5 ms·

Wow, it exists. I dreamed about having something like this in the US, with the possibility of changing your private key if you visit the DMV. It would make a si

Wow, it exists. I dreamed about having something like this in the US, with the possibility of changing your private key if you visit the DMV. It would make a significant difference in the fight against identity theft, versus our current system of having a number of which only 4 digits are "secret" (and I hear those are sequential too. Worse still, they are the same 4 digits everyone asks you for).

sneak 5y ago
How would the DMV authenticate you? Would you like each state to do it, or a federal system? Many state DMVs sell their whole database to private companies like auto insurers and marketers. What makes you think they should continue to be stewards of this sensitive personal information when they have mishandled it so badly in the past? Why do we need strong ID so often anyway? Most things people demand ID for don't actually need ID.
- lou1306 5y ago
  > Why do we need strong ID so often anyway? ... To prevent identity theft?
  - sneak 5y ago
    Bank fraud (a better name for it) generally does need strong ID, but the vast majority of transactions in which people are demanded to show ID to transact have nothing to do with this. You only do bank loans, mortgages, lines of credit and the like a few times per year. Your ID is demanded so often in the USA there is even a hand signal for it that everyone knows (a C shape made with the right hand held up at eye level).
    - hhjj 5y ago
      Maybe ID is asked to feed marketing database so they can sell data about you ? In Europe we aren't asked IDs but usually email/phone numbers and that's for marketing reason (spamming and being able to identify customers cross businesses).
    - _jal 5y ago
      As a first step, stop giving in to the demands. I routinely refuse to provide ID when asked by private businesses. About half the time they're OK with proceeding with whatever without it.
      - sneak 5y ago
        First off, you're preaching to the choir. I show ID for many fewer things than the average person, and perhaps even yourself. There are however many, many things that you are simply entirely barred from doing in the USA without showing ID. It's even worse in Europe. Many music venues (the vast majority), all federally licensed firearms retailers, almost all hotels and modes of travel. Perhaps you can live without music, air travel, hotels, and firearms, but I cannot.
        yencabulator 5y ago
        In Europe, the ID you show in that situation contains no private information. Date of birth and address are not authenticators!
        sneak 5y ago
        As a US citizen in Europe, the ID they require from me is a passport.
- azernik 5y ago
  DMVs in the US already have fingerprint scanners; there exist physical documents that verify your identity and associate it with a face and name. In this case, you'd have the Interior Ministry or equivalent be the certificate authority, and it can issue revocations and new certs based on the normal identity verification systems of the state.
- zamadatix 5y ago
  Doesn't particularly matter how the DMV would authenticate you, the point of the electronic ID is to get rid of the exchange of full copies of the identifying information. More careful re-assignment of identifying information is nice to pursue but also a completely independent issue. Same with state vs federal question. Right now SSNs are assigned federally and drivers licenses and birth certificates by state. It doesn't much matter which it comes from as long as the identification is trusted nationally (as it is currently with the above examples). What DMVs are able to sell varies by state, many can't sell drivers license photos for example. SSNs are also illegal to sell based on federal law. Ultimately that comes down to the content of the law relating to creating said ID not past actions with other information. As for why we need to identify ourselves so often it often comes down to the public use case of credit checks and various forms of identification for governmental reasons (e.g. applying for official licenses or forms or travel documents or so on). It's perfectly fine to do these 2 separate but as-is we are already tying the 2 together so why not answer both in one go with something like eIDAS.
- iknowstuff 5y ago
  Well the databases are already there whether we like it or not. Generally, with eIDAS, various websites can use an API to access the identity stored on your ID (public key) when you allow it. Crucially, every time you want to make a legally binding change or sign a document, you need to ask your ID to use its private key to cryptographically sign it. Typically this operation needs a PIN. Without such a valid signature, you won't be able to use someone's credit line. With a well designed system, the government can provide an API to give institutions/apps unique, but app-specific people identifiers. Those can be trusted to each be tied to a unique person, without making it possible to track the services they use (unlike the easily trackable SSN).
- jvanderbot 5y ago
  "I don't trust the government" is moot. You already use your government issued ID for everything. Asking them to improve their technology is not asking them to takeover any new responsibilities.

sneak 5y ago

How would the DMV authenticate you? Would you like each state to do it, or a federal system? Many state DMVs sell their whole database to private companies like auto insurers and marketers. What makes you think they should continue to be stewards of this sensitive personal information when they have mishandled it so badly in the past? Why do we need strong ID so often anyway? Most things people demand ID for don't actually need ID.

lou1306 5y ago
> Why do we need strong ID so often anyway? ... To prevent identity theft?
- sneak 5y ago
  Bank fraud (a better name for it) generally does need strong ID, but the vast majority of transactions in which people are demanded to show ID to transact have nothing to do with this. You only do bank loans, mortgages, lines of credit and the like a few times per year. Your ID is demanded so often in the USA there is even a hand signal for it that everyone knows (a C shape made with the right hand held up at eye level).
  - hhjj 5y ago
    Maybe ID is asked to feed marketing database so they can sell data about you ? In Europe we aren't asked IDs but usually email/phone numbers and that's for marketing reason (spamming and being able to identify customers cross businesses).
  - _jal 5y ago
    As a first step, stop giving in to the demands. I routinely refuse to provide ID when asked by private businesses. About half the time they're OK with proceeding with whatever without it.
    - sneak 5y ago
      First off, you're preaching to the choir. I show ID for many fewer things than the average person, and perhaps even yourself. There are however many, many things that you are simply entirely barred from doing in the USA without showing ID. It's even worse in Europe. Many music venues (the vast majority), all federally licensed firearms retailers, almost all hotels and modes of travel. Perhaps you can live without music, air travel, hotels, and firearms, but I cannot.
      - yencabulator 5y ago
        In Europe, the ID you show in that situation contains no private information. Date of birth and address are not authenticators!
        sneak 5y ago
        As a US citizen in Europe, the ID they require from me is a passport.
azernik 5y ago
DMVs in the US already have fingerprint scanners; there exist physical documents that verify your identity and associate it with a face and name. In this case, you'd have the Interior Ministry or equivalent be the certificate authority, and it can issue revocations and new certs based on the normal identity verification systems of the state.
zamadatix 5y ago
Doesn't particularly matter how the DMV would authenticate you, the point of the electronic ID is to get rid of the exchange of full copies of the identifying information. More careful re-assignment of identifying information is nice to pursue but also a completely independent issue. Same with state vs federal question. Right now SSNs are assigned federally and drivers licenses and birth certificates by state. It doesn't much matter which it comes from as long as the identification is trusted nationally (as it is currently with the above examples). What DMVs are able to sell varies by state, many can't sell drivers license photos for example. SSNs are also illegal to sell based on federal law. Ultimately that comes down to the content of the law relating to creating said ID not past actions with other information. As for why we need to identify ourselves so often it often comes down to the public use case of credit checks and various forms of identification for governmental reasons (e.g. applying for official licenses or forms or travel documents or so on). It's perfectly fine to do these 2 separate but as-is we are already tying the 2 together so why not answer both in one go with something like eIDAS.
iknowstuff 5y ago
Well the databases are already there whether we like it or not. Generally, with eIDAS, various websites can use an API to access the identity stored on your ID (public key) when you allow it. Crucially, every time you want to make a legally binding change or sign a document, you need to ask your ID to use its private key to cryptographically sign it. Typically this operation needs a PIN. Without such a valid signature, you won't be able to use someone's credit line. With a well designed system, the government can provide an API to give institutions/apps unique, but app-specific people identifiers. Those can be trusted to each be tied to a unique person, without making it possible to track the services they use (unlike the easily trackable SSN).
jvanderbot 5y ago
"I don't trust the government" is moot. You already use your government issued ID for everything. Asking them to improve their technology is not asking them to takeover any new responsibilities.