now they're free to continue sticking their head in the sand and acting like anybody who gets a hold of their lists is a witch. So many companies refused to take code seriously security until the rise of full disclosure. We need a similar watershed for fallacious identification procedures.

Here's yet another instance where a blockchain could possibly solve the identity crisis of Americans.

by 1-6 6y ago

Here's yet another instance where a blockchain could possibly solve the identity crisis of Americans.

Nah. I think that companies need to verify identities better. All information about me is probably out there in some form but there is still only one "me". Verify "me" better. Companies who are tricked into doing things with stolen credentials should be held accountable.

eloff 6y ago

Or you know, a centralized database. The problem is not that your SSN can be leaked, the problem is that it shouldn't be trusted in the first place. How is it a thing that a bank can give a loan to anyone claiming to have my name and SSN, without verifying that, and then hold me legally responsible for their lack of judgment? And the court protects the bank? The problem here is the banks are being dumb, and rather than letting them suffer the consequences of that stupidity - the court makes it my problem. The legal system has seriously failed Americans here.

adolph 6y ago
How would a "centralized database" solve "a bank can give a loan to anyone claiming to have my name and SSN?"
- eloff 6y ago
  How does a blockchain solve it in a way that a centralized db does not? The choice of db does nothing to address the underlying problems. Which was my point.
- idiotsecant 6y ago
  In pretty much the same way that a decentralized database like a blockchain would. You interact with the centralized database to permit the transaction requested by the loan distributor, probably via 2FA. The only difference in the schemes is whether you need to trust the centralized database or not. Most people would much rather trust a large institution than have responsibility for managing their key.
throwawayboise 6y ago
> How is it a thing that a bank can give a loan to anyone claiming to have my name and SSN, without verifying that, and then hold me legally responsible for their lack of judgment? They can't. That's not to say that it doesn't happen, or that it might not be a PITA to sort it out. But in court they would need to have more than a name and SSN to prove that you took out the loan.
jdsully 6y ago
The problem is rarely with the courts most people don't lose lawsuits like that. The problem is when the real person goes to the bank for credit and can't get it because the bank thinks you are already in default.
- eloff 6y ago
  And it could take up to a decade to sort out in the courts at your own expense. The courts and regulators have completely failed the people here. Why do they not slap the banks and credit rating agencies down for this behavior? They are failing egregiously to protect the little guy here.
pmiller2 6y ago
Or, how about we just don't publish everyone's legal identity in the same exact place? Sure, they won't be breaking into Geico to steal drivers' license numbers anymore, but just wait until this wonderful "centralized database" gets compromised....
- eloff 6y ago
  I actually think we should do the opposite. Publish the name, birth date, email, ssn, etc of everybody in the country. Most of that is public knowledge by now anyway. But make one really good central db out of it open to all and companies will have to stop pretending it's a secret.

Guest42 6y ago

I would lean more towards better use of encryption and firewalls for the sake of simplicity and thoroughness. Can anyone with familiarity describe a solution/strategy?

trashcan 6y ago

I need to put my personal information in a public ledger, and then waste energy to prove it is correct?

specialist 6y ago
Yup, more or less. Misc central authorities issue you secure enclaves. Dept of licensing, health care system, banks, github, employer, etc. You then create key pairs as needed. Publish those public keys to misc web's of trust, as needed. Then use private digitally sign anything you think worth signing. Log those transactions to the misc blockchains, as needed. -- The alternative to authenticity is our current Freedom Speeches™ dystopia. Bots, sock puppets, identity theft industry, fraud, etc. For all the naysayers: Would you install unsigned, untrusted code? If you answer yes, then stuff like privacy and authenticity isn't really your priority. Choose wisely.
- mindslight 6y ago
  The problem is that any such system needs to be designed such that an individual can't be forced to give up their ironclad identity to a grocery store for loyalty discounts, to a webstore simply to make a purchase, or even to an online discussion forum - eg through blinding, nyms, and legal restrictions. But we lack the political will to mandate this, because corporate interests will sponsor loopholes that eliminate any such protections. We have the current state of affairs precisely because the law failed to include any prohibition on companies demanding SSNs/DLs for arbitrary purposes. > Would you install unsigned, untrusted code? Yes. I trust javascript from https://google.com https://google.com the same as javascript from http://dodgywarez.example.com http://dodgywarez.example.com. Both get executed in a javascript VM, nested in a KVM VM, off of my main desktop machine. Security based on making sure that there is someone to sue just doesn't scale.
  - specialist 6y ago
    Somewhat sandboxed scripting vs operating system is like coupon flyers vs notarized legal documents. Would you bank online via HTTP (vs HTTPS)? When I was doing nodejs work, npm artifacts still weren't being signed. Sure, some people play in traffic. Doesn't mean we all should. People arguing against privacy & authenicity always remind me of a coworker who emphatically opposed password managers or any system whatsoever for managing secrets. Something something "single point of failure".

mindslight 6y ago

Exactly! Publish all the leaks of this needlessly-sensitive non-secret information into a blockchain, so that companies and governments are unable to ignore the obvious reality. Right now they're free to continue sticking their head in the sand and acting like anybody who gets a hold of their lists is a witch. So many companies refused to take code seriously security until the rise of full disclosure. We need a similar watershed for fallacious identification procedures.