4 ms·

> and were surprised to find that just one of the five multiple-guess questions they were asked after entering their address, Social Security Number and date of

> and were surprised to find that just one of the five multiple-guess questions they were asked after entering their address, Social Security Number and date of birth had anything to do with information only the credit bureau might know. And a lot more than the credit bureau know those two pieces of information. Honestly, the US really needs a government run public key ID service. The government in providing passports and drivers’ licenses is already doing identity verification. If along with your passport they would allow you to register a public key that people could use to verify your identity, it would be a huge help.

dylan604 6y ago
Passports are federal while driver licenses are issued through the state. If you're suggesting that the public key be linked to a passport, then I'm guessing quite a few states will oppose that on "state's rights" standing.
- dataflow 6y ago
  How about having the states run ID services?
  - dylan604 6y ago
    They already do this. Most common is the drivers license. If you don't need to drive, there is still a state ID that can be issued.
    - dataflow 6y ago
      I meant a digital ID. For verifying with these services.
- mikestew 6y ago
  No, it will be opposed because of an American aversion to a national ID. I would argue that a passport is the same thing, but a passport is optional in the U. S.
  - 0xbadcafebee 6y ago
    The REAL ID is a mix of both state and federal. It is "optional", except that they won't let you fly or enter a government building without one. https://en.wikipedia.org/wiki/Real_ID_Act https://en.wikipedia.org/wiki/Real_ID_Act "Starting October 1, 2021 (originally scheduled for October 1, 2020 but was postponed a year due to a global coronavirus pandemic[6]), every air traveler will need a REAL ID–compliant license or another acceptable form of identification (such as a U.S. passport, U.S. passport card, U.S. military card, or DHS trusted traveler card, e.g. Global Entry, NEXUS, SENTRI, FAST) for domestic air travel." Apparently the government is gravely concerned that terrorists might fly from Boise to Twin Falls, so we need to make them generate at least 3 to 4 forged documents, to force them to get the super duper secure drivers license.
  - dylan604 6y ago
    So why does it need to be federal? Make it a responsibilty of the states. Either way, it will be mismanaged, so might as well make it as complicated as possible by having 50+ mismanaged things.
    - mikestew 6y ago
      Make it a responsibilty of the states. I'd go find links on RealID, and the resistance to that, but it should be an easy query away. RealID made it the responsibility of the states, and people still didn't want it. As I understand it, mainly because it was just a proxy for a federal ID.
      - esrauch 6y ago
        NY wouldn't give me a RealId since I don't have a physical SS card even though I have a passport and birth certificate. So it seems like the system is kind of broken.
aneutron 6y ago
Not necessarily. The chain of trust doesn't require such a drastic deployment. In Europe, it's common place to be able to subscribe to loans, or similar contracts online. However, the legislation is VERY strict about requiring very tough MFA-authentication. Say for example you would want to subscribe to a new credit card. You would either have to go personally to do it (which means they can verify your identity), or you can do it from your Online portal. HOWEVER, if you choose to do entirely online, you HAVE to use your phone as a 2nd factor to authorize the operation. I'm not saying there's no identity theft. There absolutely is. But they are extremely strict about authenticating each and every (considerable) move. I guess what I'm trying to say is, a PKI for the US. government is not necessary (in fact, given the time and resistance it took to deploy SECURE ID, I'd say it's dead in the waters right now), and would only require legislators not in the bed with credit card companies, to setup and enforce strict rules for authenticating orders / proceedings.
scott00 6y ago
The government PKI actually almost exists already. Passports have an rfid chip inside them that does something like receive a challenge and respond with a signature over a hash of the passports biographical data combined with the challenge, along with the public key corresponding to the signing key, and a certificate signed by a government key to confirm the signing key is legit. The government public keys are published, so anybody can verify that someone who claims to have possession of a particular passport really does. The weak point is that as far as I can tell the revocation list is not public, so you can't distiguish between a stolen and not stolen passport.

dylan604 6y ago

Passports are federal while driver licenses are issued through the state. If you're suggesting that the public key be linked to a passport, then I'm guessing quite a few states will oppose that on "state's rights" standing.

dataflow 6y ago
How about having the states run ID services?
- dylan604 6y ago
  They already do this. Most common is the drivers license. If you don't need to drive, there is still a state ID that can be issued.
  - dataflow 6y ago
    I meant a digital ID. For verifying with these services.
mikestew 6y ago
No, it will be opposed because of an American aversion to a national ID. I would argue that a passport is the same thing, but a passport is optional in the U. S.
- 0xbadcafebee 6y ago
  The REAL ID is a mix of both state and federal. It is "optional", except that they won't let you fly or enter a government building without one. https://en.wikipedia.org/wiki/Real_ID_Act https://en.wikipedia.org/wiki/Real_ID_Act "Starting October 1, 2021 (originally scheduled for October 1, 2020 but was postponed a year due to a global coronavirus pandemic[6]), every air traveler will need a REAL ID–compliant license or another acceptable form of identification (such as a U.S. passport, U.S. passport card, U.S. military card, or DHS trusted traveler card, e.g. Global Entry, NEXUS, SENTRI, FAST) for domestic air travel." Apparently the government is gravely concerned that terrorists might fly from Boise to Twin Falls, so we need to make them generate at least 3 to 4 forged documents, to force them to get the super duper secure drivers license.
- dylan604 6y ago
  So why does it need to be federal? Make it a responsibilty of the states. Either way, it will be mismanaged, so might as well make it as complicated as possible by having 50+ mismanaged things.
  - mikestew 6y ago
    Make it a responsibilty of the states. I'd go find links on RealID, and the resistance to that, but it should be an easy query away. RealID made it the responsibility of the states, and people still didn't want it. As I understand it, mainly because it was just a proxy for a federal ID.
    - esrauch 6y ago
      NY wouldn't give me a RealId since I don't have a physical SS card even though I have a passport and birth certificate. So it seems like the system is kind of broken.

aneutron 6y ago

Not necessarily. The chain of trust doesn't require such a drastic deployment. In Europe, it's common place to be able to subscribe to loans, or similar contracts online. However, the legislation is VERY strict about requiring very tough MFA-authentication. Say for example you would want to subscribe to a new credit card. You would either have to go personally to do it (which means they can verify your identity), or you can do it from your Online portal. HOWEVER, if you choose to do entirely online, you HAVE to use your phone as a 2nd factor to authorize the operation. I'm not saying there's no identity theft. There absolutely is. But they are extremely strict about authenticating each and every (considerable) move. I guess what I'm trying to say is, a PKI for the US. government is not necessary (in fact, given the time and resistance it took to deploy SECURE ID, I'd say it's dead in the waters right now), and would only require legislators not in the bed with credit card companies, to setup and enforce strict rules for authenticating orders / proceedings.

scott00 6y ago

The government PKI actually almost exists already. Passports have an rfid chip inside them that does something like receive a challenge and respond with a signature over a hash of the passports biographical data combined with the challenge, along with the public key corresponding to the signing key, and a certificate signed by a government key to confirm the signing key is legit. The government public keys are published, so anybody can verify that someone who claims to have possession of a particular passport really does. The weak point is that as far as I can tell the revocation list is not public, so you can't distiguish between a stolen and not stolen passport.