4 ms·

The use cases for digital identity are almost all pernicious. Sure, you can use it for nice things like public services, except we do that today quite expansive

The use cases for digital identity are almost all pernicious. Sure, you can use it for nice things like public services, except we do that today quite expansively without one, and why do we need biometric level proofs for that? A government digital identity means that every informal transaction in the economy that uses it relies on the state as an inline broker. We can see this today with vax passports, where just this month you have to check-in with the government before you can enter a restaurant. (only temporary, surely) It's designed to manage people like livestock, and we all know that some pigs are more equal than others. Even vax passports and so-called "mandates," have exploited loopholes in our high trust societies and assumed formlessness as to avoid being challenged legally. Digital identity regimes will use the same indirect methods. This is their strategy. Why do you need to prove your identity unless you there is some intent to prosecute you? Most of the value in the economy is based on people taking on transaction risk on behalf of others, so replacing it with digital identity will destroy degrees of economic freedom and opportunity for your kids and grandkids. Identity does not create opportunity, it limits it. Civilization doesn't survive malicious institutions that turn inward against the people they serve, and I hope other technologists think seriously about identity and consider the consequences of it falling into the hands of an enemy or evil institution, because having worked in identity, I guarantee it will.

the_greyd 5y ago
You make a good point. In a state of pandemic, the population IS in some sense similar to livestock, bodies to be managed, since the virus has weaponized our bodies. Wouldn't you say?
- tasogare 5y ago
  The common method to deal with avian influenza is killing all the livestock when one case is detected. Your comparison is scary and uncanny, but well aligned with how violent the pandemic has been handled by various governments.
  - the_greyd 5y ago
    Overall I like yuval noah harrari's point about our systems, that liberal democracies and free market are based on the assumption that we have rational individuals making decisions in their self-interest. Which is not true at all, in today's day and age where misinformation and propaganda run rampant. You cannot rely on individual judgement to get us out of a pandemic. Same can be stated about climate change. I would say it's more alarming with climate change, since the consequences of our actions are stretched out in the far future (atleast when compared to covid). How the heck are we going to get people/companies/govt to get in line with what's needed for the survival of our species?
Jensson 5y ago
> Why do you need to prove your identity unless you there is some intent to prosecute you? Most of the value in the economy is based on people taking on transaction risk on behalf of others, so replacing it with digital identity will destroy degrees of economic freedom and opportunity for your kids and grandkids. Identity does not create opportunity, it limits it. I don't understand this argument at all. In what way does the economy require that people take on risks of identity theft when they trade with each other? I don't see a single instance of trade being limited even if all transactions were between established identities. There are other issues of tight tracking of course, but I don't see this one.
- dabbledash 5y ago
  Unless the entity that vouches for the identity or oversees transactions wanted to limit the ability of some disfavored participants, for some reason.
  - Jensson 5y ago
    If your bank wants to stop you from making a transaction they can do so today as well, not sure how this would change anything. The big difference is that now you could verify the other parties identity before the transaction instead of just your bank doing it. I can see an objection to erasure of cash, but not these identities.
- throwaway41597 5y ago
  With the rise of the internet I now consider my identity to be valuable. So I don't give it away for free. I personally don't want my identity checked unless I'm asking someone to trust me. And I'd rather use a trust-minimizing system before going there. You don't need your id checked when going to the restaurant or the theater. You need to check someone's id when they take your money and promise you something in return (and even then, there may be a better way). > I don't see a single instance of trade being limited even if all transactions were between established identities. Do you buy something if you need to send a copy of your id? Do you use a website if it requires Facebook connect? The issues of tight tracking you mention would be amplified by widespread use of id checks so I think it's essential not to do them often.
dwaite 5y ago
> why do we need biometric level proofs for that? There's generally two buckets of biometric auth: 1. Local biometric auth, with no metrics shared outside the local context, for convenience in authentication. This would be FaceID/TouchID/Windows Hello sorts of functions 2. Remote biometric auth to prevent certain types of 'friendly' impersonation, such as using a family member's identity for an age or background or credit check. This is say comparing a live camera capture against a previous photo. You see #2 a lot in identity proofing, e.g. I presented an official document and it is legitimate, but how do they know it's actually the right person vs someone who did some lucky dumpster diving? For digital identity credential systems which represent those documents, you have both cryptographic document verification and typically have a form of authentication by proof-of-possession of some key, but often people still feel the need for a remote biometric check. The reality is that they should be basing that on an actual need.
- motohagiography 5y ago
  My point is there is no actual need, and all needs are contrived by policy for policy's sake, usually caused by security nerds (my people) whose rationale is identity because identity, and then we index on geeking out on writing security protocols without product use cases for the people subject to it. The real problems in identity proofing are things like task delegation, substitute decision makers in elder care, parents doing things on behalf of their kids and kids asserting their parents permission, federation of user attributes with privacy, etc. These aren't difficult technical problems, except you need some way to transfer risk and accountability, which is an absolute quagmire. Universal digital identity (because let's face it, that's what it necessarily is) approaches these problems with a necessary component of a solution, but that's not what it's mainly going to be used for. Maybe this yields a thought experiment where let's say I write an app for parents and kids where kids can use it to show they have their parents permission to be in a park after dark, walk to school by themselves, participation in a class trip, travel by themselves on a train or plane, get consent for emergency medical procedures, etc. Then that kid grows up and it switches from their parents to being a drivers license, age of majority card, school graduation certificates, their last STD test, list of employers and past salaries, speeding tickets, criminal records, lowest rated tweets, sexual partners etc. Sounds like it could be a real product right? Except that kid never wanted the stupid app that monitors them, the hovering parents who imposed it on them just use them as a source of narcisistic supply, and then their entire life is one of being subject to some proxy for these helicopter parents. The app is capitivity, or more accurately, entry into a panopticon that deprives them of their basic humanity. This is why digital identity is a terrible idea in pretty much every version I've seen so far. It's not chosen, it's imposed, and that's not a product, that's a mandate laundered through tech.
raxxorrax 5y ago
The one application I would see is that government would be in control of biometric information. Today a lot of people share such markers with companies. But many also do not do that and they should also not be forced to do the same with government. That the EU enforced biometric passports without any benefit is bad enough.

the_greyd 5y ago

You make a good point. In a state of pandemic, the population IS in some sense similar to livestock, bodies to be managed, since the virus has weaponized our bodies. Wouldn't you say?

tasogare 5y ago
The common method to deal with avian influenza is killing all the livestock when one case is detected. Your comparison is scary and uncanny, but well aligned with how violent the pandemic has been handled by various governments.
- the_greyd 5y ago
  Overall I like yuval noah harrari's point about our systems, that liberal democracies and free market are based on the assumption that we have rational individuals making decisions in their self-interest. Which is not true at all, in today's day and age where misinformation and propaganda run rampant. You cannot rely on individual judgement to get us out of a pandemic. Same can be stated about climate change. I would say it's more alarming with climate change, since the consequences of our actions are stretched out in the far future (atleast when compared to covid). How the heck are we going to get people/companies/govt to get in line with what's needed for the survival of our species?

Jensson 5y ago

> Why do you need to prove your identity unless you there is some intent to prosecute you? Most of the value in the economy is based on people taking on transaction risk on behalf of others, so replacing it with digital identity will destroy degrees of economic freedom and opportunity for your kids and grandkids. Identity does not create opportunity, it limits it. I don't understand this argument at all. In what way does the economy require that people take on risks of identity theft when they trade with each other? I don't see a single instance of trade being limited even if all transactions were between established identities. There are other issues of tight tracking of course, but I don't see this one.

dabbledash 5y ago
Unless the entity that vouches for the identity or oversees transactions wanted to limit the ability of some disfavored participants, for some reason.
- Jensson 5y ago
  If your bank wants to stop you from making a transaction they can do so today as well, not sure how this would change anything. The big difference is that now you could verify the other parties identity before the transaction instead of just your bank doing it. I can see an objection to erasure of cash, but not these identities.
throwaway41597 5y ago
With the rise of the internet I now consider my identity to be valuable. So I don't give it away for free. I personally don't want my identity checked unless I'm asking someone to trust me. And I'd rather use a trust-minimizing system before going there. You don't need your id checked when going to the restaurant or the theater. You need to check someone's id when they take your money and promise you something in return (and even then, there may be a better way). > I don't see a single instance of trade being limited even if all transactions were between established identities. Do you buy something if you need to send a copy of your id? Do you use a website if it requires Facebook connect? The issues of tight tracking you mention would be amplified by widespread use of id checks so I think it's essential not to do them often.

dwaite 5y ago

> why do we need biometric level proofs for that? There's generally two buckets of biometric auth: 1. Local biometric auth, with no metrics shared outside the local context, for convenience in authentication. This would be FaceID/TouchID/Windows Hello sorts of functions 2. Remote biometric auth to prevent certain types of 'friendly' impersonation, such as using a family member's identity for an age or background or credit check. This is say comparing a live camera capture against a previous photo. You see #2 a lot in identity proofing, e.g. I presented an official document and it is legitimate, but how do they know it's actually the right person vs someone who did some lucky dumpster diving? For digital identity credential systems which represent those documents, you have both cryptographic document verification and typically have a form of authentication by proof-of-possession of some key, but often people still feel the need for a remote biometric check. The reality is that they should be basing that on an actual need.

motohagiography 5y ago
My point is there is no actual need, and all needs are contrived by policy for policy's sake, usually caused by security nerds (my people) whose rationale is identity because identity, and then we index on geeking out on writing security protocols without product use cases for the people subject to it. The real problems in identity proofing are things like task delegation, substitute decision makers in elder care, parents doing things on behalf of their kids and kids asserting their parents permission, federation of user attributes with privacy, etc. These aren't difficult technical problems, except you need some way to transfer risk and accountability, which is an absolute quagmire. Universal digital identity (because let's face it, that's what it necessarily is) approaches these problems with a necessary component of a solution, but that's not what it's mainly going to be used for. Maybe this yields a thought experiment where let's say I write an app for parents and kids where kids can use it to show they have their parents permission to be in a park after dark, walk to school by themselves, participation in a class trip, travel by themselves on a train or plane, get consent for emergency medical procedures, etc. Then that kid grows up and it switches from their parents to being a drivers license, age of majority card, school graduation certificates, their last STD test, list of employers and past salaries, speeding tickets, criminal records, lowest rated tweets, sexual partners etc. Sounds like it could be a real product right? Except that kid never wanted the stupid app that monitors them, the hovering parents who imposed it on them just use them as a source of narcisistic supply, and then their entire life is one of being subject to some proxy for these helicopter parents. The app is capitivity, or more accurately, entry into a panopticon that deprives them of their basic humanity. This is why digital identity is a terrible idea in pretty much every version I've seen so far. It's not chosen, it's imposed, and that's not a product, that's a mandate laundered through tech.

raxxorrax 5y ago

The one application I would see is that government would be in control of biometric information. Today a lot of people share such markers with companies. But many also do not do that and they should also not be forced to do the same with government. That the EU enforced biometric passports without any benefit is bad enough.