3 ms·

Hi Molly, great article. I was just thinking about the CAP theorem again a few days ago and the trilemma you describe here, interestingly, feels quite related.

Hi Molly, great article. I was just thinking about the CAP theorem again a few days ago and the trilemma you describe here, interestingly, feels quite related. As for what I personally consider to be the heart of the problem, I believe proof of personship (or whatever a soul is) is an unsolvable problem in the most rigorous sense. This is one reason why we have government. The issue isn't that government exists, it's that we cannot trust them, nor control them effectively. Still, a local government is much better positioned to prove my identity than some nebulous algorithm. Even the crazy Orb people knew this, and took to physically scanning retinas as you mention. We just need to build trust locally again somehow. Of course, people move and trust must be (re)bootstrapped. This is the root of the heart of the problem if you will; and a problem I cannot see concrete solutions to that don't approximate the existing systems. Here in MA, I have to both pay to get an ID, and provide various information to verify my address and initiate background checks, etc. This is all worth something, no? So why not have local governments provide this verification service...? Well, there's another complicating factor. The higher the value of a secret (i.e. identity proof), the less one should use it, or the more careful one should be with it. If I'm asked to give out my SSN to log into some new video game, I might stop and think twice. Whereas, providing my SSN to apply for a loan from a trustworthy financial institution is pretty commonplace. Finnaly, on data stewardship. Why not have companies like Apple and Google selling HomePods which act as local clouds which store, sync, and replicate encrypted data as requested by the user? Give me a static IPv6 and a decent authenticated tunnel into my LAN and I'm good to go! I choose what files go up to iCloud.com, I choose where 3rd party services point to for authentication credentials, and I decide when I want to delete and invalidate things! Anyway, thanks for the thought provocation. </rant>

titanomachy 4y ago
I agree that government proof-of-identity systems are actually pretty decent, and I think they could offer something really useful by making those services available as cryptographic proofs. In America, using a government-issued proof of identity over the internet amounts to sending someone my SSN, or a picture of my passport or drivers license. Obviously this sucks because they can now convincingly impersonate me on the internet. If they also provided some kind of public-key database, any internet service could verify my identity without learning how to impersonate me. If I lose my private key (or it gets leaked), I can go to the DMV or whatever and have them revoke my old one and issue a new one, just like if I lose my physical license today. EDIT: I know, Estonia/Iceland/whoever already do this. Not an original idea.

titanomachy 4y ago

I agree that government proof-of-identity systems are actually pretty decent, and I think they could offer something really useful by making those services available as cryptographic proofs. In America, using a government-issued proof of identity over the internet amounts to sending someone my SSN, or a picture of my passport or drivers license. Obviously this sucks because they can now convincingly impersonate me on the internet. If they also provided some kind of public-key database, any internet service could verify my identity without learning how to impersonate me. If I lose my private key (or it gets leaked), I can go to the DMV or whatever and have them revoke my old one and issue a new one, just like if I lose my physical license today. EDIT: I know, Estonia/Iceland/whoever already do this. Not an original idea.