4 ms·

No, it's not. Estonia solved it by issuing ID cards with a private key that signs for a public key identifier. [1] Then proving your identity requires the prese

No, it's not. Estonia solved it by issuing ID cards with a private key that signs for a public key identifier. [1] Then proving your identity requires the presence of the physical token rather than just the identifier. Unfortunately most Western nations are so embroiled in bureaucracy that this obvious solution will not be available for a long time. [1] https://en.wikipedia.org/wiki/Estonian_identity_card https://en.wikipedia.org/wiki/Estonian_identity_card

8note 4y ago
What do you do when you lose it though? Or it burns in a fire? A surrogate token still needs a replacement mechanism
- bombcar 4y ago
  It's pretty easy to implement that if you have a central authority to manage the public keys, which a government can do. A bigger issue is how to handle it being stolen (if the "card" also needs something like a passphrase it can reduce this risk, but it's probably better to make it relatively easy to "cancel" if you lose yours, and then you have to head to the DMV or whatever to procure a replacement). Certainly better than knowing 10 digits and where you were born and to whom.
  - kube-system 4y ago
    "Better" depends on which specific problem that someone is experiencing. If your problem is that someone stole the token, then you're better off with a PKI token. If your problem is that you have lost your token, then you're better off with a non-PKI memorable token.
- f38zf5vdt 4y ago
  Go to a government office and use biometric identification methods, then remove the old public key from databases and replace it with a new public key from a newly issued ID card.
- charcircuit 4y ago
  SSN already suffers from the same exact problem and has ways to request a new SSN card. You are limited to 3 replacement cards in a year and 10 during your lifetime.
  - kube-system 4y ago
    That is mitigated by the fact that SSNs can often be used without the physical card.
kube-system 4y ago
Estonia was exactly what I had in mind when I wrote my comment. You can't just guess PKI keys, but they are less accessible. You need the physical card, you must have a process for issuing/reissuing, and the technology must be available to use it. There are trade-offs. They can be good trade offs, but they exist.
- charcircuit 4y ago
  >you must have a process for issuing/reissuing Can't you piggyback off of the processes for social security cards?
  - kube-system 4y ago
    You can. But, if I lose my SSN card I can still (usually) use my SSN because it exists in a functional form inside of my head. If it was a PKI card, I would physically need to have the card. I have family who tried to get a replacement SSN card during COVID and the process has been entirely impossible. This a drawback to using physical tokens. Also, this doesn't eliminate identity theft, the point of issuing is the weak-point for fraud.
    - zaphod12 4y ago
      Ok, but I got a replacement card several years ago and it was really not too hard. Took a few minutes at the SSA office with my passport (advice is to get their obscenely early to avoid waiting), and then waiting for the mail. Took a while to get in the mail, but wasn't hard, just slow.
      - kube-system 4y ago
        Normally, it shouldn't be. But, my family ran into issues such as: 1. The office was physically closed for business during COVID. 2. They needed to get documentation which was physically in another country. 3. They could not travel to that country due to travel restrictions.
    - 4y ago
jasonshaev 4y ago
You can't just transfer a process/technology that works in Estonia to a country like the U.S. which has 300x the population and decades of processes that are dependent on SSNs, many of which aren't controlled by the government. Want to open a bank account? Need an SSN. Healthcare: SSN Employment: SSN Want a STATE driver's license? Need some form of government ID, depending on the state. An SSN card is often an option. My point is, to adopt a system like you suggest would require reforming ALL of these systems across public (federal, state and local) and private sectors. It's not just bureaucracy. Doing this at scale across public/private domains is hard.
- lotsofpulp 4y ago
  I do not see what is wrong with starting somewhere, that somewhere being what Estonia has already proven works.
- iqkznnft 4y ago
  > Want to open a bank account? Need an SSN. Healthcare: SSN Employment: SSN You don't need a SSN to open a bank account. Health, I believe it depends on the provider, not sure.
EvanAnderson 4y ago
I never miss a plug for the idea that the United States Postal Service should get into the PKI game and issue hardware tokens. They have immense infrastructure they could leverage to be a very effective trust provider. They already serve in that capacity to some extent evidenced by the various government entities who accept an addressed piece of mail as proof of residency. I don't think there'd be enough bipartisan support to make it happen, but I think it'd work great.
- panda88888 4y ago
  Totally agree with you. I think they should get into simple banking too. Even just a no fee simple savings account with debit cards would do wonders for the unbanked.

8note 4y ago

What do you do when you lose it though? Or it burns in a fire? A surrogate token still needs a replacement mechanism

bombcar 4y ago
It's pretty easy to implement that if you have a central authority to manage the public keys, which a government can do. A bigger issue is how to handle it being stolen (if the "card" also needs something like a passphrase it can reduce this risk, but it's probably better to make it relatively easy to "cancel" if you lose yours, and then you have to head to the DMV or whatever to procure a replacement). Certainly better than knowing 10 digits and where you were born and to whom.
- kube-system 4y ago
  "Better" depends on which specific problem that someone is experiencing. If your problem is that someone stole the token, then you're better off with a PKI token. If your problem is that you have lost your token, then you're better off with a non-PKI memorable token.
f38zf5vdt 4y ago
Go to a government office and use biometric identification methods, then remove the old public key from databases and replace it with a new public key from a newly issued ID card.
charcircuit 4y ago
SSN already suffers from the same exact problem and has ways to request a new SSN card. You are limited to 3 replacement cards in a year and 10 during your lifetime.
- kube-system 4y ago
  That is mitigated by the fact that SSNs can often be used without the physical card.

kube-system 4y ago

Estonia was exactly what I had in mind when I wrote my comment. You can't just guess PKI keys, but they are less accessible. You need the physical card, you must have a process for issuing/reissuing, and the technology must be available to use it. There are trade-offs. They can be good trade offs, but they exist.

charcircuit 4y ago
>you must have a process for issuing/reissuing Can't you piggyback off of the processes for social security cards?
- kube-system 4y ago
  You can. But, if I lose my SSN card I can still (usually) use my SSN because it exists in a functional form inside of my head. If it was a PKI card, I would physically need to have the card. I have family who tried to get a replacement SSN card during COVID and the process has been entirely impossible. This a drawback to using physical tokens. Also, this doesn't eliminate identity theft, the point of issuing is the weak-point for fraud.
  - zaphod12 4y ago
    Ok, but I got a replacement card several years ago and it was really not too hard. Took a few minutes at the SSA office with my passport (advice is to get their obscenely early to avoid waiting), and then waiting for the mail. Took a while to get in the mail, but wasn't hard, just slow.
    - kube-system 4y ago
      Normally, it shouldn't be. But, my family ran into issues such as: 1. The office was physically closed for business during COVID. 2. They needed to get documentation which was physically in another country. 3. They could not travel to that country due to travel restrictions.
  - 4y ago

jasonshaev 4y ago

You can't just transfer a process/technology that works in Estonia to a country like the U.S. which has 300x the population and decades of processes that are dependent on SSNs, many of which aren't controlled by the government. Want to open a bank account? Need an SSN. Healthcare: SSN Employment: SSN Want a STATE driver's license? Need some form of government ID, depending on the state. An SSN card is often an option. My point is, to adopt a system like you suggest would require reforming ALL of these systems across public (federal, state and local) and private sectors. It's not just bureaucracy. Doing this at scale across public/private domains is hard.

lotsofpulp 4y ago
I do not see what is wrong with starting somewhere, that somewhere being what Estonia has already proven works.
iqkznnft 4y ago
> Want to open a bank account? Need an SSN. Healthcare: SSN Employment: SSN You don't need a SSN to open a bank account. Health, I believe it depends on the provider, not sure.

EvanAnderson 4y ago

I never miss a plug for the idea that the United States Postal Service should get into the PKI game and issue hardware tokens. They have immense infrastructure they could leverage to be a very effective trust provider. They already serve in that capacity to some extent evidenced by the various government entities who accept an addressed piece of mail as proof of residency. I don't think there'd be enough bipartisan support to make it happen, but I think it'd work great.

panda88888 4y ago
Totally agree with you. I think they should get into simple banking too. Even just a no fee simple savings account with debit cards would do wonders for the unbanked.