10 ms·

The EU has a federated public key cryptography based identity system. The member states recognize identities issued by other member states, but there is no cent

The EU has a federated public key cryptography based identity system. The member states recognize identities issued by other member states, but there is no central system. In any case, the private key is stored on a plastic ID, which acts as a smart card and can be hooked up to a smartphone/PC for identity verification and document signing online. The key is only released with a PIN, and the databases online only store the corresponding public key. A leak of a public key without the private key is (relative to SSN) harmless. https://en.m.wikipedia.org/wiki/EIDAS https://en.m.wikipedia.org/wiki/EIDAS Can we please have this in the US?

netsec_burn 5y ago
Wow, it exists. I dreamed about having something like this in the US, with the possibility of changing your private key if you visit the DMV. It would make a significant difference in the fight against identity theft, versus our current system of having a number of which only 4 digits are "secret" (and I hear those are sequential too. Worse still, they are the same 4 digits everyone asks you for).
- sneak 5y ago
  How would the DMV authenticate you? Would you like each state to do it, or a federal system? Many state DMVs sell their whole database to private companies like auto insurers and marketers. What makes you think they should continue to be stewards of this sensitive personal information when they have mishandled it so badly in the past? Why do we need strong ID so often anyway? Most things people demand ID for don't actually need ID.
  - lou1306 5y ago
    > Why do we need strong ID so often anyway? ... To prevent identity theft?
    - sneak 5y ago
      Bank fraud (a better name for it) generally does need strong ID, but the vast majority of transactions in which people are demanded to show ID to transact have nothing to do with this. You only do bank loans, mortgages, lines of credit and the like a few times per year. Your ID is demanded so often in the USA there is even a hand signal for it that everyone knows (a C shape made with the right hand held up at eye level).
      - hhjj 5y ago
        Maybe ID is asked to feed marketing database so they can sell data about you ? In Europe we aren't asked IDs but usually email/phone numbers and that's for marketing reason (spamming and being able to identify customers cross businesses).
      - _jal 5y ago
        As a first step, stop giving in to the demands. I routinely refuse to provide ID when asked by private businesses. About half the time they're OK with proceeding with whatever without it.
        sneak 5y ago
        First off, you're preaching to the choir. I show ID for many fewer things than the average person, and perhaps even yourself. There are however many, many things that you are simply entirely barred from doing in the USA without showing ID. It's even worse in Europe. Many music venues (the vast majority), all federally licensed firearms retailers, almost all hotels and modes of travel. Perhaps you can live without music, air travel, hotels, and firearms, but I cannot.
        yencabulator 5y ago
        In Europe, the ID you show in that situation contains no private information. Date of birth and address are not authenticators!
  - azernik 5y ago
    DMVs in the US already have fingerprint scanners; there exist physical documents that verify your identity and associate it with a face and name. In this case, you'd have the Interior Ministry or equivalent be the certificate authority, and it can issue revocations and new certs based on the normal identity verification systems of the state.
  - zamadatix 5y ago
    Doesn't particularly matter how the DMV would authenticate you, the point of the electronic ID is to get rid of the exchange of full copies of the identifying information. More careful re-assignment of identifying information is nice to pursue but also a completely independent issue. Same with state vs federal question. Right now SSNs are assigned federally and drivers licenses and birth certificates by state. It doesn't much matter which it comes from as long as the identification is trusted nationally (as it is currently with the above examples). What DMVs are able to sell varies by state, many can't sell drivers license photos for example. SSNs are also illegal to sell based on federal law. Ultimately that comes down to the content of the law relating to creating said ID not past actions with other information. As for why we need to identify ourselves so often it often comes down to the public use case of credit checks and various forms of identification for governmental reasons (e.g. applying for official licenses or forms or travel documents or so on). It's perfectly fine to do these 2 separate but as-is we are already tying the 2 together so why not answer both in one go with something like eIDAS.
  - iknowstuff 5y ago
    Well the databases are already there whether we like it or not. Generally, with eIDAS, various websites can use an API to access the identity stored on your ID (public key) when you allow it. Crucially, every time you want to make a legally binding change or sign a document, you need to ask your ID to use its private key to cryptographically sign it. Typically this operation needs a PIN. Without such a valid signature, you won't be able to use someone's credit line. With a well designed system, the government can provide an API to give institutions/apps unique, but app-specific people identifiers. Those can be trusted to each be tied to a unique person, without making it possible to track the services they use (unlike the easily trackable SSN).
  - jvanderbot 5y ago
    "I don't trust the government" is moot. You already use your government issued ID for everything. Asking them to improve their technology is not asking them to takeover any new responsibilities.
deleted 5y ago
[deleted]
merb 5y ago
except that eIDAS is basically not in use in germany.
- gostsamo 5y ago
  Well, Germany is not the entire EU. I have such card and it comes in handy from time to time, though the implementation could be much better.
  - merb 5y ago
    I'm pretty sure that in france eIDAS is not there aswell, which would already mean that over 1/3 (probably more, because more states basically don't have it implemented) of the european member states population does not use it (yet)
    - gostsamo 5y ago
      This is sad and totally not my problem. I like the option to access easily my tax and health information and to get e-signed invoices instead of dealing with paper and stuff. I hope that the rest of the EU will do their part of crossing to the 21th century.
  - wiredfool 5y ago
    Haven’t seen it in Ireland either.
    - gostsamo 5y ago
      I think that it exist under the name electronic signature. Here is a pdf that might talk about it in IE: https://www.lawsociety.ie/globalassets/documents/committees/business/e-signatures-electronic-contracts-other-electronic-transactions.pdf https://www.lawsociety.ie/globalassets/documents/committees/...
- iknowstuff 5y ago
  These things take time to implement. It's slowly getting rolled out. Germany in particular is.. digitally challenged as a country.
SahAssar 5y ago
The ID is not always on a plastic id card, for example BankID (at least the swedish variant) is eIDAS compliant and is instead an app where the identity is issued by your bank. I have the ID card with smartcard capabilities too but I've never seen any place in sweden where they are used, but it's good to know I have it if I need to identify in the rest of europe.
- iknowstuff 5y ago
  Here's hoping they at least store the key on Secure Enclave [1]/Secure Element so it's inaccessible to the operating system in case of a breach. [1] https://developer.apple.com/documentation/security/certificate_key_and_trust_services/keys/storing_keys_in_the_secure_enclave https://developer.apple.com/documentation/security/certifica...
  - jeffmcjunkin 5y ago
    Smart cards are essentially a big Secure Enclave themselves. The whole point of a smart card (same as a military CAC, and almost the same as a TPM chip on computers) is to sign operations using the private key, without allowing export of that private key. They're still made of atoms, like all objects, and susceptible to physical key extraction attacks.
swiley 5y ago
>Can we please have this in the US? Absolutely not. How about not requiring an ID? There are plenty of carriers here that don't do that.
- astura 5y ago
  A post paid phone plan in the US is a contract with a rotating line if credit - that is why the ID is required. If you don't want to show id there's plenty of prepaid options (including with TMobile). You can also pay someone else to put you on their plan - the carrier only has the identification information for the plan owner.
  - wil421 5y ago
    Just to add. Mint Mobile offers prepaid plans and doesn’t require a SSN. Harvard has a list I found on google. https://www.hio.harvard.edu/telephone-service https://www.hio.harvard.edu/telephone-service
  - toast0 5y ago
    With today's postpaid plans that have almost no way to get an overage, what's the point of setting it up to require credit? The postpaid plans are usually more expensive than prepaid, and they require a SSN and I'm not going to make the difference back by investing the payment for a month.
    - cma 5y ago
      Because late fees are a primary profit source for cell carriers.
    - memco 5y ago
      When I asked about this on AT&T I was told that prepaid plans do not qualify for some type of peering system that increases coverage and reception by using other carrier's towers: I haven't looked into it more, but if this is true this would be a potential factor in choosing post-paid over pre-paid. Would love to know if this is true for AT&T or all carriers as if I can get pre-paid service of the same level as a post-paid plan I would make the switch.
dahfizz 5y ago
Better yet, why does my cell phone provider need all this information about me anyway? Why is there an ID involved at all?
- gruez 5y ago
  credit checks (for post-paid plans), I believe.
  - pengaru 5y ago
    They could just require a cash deposit and pause service when you run up a bill exceeding that amt, but to the best of my knowledge they don't offer this option or if they do they don't promote it. It's just pre-paid or credit-based contracts AIUI. My power company asked for my SSN when setting up the utilities, after plainly refusing to provide it they said a $250 deposit would be required, done!
  - jonny_eh 5y ago
    But why do they store it?
    - dharmab 5y ago
      Postpaid plans are a rotating line of credit- you are credited the upcoming charges and pay off previous charges.
    - astura 5y ago
      Post-paid plans are a small rotating line of credit - just like a credit card. If you don't pay your bill or pay off your phone you get reported to the credit bureaus and sent to collections.
- astura 5y ago
  There isn't if you have a prepaid plan. IDs are only required if you want a post-paid plan and/or monthly financing for your phone. It's a rotating line of credit.
- deleted 5y ago
jandrewrogers 5y ago
It is illegal for the US government to create a mandatory national identity system or coerce the States into creating one. The limits of this have been pretty thoroughly tested in the US Supreme Court. Every time things like this come up, everyone asks why don't we just thing that looks like a national identity system to fix the issue, as if that never occurred to anyone in Congress. This is why: it violates the Constitution. Short of amending the Constitution, which seems highly unlikely, the US will never have a national identity system like European countries.
- volta83 5y ago
  > It is illegal for the US government to create a mandatory national identity system The system can be voluntary. If you don't need an SSN today, you wouldn't need to use that system. If some bank or health care provider only accepts such a system, just pick another one, or create your own bank / health care provider.
  - smsm42 5y ago
    You can not create a bank that does not verify identity according to a myriad of KYC regulations. You'd be heavily fined and most likely jailed if you do. Not sure about healthcare providers, probably if you're something like a massage therapist, there are no such requirements, but for a larger one there are probably regulations too.
    - InitialLastName 5y ago
      I suspect that for healthcare providers, the ID requirement is driven more by insurance fraud prevention (including Medicare/Medicaid); i.e. the insurers require the providers to perform due diligence to ensure that the patient being treated is the patient who is covered. I don't know of any examples, but perhaps a provider who did not take insurance would be able to avoid the requirement.
    - volta83 5y ago
      So how do banks verify identity in the US ?
solatic 5y ago
What if you lose your card? How do you prove your identity to get a replacement? How do you prevent someone from reporting your card as stolen, representing themselves as you, and getting a new card (with a new PIN) issued in your name? What if you forget your PIN, how do you reset it? You make it seem like the EU has an ideal system, but the truth of the matter is that identity verification, in a way that is both reliable enough to allow it to be used for making legal commitments (that cannot be backed out of), is flexible enough to suit a long tail of edge cases (the intellectually disabled, the elderly, children, etc.), and is secure enough against loss or theft is a very hard problem.
- pokoleo 5y ago
  Not sure what they do in the EU, but these seem solveable. > What if you lose your card? Each country could keep a log of revoked publishable keys. Countries do more complex things to validate VAT IDs today, so this wouldn't be out of the blue. > How do you prove your identity to get a replacement? How do you prevent someone from reporting your card as stolen, representing themselves as you, and getting a new card (with a new PIN) issued in your name? Governments need to solve the same issue with lost passports today. In some cases you can have other people to vouch for you, putting their own identities on the line. In other cases, you use other forms of ID (including immutable things like biometrics). Society has generally made this not a problem, and a new form of ID won't make it worse. > What if you forget your PIN, how do you reset it? At the worst, it's treated as a lost card and get a replacement. There are probably ways to make this better but my point is: solveable.

netsec_burn 5y ago

Wow, it exists. I dreamed about having something like this in the US, with the possibility of changing your private key if you visit the DMV. It would make a significant difference in the fight against identity theft, versus our current system of having a number of which only 4 digits are "secret" (and I hear those are sequential too. Worse still, they are the same 4 digits everyone asks you for).

sneak 5y ago
How would the DMV authenticate you? Would you like each state to do it, or a federal system? Many state DMVs sell their whole database to private companies like auto insurers and marketers. What makes you think they should continue to be stewards of this sensitive personal information when they have mishandled it so badly in the past? Why do we need strong ID so often anyway? Most things people demand ID for don't actually need ID.
- lou1306 5y ago
  > Why do we need strong ID so often anyway? ... To prevent identity theft?
  - sneak 5y ago
    Bank fraud (a better name for it) generally does need strong ID, but the vast majority of transactions in which people are demanded to show ID to transact have nothing to do with this. You only do bank loans, mortgages, lines of credit and the like a few times per year. Your ID is demanded so often in the USA there is even a hand signal for it that everyone knows (a C shape made with the right hand held up at eye level).
    - hhjj 5y ago
      Maybe ID is asked to feed marketing database so they can sell data about you ? In Europe we aren't asked IDs but usually email/phone numbers and that's for marketing reason (spamming and being able to identify customers cross businesses).
    - _jal 5y ago
      As a first step, stop giving in to the demands. I routinely refuse to provide ID when asked by private businesses. About half the time they're OK with proceeding with whatever without it.
      - sneak 5y ago
        First off, you're preaching to the choir. I show ID for many fewer things than the average person, and perhaps even yourself. There are however many, many things that you are simply entirely barred from doing in the USA without showing ID. It's even worse in Europe. Many music venues (the vast majority), all federally licensed firearms retailers, almost all hotels and modes of travel. Perhaps you can live without music, air travel, hotels, and firearms, but I cannot.
        yencabulator 5y ago
        In Europe, the ID you show in that situation contains no private information. Date of birth and address are not authenticators!
- azernik 5y ago
  DMVs in the US already have fingerprint scanners; there exist physical documents that verify your identity and associate it with a face and name. In this case, you'd have the Interior Ministry or equivalent be the certificate authority, and it can issue revocations and new certs based on the normal identity verification systems of the state.
- zamadatix 5y ago
  Doesn't particularly matter how the DMV would authenticate you, the point of the electronic ID is to get rid of the exchange of full copies of the identifying information. More careful re-assignment of identifying information is nice to pursue but also a completely independent issue. Same with state vs federal question. Right now SSNs are assigned federally and drivers licenses and birth certificates by state. It doesn't much matter which it comes from as long as the identification is trusted nationally (as it is currently with the above examples). What DMVs are able to sell varies by state, many can't sell drivers license photos for example. SSNs are also illegal to sell based on federal law. Ultimately that comes down to the content of the law relating to creating said ID not past actions with other information. As for why we need to identify ourselves so often it often comes down to the public use case of credit checks and various forms of identification for governmental reasons (e.g. applying for official licenses or forms or travel documents or so on). It's perfectly fine to do these 2 separate but as-is we are already tying the 2 together so why not answer both in one go with something like eIDAS.
- iknowstuff 5y ago
  Well the databases are already there whether we like it or not. Generally, with eIDAS, various websites can use an API to access the identity stored on your ID (public key) when you allow it. Crucially, every time you want to make a legally binding change or sign a document, you need to ask your ID to use its private key to cryptographically sign it. Typically this operation needs a PIN. Without such a valid signature, you won't be able to use someone's credit line. With a well designed system, the government can provide an API to give institutions/apps unique, but app-specific people identifiers. Those can be trusted to each be tied to a unique person, without making it possible to track the services they use (unlike the easily trackable SSN).
- jvanderbot 5y ago
  "I don't trust the government" is moot. You already use your government issued ID for everything. Asking them to improve their technology is not asking them to takeover any new responsibilities.

deleted 5y ago

[deleted]

merb 5y ago

except that eIDAS is basically not in use in germany.

gostsamo 5y ago
Well, Germany is not the entire EU. I have such card and it comes in handy from time to time, though the implementation could be much better.
- merb 5y ago
  I'm pretty sure that in france eIDAS is not there aswell, which would already mean that over 1/3 (probably more, because more states basically don't have it implemented) of the european member states population does not use it (yet)
  - gostsamo 5y ago
    This is sad and totally not my problem. I like the option to access easily my tax and health information and to get e-signed invoices instead of dealing with paper and stuff. I hope that the rest of the EU will do their part of crossing to the 21th century.
- wiredfool 5y ago
  Haven’t seen it in Ireland either.
  - gostsamo 5y ago
    I think that it exist under the name electronic signature. Here is a pdf that might talk about it in IE: https://www.lawsociety.ie/globalassets/documents/committees/business/e-signatures-electronic-contracts-other-electronic-transactions.pdf https://www.lawsociety.ie/globalassets/documents/committees/...
iknowstuff 5y ago
These things take time to implement. It's slowly getting rolled out. Germany in particular is.. digitally challenged as a country.

SahAssar 5y ago

The ID is not always on a plastic id card, for example BankID (at least the swedish variant) is eIDAS compliant and is instead an app where the identity is issued by your bank. I have the ID card with smartcard capabilities too but I've never seen any place in sweden where they are used, but it's good to know I have it if I need to identify in the rest of europe.

iknowstuff 5y ago
Here's hoping they at least store the key on Secure Enclave [1]/Secure Element so it's inaccessible to the operating system in case of a breach. [1] https://developer.apple.com/documentation/security/certificate_key_and_trust_services/keys/storing_keys_in_the_secure_enclave https://developer.apple.com/documentation/security/certifica...
- jeffmcjunkin 5y ago
  Smart cards are essentially a big Secure Enclave themselves. The whole point of a smart card (same as a military CAC, and almost the same as a TPM chip on computers) is to sign operations using the private key, without allowing export of that private key. They're still made of atoms, like all objects, and susceptible to physical key extraction attacks.

swiley 5y ago

>Can we please have this in the US? Absolutely not. How about not requiring an ID? There are plenty of carriers here that don't do that.

astura 5y ago
A post paid phone plan in the US is a contract with a rotating line if credit - that is why the ID is required. If you don't want to show id there's plenty of prepaid options (including with TMobile). You can also pay someone else to put you on their plan - the carrier only has the identification information for the plan owner.
- wil421 5y ago
  Just to add. Mint Mobile offers prepaid plans and doesn’t require a SSN. Harvard has a list I found on google. https://www.hio.harvard.edu/telephone-service https://www.hio.harvard.edu/telephone-service
- toast0 5y ago
  With today's postpaid plans that have almost no way to get an overage, what's the point of setting it up to require credit? The postpaid plans are usually more expensive than prepaid, and they require a SSN and I'm not going to make the difference back by investing the payment for a month.
  - cma 5y ago
    Because late fees are a primary profit source for cell carriers.
  - memco 5y ago
    When I asked about this on AT&T I was told that prepaid plans do not qualify for some type of peering system that increases coverage and reception by using other carrier's towers: I haven't looked into it more, but if this is true this would be a potential factor in choosing post-paid over pre-paid. Would love to know if this is true for AT&T or all carriers as if I can get pre-paid service of the same level as a post-paid plan I would make the switch.

dahfizz 5y ago

Better yet, why does my cell phone provider need all this information about me anyway? Why is there an ID involved at all?

gruez 5y ago
credit checks (for post-paid plans), I believe.
- pengaru 5y ago
  They could just require a cash deposit and pause service when you run up a bill exceeding that amt, but to the best of my knowledge they don't offer this option or if they do they don't promote it. It's just pre-paid or credit-based contracts AIUI. My power company asked for my SSN when setting up the utilities, after plainly refusing to provide it they said a $250 deposit would be required, done!
- jonny_eh 5y ago
  But why do they store it?
  - dharmab 5y ago
    Postpaid plans are a rotating line of credit- you are credited the upcoming charges and pay off previous charges.
  - astura 5y ago
    Post-paid plans are a small rotating line of credit - just like a credit card. If you don't pay your bill or pay off your phone you get reported to the credit bureaus and sent to collections.
astura 5y ago
There isn't if you have a prepaid plan. IDs are only required if you want a post-paid plan and/or monthly financing for your phone. It's a rotating line of credit.
deleted 5y ago

jandrewrogers 5y ago

It is illegal for the US government to create a mandatory national identity system or coerce the States into creating one. The limits of this have been pretty thoroughly tested in the US Supreme Court. Every time things like this come up, everyone asks why don't we just thing that looks like a national identity system to fix the issue, as if that never occurred to anyone in Congress. This is why: it violates the Constitution. Short of amending the Constitution, which seems highly unlikely, the US will never have a national identity system like European countries.

volta83 5y ago
> It is illegal for the US government to create a mandatory national identity system The system can be voluntary. If you don't need an SSN today, you wouldn't need to use that system. If some bank or health care provider only accepts such a system, just pick another one, or create your own bank / health care provider.
- smsm42 5y ago
  You can not create a bank that does not verify identity according to a myriad of KYC regulations. You'd be heavily fined and most likely jailed if you do. Not sure about healthcare providers, probably if you're something like a massage therapist, there are no such requirements, but for a larger one there are probably regulations too.
  - InitialLastName 5y ago
    I suspect that for healthcare providers, the ID requirement is driven more by insurance fraud prevention (including Medicare/Medicaid); i.e. the insurers require the providers to perform due diligence to ensure that the patient being treated is the patient who is covered. I don't know of any examples, but perhaps a provider who did not take insurance would be able to avoid the requirement.
  - volta83 5y ago
    So how do banks verify identity in the US ?

solatic 5y ago

What if you lose your card? How do you prove your identity to get a replacement? How do you prevent someone from reporting your card as stolen, representing themselves as you, and getting a new card (with a new PIN) issued in your name? What if you forget your PIN, how do you reset it? You make it seem like the EU has an ideal system, but the truth of the matter is that identity verification, in a way that is both reliable enough to allow it to be used for making legal commitments (that cannot be backed out of), is flexible enough to suit a long tail of edge cases (the intellectually disabled, the elderly, children, etc.), and is secure enough against loss or theft is a very hard problem.

pokoleo 5y ago
Not sure what they do in the EU, but these seem solveable. > What if you lose your card? Each country could keep a log of revoked publishable keys. Countries do more complex things to validate VAT IDs today, so this wouldn't be out of the blue. > How do you prove your identity to get a replacement? How do you prevent someone from reporting your card as stolen, representing themselves as you, and getting a new card (with a new PIN) issued in your name? Governments need to solve the same issue with lost passports today. In some cases you can have other people to vouch for you, putting their own identities on the line. In other cases, you use other forms of ID (including immutable things like biometrics). Society has generally made this not a problem, and a new form of ID won't make it worse. > What if you forget your PIN, how do you reset it? At the worst, it's treated as a lost card and get a replacement. There are probably ways to make this better but my point is: solveable.