9 ms·

The thing about a single online Identity is that there should be no way for it to be revoked against the will of the person it identifies. In real life I am who

The thing about a single online Identity is that there should be no way for it to be revoked against the will of the person it identifies. In real life I am who I am, and unless I choose to change that, no-one can legally take my identity from me. There's been too many horror stories of people being locked out of their Google or Facebook accounts by Google and Facebook, even for the most minor of infractions, and that person immediately also losing access to to all the other services they used 'Sign in with...' Until this problem is solved, I will never switch to a single online Identity for access, and I certainly will never use my Google or Facebook account to register with third party services.

causi 4y ago
Yes. It would be nice to have a government-issued e-mail address that couldn't be taken away from me by anything short of a court order.
- harlanji 4y ago
  What about starting with a public library? 120 year email + static hosting tied to library card. Start with one branch or small system, scale from there. Could reasonably be managed per branch with central support orgs. I guess most of them have a server room or colo or similar with a couple U free.
- toomuchtodo 4y ago
  [US centric] It feels like we're almost there between usps.gov and login.gov, someone at USDS just needs to make the equity and digital access case to get the funding to build out the app. The current administration has already expressed its position on federal service delivery improvements [1], and frankly, USDS/18F has a track record of crushing it. This would go hand in hand with the USPS slowly making its way to being a meatspace trust anchor/identity proofing|credentialing provider [2]; problem with your email account? Get help in person at your local USPS. [1] https://www.whitehouse.gov/briefing-room/presidential-actions/2021/12/13/executive-order-on-transforming-federal-customer-experience-and-service-delivery-to-rebuild-trust-in-government/ https://www.whitehouse.gov/briefing-room/presidential-action... [2] https://www.cfr.org/report/solving-identity-protection-post-office https://www.cfr.org/report/solving-identity-protection-post-...
- new_stranger 4y ago
  Perhaps a little better, but anything the government does is always subpar Whatever email server/system the government created would be so bad no one one would use it.
  - Jaruzel 4y ago
    Maybe it just needs to be a forwarding service to your current REAL email address?
- PaulHoule 4y ago
  Which government? US federal? State? County? City? Part of the fun of the internet is that it is really international so I'd expect it to interoperate with Canada, France, Ukraine, etc. What if people from Barcelona want a Catalan e-mail address?
  - reidjs 4y ago
    I think whoever issues passports might be able to take it on. So, basically the post office? I'm not entirely sure to be honest.
  - jimkleiber 4y ago
    Ideally I'd like a global government to do it, although I don't like the current structure of the UN. I think what I see in the web3 space is possibly a yearning for a global registry, whether for identity of humans or businesses (DAOs), or even a global currency. So for me, I'd like a global entity that more closely resembles the global nature of the internet, combined with a more globally representative structure.
- mindslight 4y ago
  I see where you're coming from, but it would also be an extreme liability. For example, imagine companies demanding that you sign in with only your uniquely-identifiable government email address so they can better track you. The necessary technical qualities to resist such attacks (eg allowing any user to generate a bunch of additional nyms) will never be considered in make-everything-legible government thinking. Social security numbers and drivers license numbers are already abused by surveillance companies, and so the last thing we need is another government-issued identifier without something like a US GDPR to prevent its abuse. Also, the kind of long term stable online identity you're desiring can already be had by registering your own domain name.
  - causi 4y ago
    Registering your own domain name still puts you at the mercy of public opinion in the form of registrars. Sure, becoming persona-non-grata to registrars doesn't happen every day but it does happen and it certainly isn't becoming less common.
- vorpalhex 4y ago
  Social security numbers get wrongly revoked and you often end up having to sue the US government to get any redress. Why in the world do you want them to host your email?
- jeroenhd 4y ago
  I think government email services would be very risky, both in a legal sense and in a cybersecurity sense. You can have government authentication without too many issues, though. The EU has a digital login system that's federated (EIDAS) and your government should never have to retract your ID unless you die. Some implementations use physical smart cards to sign in, others use usernames/passwords+apps/2fa. The system is currently intended only for official government business, but under the hood most systems use something close to OAuth2 so it should be possible to modify the system to allow generic logins. The downside of such a system is that the using the same authentication for government grants and your social media makes it very easy to phish people. This increases the security requirements of the system significantly, which in turn make the system very annoying to use. The authentication mechanism also allows the government to track exactly what services you use and when. Personally, I'd much rather see OpenID return. The ability to pick an identity provider and log in would allow for multiple accounts and the ability to control your own data. Alternatively, wide-spread use of something like https://irma.app/ https://irma.app/ would be even better. This allows for decentralised identity that you can take with you, just like a regular ID. It also allows for exposing only scoped data (ie "is this person of drinking age" rather than "what's this person's birthdate").
izzydata 4y ago
It seems like their proposed solution is decentralized blockchain identities which in theory should be impossible to revoke. I don't know what that would look like in practice, but if every web service needs to support it then I doubt it will ever happen.
skoskie 4y ago
Very well said. I’ll add that it creates a single point of failure for being hacked as well. Plus it drives me crazy that 1Password doesn’t support it. Anyone know if Bitwarden does?
robmccoll 4y ago
This is why we need a federated protocol. Most people can just trust a major player. More technically inclined people can host their own.
- rstupek 4y ago
  How would that be different than what happens with email? Getting email through to major providers is a challenge.
  - robmccoll 4y ago
    It would be more like receiving mail from a service than sending mail to a service which isn't a problem. There isn't really a spam component. I show up to bigsaas.com. Big SaaS asks me to identify myself. I submit that I am rob@robmccoll.com optionally with a proof of that claim. If I have provided a proof (think attestation along the lines of "The holder of this certificate is rob@robmccoll.com requesting to use bigsaas.com at time T using signing key Kpub") it will be signed under a key chain whose root can be obtained from a specifically formatted DNS TXT record under robmccoll.com (similar to DNSSEC or DKIM - maybe it gets a custom record type). bigsaas.com can fetch said key and verify the signature. If I haven't provided a proof, bigsaas.com looks up a DNS record under robmccoll.com that points to which server provides this authentication service for the domain and does something like an OAUTH or SAML type of exchange but without the need for point-to-point pre-configuration. It beings this exchange with a signed request "This is bigsaas.com attempting to authenticate rob@robmccoll.com at time T" which is signed under the key in its own DNS records (or at least a chain that can be verified under that key). Either way, the service doesn't have to have some pre-seeded trust beyond trusting DNS (and this should probably insist on DNSSEC and TLS-only for whatever interactive authentication gets layered on top) Edit: I guess this is kind of OpenID, but to be honest, OpenID looks way more complex than necessary.

causi 4y ago

Yes. It would be nice to have a government-issued e-mail address that couldn't be taken away from me by anything short of a court order.

harlanji 4y ago
What about starting with a public library? 120 year email + static hosting tied to library card. Start with one branch or small system, scale from there. Could reasonably be managed per branch with central support orgs. I guess most of them have a server room or colo or similar with a couple U free.
toomuchtodo 4y ago
[US centric] It feels like we're almost there between usps.gov and login.gov, someone at USDS just needs to make the equity and digital access case to get the funding to build out the app. The current administration has already expressed its position on federal service delivery improvements [1], and frankly, USDS/18F has a track record of crushing it. This would go hand in hand with the USPS slowly making its way to being a meatspace trust anchor/identity proofing|credentialing provider [2]; problem with your email account? Get help in person at your local USPS. [1] https://www.whitehouse.gov/briefing-room/presidential-actions/2021/12/13/executive-order-on-transforming-federal-customer-experience-and-service-delivery-to-rebuild-trust-in-government/ https://www.whitehouse.gov/briefing-room/presidential-action... [2] https://www.cfr.org/report/solving-identity-protection-post-office https://www.cfr.org/report/solving-identity-protection-post-...
new_stranger 4y ago
Perhaps a little better, but anything the government does is always subpar Whatever email server/system the government created would be so bad no one one would use it.
- Jaruzel 4y ago
  Maybe it just needs to be a forwarding service to your current REAL email address?
PaulHoule 4y ago
Which government? US federal? State? County? City? Part of the fun of the internet is that it is really international so I'd expect it to interoperate with Canada, France, Ukraine, etc. What if people from Barcelona want a Catalan e-mail address?
- reidjs 4y ago
  I think whoever issues passports might be able to take it on. So, basically the post office? I'm not entirely sure to be honest.
- jimkleiber 4y ago
  Ideally I'd like a global government to do it, although I don't like the current structure of the UN. I think what I see in the web3 space is possibly a yearning for a global registry, whether for identity of humans or businesses (DAOs), or even a global currency. So for me, I'd like a global entity that more closely resembles the global nature of the internet, combined with a more globally representative structure.
mindslight 4y ago
I see where you're coming from, but it would also be an extreme liability. For example, imagine companies demanding that you sign in with only your uniquely-identifiable government email address so they can better track you. The necessary technical qualities to resist such attacks (eg allowing any user to generate a bunch of additional nyms) will never be considered in make-everything-legible government thinking. Social security numbers and drivers license numbers are already abused by surveillance companies, and so the last thing we need is another government-issued identifier without something like a US GDPR to prevent its abuse. Also, the kind of long term stable online identity you're desiring can already be had by registering your own domain name.
- causi 4y ago
  Registering your own domain name still puts you at the mercy of public opinion in the form of registrars. Sure, becoming persona-non-grata to registrars doesn't happen every day but it does happen and it certainly isn't becoming less common.
vorpalhex 4y ago
Social security numbers get wrongly revoked and you often end up having to sue the US government to get any redress. Why in the world do you want them to host your email?
jeroenhd 4y ago
I think government email services would be very risky, both in a legal sense and in a cybersecurity sense. You can have government authentication without too many issues, though. The EU has a digital login system that's federated (EIDAS) and your government should never have to retract your ID unless you die. Some implementations use physical smart cards to sign in, others use usernames/passwords+apps/2fa. The system is currently intended only for official government business, but under the hood most systems use something close to OAuth2 so it should be possible to modify the system to allow generic logins. The downside of such a system is that the using the same authentication for government grants and your social media makes it very easy to phish people. This increases the security requirements of the system significantly, which in turn make the system very annoying to use. The authentication mechanism also allows the government to track exactly what services you use and when. Personally, I'd much rather see OpenID return. The ability to pick an identity provider and log in would allow for multiple accounts and the ability to control your own data. Alternatively, wide-spread use of something like https://irma.app/ https://irma.app/ would be even better. This allows for decentralised identity that you can take with you, just like a regular ID. It also allows for exposing only scoped data (ie "is this person of drinking age" rather than "what's this person's birthdate").

izzydata 4y ago

It seems like their proposed solution is decentralized blockchain identities which in theory should be impossible to revoke. I don't know what that would look like in practice, but if every web service needs to support it then I doubt it will ever happen.

skoskie 4y ago

Very well said. I’ll add that it creates a single point of failure for being hacked as well. Plus it drives me crazy that 1Password doesn’t support it. Anyone know if Bitwarden does?

robmccoll 4y ago

This is why we need a federated protocol. Most people can just trust a major player. More technically inclined people can host their own.

rstupek 4y ago
How would that be different than what happens with email? Getting email through to major providers is a challenge.
- robmccoll 4y ago
  It would be more like receiving mail from a service than sending mail to a service which isn't a problem. There isn't really a spam component. I show up to bigsaas.com. Big SaaS asks me to identify myself. I submit that I am rob@robmccoll.com optionally with a proof of that claim. If I have provided a proof (think attestation along the lines of "The holder of this certificate is rob@robmccoll.com requesting to use bigsaas.com at time T using signing key Kpub") it will be signed under a key chain whose root can be obtained from a specifically formatted DNS TXT record under robmccoll.com (similar to DNSSEC or DKIM - maybe it gets a custom record type). bigsaas.com can fetch said key and verify the signature. If I haven't provided a proof, bigsaas.com looks up a DNS record under robmccoll.com that points to which server provides this authentication service for the domain and does something like an OAUTH or SAML type of exchange but without the need for point-to-point pre-configuration. It beings this exchange with a signed request "This is bigsaas.com attempting to authenticate rob@robmccoll.com at time T" which is signed under the key in its own DNS records (or at least a chain that can be verified under that key). Either way, the service doesn't have to have some pre-seeded trust beyond trusting DNS (and this should probably insist on DNSSEC and TLS-only for whatever interactive authentication gets layered on top) Edit: I guess this is kind of OpenID, but to be honest, OpenID looks way more complex than necessary.