5 ms·

Apple is sticking taxpayers with part of the bill for rollout of digital ID card

32 points by wrycoder 5y ago

barbazoo 5y ago
> The feature, when combined with Apple’s biometric security measures like Face ID, could cut down on fraud. How much id card fraud is there really, are there any numbers?
- toomuchtodo 5y ago
  Identity theft/fraud is a big business, and bridging the gap between meatspace and digital identity is a win for everyone (except those who aren’t benefited by strong identity guarantees). Some cost sharing is reasonable on both the vendor and government sides. The onerous Apple requirements should be pushed back on.
  - barbazoo 5y ago
    Is that id card based though? I get that this prevents teenagers from buying booze but identity theft via the antiquated SSN based system isn't affected by this, is it?
    - toomuchtodo 5y ago
      Once your identity is proofed using physical identity credentials, your digital identity can be used not just for buying alcohol but also for air transit with the TSA. The logical conclusion is to then use your digital ID for credit and financial transactions, instead of credit knowledge tests or just winging it with personal data in forms. Baby steps. Think of how credit cards moved from mag stripe to chip, and merchants still using the mag stripe for transactions are liable for the fraud. https://www.buzzfeednews.com/article/katienotopoulos/apple-wallet-id-license-tsa https://www.buzzfeednews.com/article/katienotopoulos/apple-w...
- InTheArena 5y ago
  From my experience as a student in a college town. A awful lot.
  - barbazoo 5y ago
    Interesting, I always thought that's just a TV trope.
dane-pgp 5y ago
> The feature, when combined with Apple's biometric security measures like Face ID, could cut down on fraud. So in order for your identity to be accepted as valid by the governments under Apple's global ID system, you have to give their software a record of the unique biometric markers of your fingerprint or face, and agree to whatever terms Apple put in its ever-changing terms of use. I assume the Android implementation will end up being identical, to allow governments to give the illusion of choice, but there will be increasing pressure on people to enrol in this unified system, just like how regular covid testing (in lieu of vaccination) is made prohibitively expensive.
- MonkeyClub 5y ago
  Hm I don't know whether that post was worthy of a downvote. Its author raised a couple of valid points about privacy and agency, especially when viewing the issue from the perspective of pressure exerted.
  - jbnorth 5y ago
    I see where they're coming from and in a lot of ways agree with them. However, I can also see some benefits to this. For the average user, if they can have a government-issued ID tied to their Apple ID that should, in theory, prevent them from ever losing access to that account. The number of times I've had to work with new parents or elderly who just want the account back for pictures of children, grandchildren, etc but ultimately had no recourse is more than I'd like to think about. If, however, I could guide them to the nearest Apple store and say "show them your drivers license, they'll match it to your Apple ID and unlock it for you" that would make most people happy beyond belief. Is that ideal for the privacy-centric among us? No, absolutely not. But for the majority of people who just want to be able to get back into an account with all of their stuff in it it's a potentially great solution.
  - alphabettsy 5y ago
    But the author seems to misunderstand how it works almost completely. FaceID or TouchID protect access to the device which protects the ID, that’s the biometric part, there is nothing I see that requires or implies biometric data is used for anything else.
sumthinprofound 5y ago
Looks like there is an ISO standard for mobile digital driver licenses. I'm assuming Apple's MOA is requiring states to adhere to the standard (perhaps amongst additional requirements?) ISO 18013–5 details: https://medium.com/@dkelts.id/mobile-driver-licenses-mdl-how-to-use-iso-18013-5-5a1bbc1a37a3 https://medium.com/@dkelts.id/mobile-driver-licenses-mdl-how...
- throw0101a 5y ago
  See also: * https://en.wikipedia.org/wiki/Mobile_driver%27s_license https://en.wikipedia.org/wiki/Mobile_driver%27s_license
  - sumthinprofound 5y ago
    Very interesting piece of information from one of the wiki links: apple will only allow one fingerprint to be associated with drivers license info, to tie the driver's license to only one person and not everyone who may have device access through their fingerprints: https://appleinsider.com/articles/21/09/02/apple-wallet-limits-users-to-one-touch-id-finger-profile-when-authenticating-state-ids https://appleinsider.com/articles/21/09/02/apple-wallet-limi...
    - bradknowles 5y ago
      And what happens when someone loses that one finger?
alphabettsy 5y ago
I don’t see the concern. > “Apple requires states to maintain the systems needed to issue and service credentials at taxpayer expense”. I’m not aware of a State that doesn’t already issue and service it’s citizens identification cards. Why would Apple be responsible for it? The states are ultimately in control of the identification cards issued so it seems reasonable that they would be responsible for the technical implementation. It also seems completely reasonable that Apple would require they implement the system in a standardized way and have certain people available to make it successful. > Jason Mikula, a fintech consultant, says “I don’t know of any other example where government-owned systems and identity credentials were made available for commercial purposes in this manner.” but that categorization makes no sense. The ID cards are not be made available for commercial purposes. The ID cards are being made available in a digital form for the use of the identified person. > Importantly, in its contract, Apple shifts responsibility for confirming the authenticity of user identities onto states. Yea, who else would have the ability to validate an individual should have access to a particular person’s digital ID? Just like Apple Pay and others require the bank to validate you have permission for a particular card.
mcphage 5y ago
Is the alternative Apple controlling all of these peoples’ identification information? That would be way, way worse, than states having to host their own citizen’s information.
tinus_hn 5y ago
Remind me when companies start printing physical ID cards for free.

32 points by wrycoder 5y ago

> The feature, when combined with Apple’s biometric security measures like Face ID, could cut down on fraud. How much id card fraud is there really, are there any numbers?

toomuchtodo 5y ago
Identity theft/fraud is a big business, and bridging the gap between meatspace and digital identity is a win for everyone (except those who aren’t benefited by strong identity guarantees). Some cost sharing is reasonable on both the vendor and government sides. The onerous Apple requirements should be pushed back on.
- barbazoo 5y ago
  Is that id card based though? I get that this prevents teenagers from buying booze but identity theft via the antiquated SSN based system isn't affected by this, is it?
  - toomuchtodo 5y ago
    Once your identity is proofed using physical identity credentials, your digital identity can be used not just for buying alcohol but also for air transit with the TSA. The logical conclusion is to then use your digital ID for credit and financial transactions, instead of credit knowledge tests or just winging it with personal data in forms. Baby steps. Think of how credit cards moved from mag stripe to chip, and merchants still using the mag stripe for transactions are liable for the fraud. https://www.buzzfeednews.com/article/katienotopoulos/apple-wallet-id-license-tsa https://www.buzzfeednews.com/article/katienotopoulos/apple-w...
InTheArena 5y ago
From my experience as a student in a college town. A awful lot.
- barbazoo 5y ago
  Interesting, I always thought that's just a TV trope.

dane-pgp 5y ago

> The feature, when combined with Apple's biometric security measures like Face ID, could cut down on fraud. So in order for your identity to be accepted as valid by the governments under Apple's global ID system, you have to give their software a record of the unique biometric markers of your fingerprint or face, and agree to whatever terms Apple put in its ever-changing terms of use. I assume the Android implementation will end up being identical, to allow governments to give the illusion of choice, but there will be increasing pressure on people to enrol in this unified system, just like how regular covid testing (in lieu of vaccination) is made prohibitively expensive.

MonkeyClub 5y ago
Hm I don't know whether that post was worthy of a downvote. Its author raised a couple of valid points about privacy and agency, especially when viewing the issue from the perspective of pressure exerted.
- jbnorth 5y ago
  I see where they're coming from and in a lot of ways agree with them. However, I can also see some benefits to this. For the average user, if they can have a government-issued ID tied to their Apple ID that should, in theory, prevent them from ever losing access to that account. The number of times I've had to work with new parents or elderly who just want the account back for pictures of children, grandchildren, etc but ultimately had no recourse is more than I'd like to think about. If, however, I could guide them to the nearest Apple store and say "show them your drivers license, they'll match it to your Apple ID and unlock it for you" that would make most people happy beyond belief. Is that ideal for the privacy-centric among us? No, absolutely not. But for the majority of people who just want to be able to get back into an account with all of their stuff in it it's a potentially great solution.
- alphabettsy 5y ago
  But the author seems to misunderstand how it works almost completely. FaceID or TouchID protect access to the device which protects the ID, that’s the biometric part, there is nothing I see that requires or implies biometric data is used for anything else.

sumthinprofound 5y ago

Looks like there is an ISO standard for mobile digital driver licenses. I'm assuming Apple's MOA is requiring states to adhere to the standard (perhaps amongst additional requirements?) ISO 18013–5 details: https://medium.com/@dkelts.id/mobile-driver-licenses-mdl-how-to-use-iso-18013-5-5a1bbc1a37a3 https://medium.com/@dkelts.id/mobile-driver-licenses-mdl-how...

throw0101a 5y ago
See also: * https://en.wikipedia.org/wiki/Mobile_driver%27s_license https://en.wikipedia.org/wiki/Mobile_driver%27s_license
- sumthinprofound 5y ago
  Very interesting piece of information from one of the wiki links: apple will only allow one fingerprint to be associated with drivers license info, to tie the driver's license to only one person and not everyone who may have device access through their fingerprints: https://appleinsider.com/articles/21/09/02/apple-wallet-limits-users-to-one-touch-id-finger-profile-when-authenticating-state-ids https://appleinsider.com/articles/21/09/02/apple-wallet-limi...
  - bradknowles 5y ago
    And what happens when someone loses that one finger?

alphabettsy 5y ago

I don’t see the concern. > “Apple requires states to maintain the systems needed to issue and service credentials at taxpayer expense”. I’m not aware of a State that doesn’t already issue and service it’s citizens identification cards. Why would Apple be responsible for it? The states are ultimately in control of the identification cards issued so it seems reasonable that they would be responsible for the technical implementation. It also seems completely reasonable that Apple would require they implement the system in a standardized way and have certain people available to make it successful. > Jason Mikula, a fintech consultant, says “I don’t know of any other example where government-owned systems and identity credentials were made available for commercial purposes in this manner.” but that categorization makes no sense. The ID cards are not be made available for commercial purposes. The ID cards are being made available in a digital form for the use of the identified person. > Importantly, in its contract, Apple shifts responsibility for confirming the authenticity of user identities onto states. Yea, who else would have the ability to validate an individual should have access to a particular person’s digital ID? Just like Apple Pay and others require the bank to validate you have permission for a particular card.

mcphage 5y ago

Is the alternative Apple controlling all of these peoples’ identification information? That would be way, way worse, than states having to host their own citizen’s information.

tinus_hn 5y ago

Remind me when companies start printing physical ID cards for free.