12 ms·

Privatizing our digital identities

122 points by soopurman 4y ago

hanniabu 4y ago
Web3 offers digital identities owned by the user.
- deleted 4y ago
  [deleted]
- liquide 4y ago
  I would offer that Web3 assumes that there are digital identities owned by the user, typically by proving control of a private key. It doesn't really solve any of the traditional usability problems of maintaining a private key, which is why so many users end up just signing up for a website that will handle it for them. Specifically the issues that come to mind are key recovery and rotation.
  - HPsquared 4y ago
    At least there is the prospect of full control by the user.
    - realce 4y ago
      "Full control" by being forced to engage with a protocol they never designed in order to authenticate their own existence? That sounds more like full submission to me.
    - thr717272 4y ago
      Only as long as enough others are in on the idea. I.e MyAwesomeBlockchain can be totally awesome but since no one uses kt it is useless. This will be the fate of well over 90% of the block chains that exist today I think. In fact I guess more than 90% of them.
    - shagie 4y ago
      What amount of personal hardware resources does a person need in order to have "full control?" Is there a way to guarantee that a user maintains "full control" over their identity as opposed to having it be stored on a 3rd party site? What would a 3rd party site that is operating less than trustworthy (a not uncommon situation in the web3 world) way be able to do with an identity that they hold in trust for someone who doesn't possess the consistent access to the previously mentioned hardware resources? If your only computing device is your phone and someone steals it, do you lose your identity? In the event that your house burnt down and all of your computing resources have been destroyed, is there a way to attest to be able to recover your identity? In the event that your evil twin decides to burn down your house, what mechanisms exist to prevent them from claiming your identity?
  - hanniabu 4y ago
    Read up on account abstraction: https://blog.jarrodwatts.com/what-is-account-abstraction-and-how-does-eip-4337-work https://blog.jarrodwatts.com/what-is-account-abstraction-and... https://twitter.com/DefiIgnas/status/1633626349226319872 https://twitter.com/DefiIgnas/status/1633626349226319872 > 5/ Account abstraction is a huge breakthrough for crypto self-custody. > It enables: > • Create & restore a wallet with an email or a phone number > • 1-Click transactions > • App pre-approvals & limits > • 2FA protection > and much more.
- AstixAndBelix 4y ago
  Web3 offers digital identities owned by the type of strategy the blockchain uses. Do you use Bitcoin and tomorrow Venezuela buys up 51% of global hashing power? Your identity is now managed by Venezuela, have fun
  - dcow 4y ago
    Yeah I am bearish on the web3 identity space because it’s chain infected. They are attacking the right problems but IMO not deploying the right solution. Just allow self-signed identity not backed by a chain.
    - AstixAndBelix 4y ago
      Self signed identity is meaningless, especially online
      - dcow 4y ago
        How does putting your ID on a chain or even having an identity provider vouch for it change anything? By your logic being a human is meaningless because anybody can do it. Self-signed identity means you own a private key. Being a human means you own a body. You can call yourself whatever you want in meatspace. People deal with it. You can sign whatever statements you want in cyberspace. If you need to verify that someone has passed a driving test, then yes you need an authority to issue a certificate (or whatever better tech you choose) saying this private key met these requirements. There's no inherent problem with the identity being self-signed if you just need a user-id.
        AstixAndBelix 4y ago
        Identity cannot be self-signed. "Self signed identity" as you call it is just a pseudonym. Anyone who has access to your private key can post with your "identity" and there is no way for checking fraudolent usage. If you see two instances of an account signing something with the same private key you cannot say that those two actions belong to the same person. You can only say that those two actions were performed by some entity which knows the private key. It could be the righful owner, it could be a hacker, it could be a bot. On the other hand, a real ID check makes sure with a high degree of certainty that the person is actually the same one who performed other actions (was born, purchased a home, has money, etc.)
kornhole 4y ago
The article completely ignores domain name registration. I own a myname.com domain and email address with that domain that I use wherever I need real ID. I also maintain the home page with my latest contact methods. My contacts only need one thing to put in their address book, https://myname.com https://myname.com. I can move registrars easily if needed. I am also not dependent on platforms since people can always find me here if I leave a platform. Edit: It does not completely ignore this option but frames it a bit restrictively. I set mine for auto renewal and use my domain at an email provider. It is not necessary to run your own SMTP.
- DeathArrow 4y ago
  What if you fail to renew the domain or to pay for hosting? What if the registrar wants to shut you down? What if your hosting facility catches fire?
  - nobody9999 4y ago
    >What if you fail to renew the domain or to pay for hosting? What if the registrar wants to shut you down? What if your hosting facility catches fire What if you[1] fail to renew your driver's license, passport, professional certification, homeowner's/renter's insurance and/or refilling your prescription for a life-saving drug? If so, you screwed up. Not paying your bills or maintaining your person-hood and infrastructure is your fault. Unless (in the US at least) you are a member of a "protected group/class"[0], no one is required to do business with you. And even if you are a member of such a group, good luck proving that you're being discriminated against because of your membership in such a group/class even if that is the case. And even then, there is more than one registrar on the planet. If my "hosting facility" catches fire, I have much bigger problems (i.e., finding a new place to live and replacing all my belongings) than not getting email. And since there is more than one "hosting facility" (including your own premise), just move to another one. It's not clear to me what, exactly, you're railing against. Each and every potential issue you mention has a "meat space" parallel that, I imagine (please do correct me if I'm wrong) you are a responsible human who makes sure to do what's necessary to maintain your life/person-hood/place in society. If those digital things you mention are so unimportant to you that you don't/won't take responsibility to manage them, that's on you, not the rest of the world. [0] https://en.wikipedia.org/wiki/Protected_group https://en.wikipedia.org/wiki/Protected_group [1] That's a general "you" rather than DeathArrow specifically. But it applies just as much to DeathArrow as it does everyone else. Including me. Edit: Removed text artifact.
specialist 4y ago
Thought provoking. I like it. I've long supported the "right to be forgotten". But, until this essay, I had never considered the corollary "right to be remembered". This real world concern is timely, relevant. Nicely done.
- ciprian_craciun 4y ago
  [Post author here,] thanks for nailing it! I want anyone to be able to choose any of these two extremes ("right to be forgotten" and "right to be remembered") or anything in between. I want to be able to configure my Discord or Slack "profile" to have all my messages automatically deleted after say 2 months. But at the same time I also want my email address to be permanently available (even after I die) because it's registered in so many places, tied to so many important things, so that if Google decides to erase me I'll be in a lot of pain... And although I do use a *payed* GMail account, I do it mainly because I trust them more from a security point of view than I trust myself. However I don't trust them not even 1% not to screw me over if the accountants say it's more profitable to drop GMail... At the same time I don't trust the government not even 1% not to screw the security of such a system, or not try to misuse it for political gains. But, I also don't see any way out of this situation with the technology, society, economy, and judicial system we have right now...
  - brabel 4y ago
    What do you think about Decentralized Identity (DIDs - https://www.w3.org/TR/did-core/ https://www.w3.org/TR/did-core/)? With it, you can have several identities and easily generate new ones when needed (but you probably need to have a single, government-recognized identity for the real world). Europe seems to be working hard on establishing an identity for every citizen: https://commission.europa.eu/strategy-and-policy/priorities-2019-2024/europe-fit-digital-age/european-digital-identity_en https://commission.europa.eu/strategy-and-policy/priorities-... (most countries already have that, but this is about unifying the various countries' ID systems).
    - ciprian_craciun 4y ago
lancesells 4y ago
My argument to all of this, at least in the US, is you don't need the internet to do things or be a person. Yes, it's 1000x more convenient (and cheaper) but you don't need to be online to do things with the government. Maybe that changes in the near future but the internet is only as real as you make it.
- dcow 4y ago
  Exactly and in the US you don't need a drivers license (generally a government-issued ID) to be a person. It helps but it’s not mandatory. The digital equivalent is signatures so digital society needs to be coerced to allow any signature. That doesn't preclude having certificates issued to you when you pass a driving test or meet residency requirements, but those aren’t sources of truth. Your personhood is.
- AlotOfReading 4y ago
  You're going to struggle to get a job or rent a house without using the Internet. That job will almost certainly require you to use the Internet for things like email, while the utilities on that house will send you increasingly absurd volumes of mail about switching to paperless. Some of them may not even have alternative payment that allow you to avoid the Internet. Seems pretty real to me.
  - dcow 4y ago
    The internet is real so we need to make it as accessible as a utility.
- WallyFunk 4y ago
  > you don't need the internet to do things or be a person The new paradigm is that everything has shifted online. The Internet is the proverbial town square. If you don't participate, that's on you, but all manner of discourse happens online now, and most importantly; that discourse shapes public opinion, and can have real lasting change in the world.
dcow 4y ago
The other option is self-sovereign identity. We desperately need to break the assumption that email is your identity. It’s like saying your postal address is your identity and if it changes everything gets messy. It doesn't work: it’s not universal and some people don’t even have addresses. The problem is not that email is privatized (though I agree I’d love to see ssn@id.gov as a usable recovery address), it’s that we’re tied to it as the only way to identify people online. Hopefully webauthn will change this and as long as services accept any signature, we aren't tied to blessed identity providers. So in my book, legislation and political effort need to focus around the “right to self-sign”. Less abstractly, we cannot allow Google, Apple, and Facebook to become the de-facto blessed ID providers. It’s silly and there’s no meatspace equivalent because it would be absurd like the article points out. We need to require that services accept any email (side rant and any oauth provider url so you can run self-hosted oauth) and, as webauthn proliferates, any signature. Finally, we need a political solution here because this is not behavior that has or will come naturally. Platforms want to own identity for profit and lock in. Other companies using identity want to only trust certain platforms/oauth providers/vendors for “security” and product simplicity. Nobody is thinking about protecting users’ rights so we must take that upon ourselves.
- ghoshbishakh 4y ago
  I was also about to mention SSI. The Decentralized Identifiers (DIDs) [1], and Verifiable Credentials [2] are W3C Recommendations for solving this exact problem. There are implementations of these also - check Hyperledger Indy and the Identity Foundation projects [3]. I along with IBM Research folks wrote a paper on even more interesting ways of exchanging identity information between two entities called Private Certifier Intersection [4]. [1] https://www.w3.org/TR/did-core/ https://www.w3.org/TR/did-core/ [2] https://www.w3.org/TR/vc-data-model/ https://www.w3.org/TR/vc-data-model/ [3] https://identity.foundation/ https://identity.foundation/ [4] https://www.ndss-symposium.org/ndss-paper/private-certifier-intersection/ https://www.ndss-symposium.org/ndss-paper/private-certifier-...
- ineptech 4y ago
  Nobody really wants government-run auth, but we need it nonetheless. For extreme cases like having your identity stolen, the solution of last resort is "go to a place and talk to a human." No tech company will pay all those salaries to run a free service, so realistically that place is going to the be the DMV or similar.
verisimi 4y ago
If you think government is a purely coercive entity, dedicated to enslaving humanity, why would you want the id that it provides? The reason is to access the services it licences. Government and its ids, licenses, laws and monopoly on force, is not there to help. And yet, despite all the examples of how government is by far and away the cause of most problems we experience, on hn you will find endless discussion on how to best assist it. Eg here - 'what type of id is best?'. It's amazing. Programmers, technologists, etc seem to be hardwired to develop the enslavement structure of everyone, including themselves, for the sake of some perceived comforts, such as a nice holiday, better car. Its literally turkeys voting for Christmas, as we plan and develop the hardcore enslavement of the future. Just think - do woodland creatures need id? Does any individual need an id? No. It is only useful if you want to control access to this or that for others. Ie you want to force your control on others who are doing you no wrong.
- matheusmoreira 4y ago
  Completely agree. The real problem is these services demanding IDs to begin with. They should just accept some random identifier without complaining. That's how it used to be on the internet and it was great. The more the web strays from that, the more painful it becomes. I don't even have to register a nick on IRC but Discord pesters me for my phone number. Why?
  - micropresident 4y ago
    Spam is the reason. Phone numbers are a costly resource to spammers. Having them permanently banned from Discord after spamming is a way to keep spam down quite a lot. I've been working on this exact problem for years, and have solved it differently. If anyone is interested, here's the draft whitepaper on my solution: https://www.stampchat.io/whitepaper.pdf https://www.stampchat.io/whitepaper.pdf
    - Buildstarted 4y ago
      Not quite sure what's wrong but the FAQ on your site doesn't expand when you click the questions. Debugger says `__webpack_require__` is undefined. (no adblock or scriptblock)
fwlr 4y ago
Falsehoods programmers believe about digital identity: it exists. Attempts at creating digital identity will invariably be gored by one of the two horns of the bull: either it is recoverable like a password-protected account and therefore anyone who can pass the recovery check can steal that identity, or it is non-recoverable like a crypto wallet address and therefore it can be lost due to carelessness. Our philosophical concept of an identity is not stealable (you cannot actually become someone else, you can only pretend to be them in some way, and they don’t stop being themselves when you do) nor is it losable (you can’t stop being yourself). Note that “recoverable” and “non-recoverable” are mutually exhaustive. There really is no third way here. You might think you can asymptotically approximate a digital identity by making it exponentially hard for anyone except you to pass the recovery check; if you do, you’re also making it harder for you to pass the recovery check - you’re just offloading into the “non-recoverable” failure state (loss). Likewise, you might think you can asymptotically approximate a digital identity by making it extremely easy to keep the access code so it won’t get lost; if you do, you’re also making it easier for anyone else else to steal the access code - you’re just off-loading into the “recoverable” failure state (theft). It fundamentally cannot be done. Instead, everything must be built to work without a Single Source of Identity Truth.
- zokier 4y ago
  > either it is recoverable like a password-protected account and therefore anyone who can pass the recovery check can steal that identity, That is equally true for physical identity documents like passports and various id cards, and yet it isn't nullifying completely the utility of such documents.
  - pessimizer 4y ago
    What you quoted was not a conclusion, it was the statement of a problem. Two options for solving the problem were presented very soon afterwards, and there was a claim that both present contradictions which create difficulties. It was very clear. > yet it isn't nullifying completely the utility of such documents. I don't think that anyone is claiming the absolute uselessness of any means of identifying anyone for any purpose, so "complete nullification" shouldn't be the standard. The standard should at least be "more benefit than cost."
zokier 4y ago
I put lot of blame for the current situation on the shortsightedness of turn of the century internet activists (cryptoanarchists and hackers and whatnot) who were extremely vocally rejecting any sort of government involvement on the internet
- sparkie 4y ago
  You have a problem and you think "I know, I'll get government involved." Now you have problems.
  - pphysch 4y ago
    https://en.wiktionary.org/wiki/deepity https://en.wiktionary.org/wiki/deepity
mindslight 4y ago
It would be trivial for governments to create email addresses for their citizens, and it would be a good idea for general digital enfranchisement. The problem is that there needs to be laws preventing private companies from requiring this identity, otherwise it would devolve into yet another unique identifier for the surveillance industry to abuse. And in the US context, we don't even have basic privacy laws. So until the abuse of basic identifiers like social security and driver's license numbers gets reigned in, having the government create digital structure just feeds into the surveillance industry.
skybrian 4y ago
If you use the same ID with multiple websites then it can easily be used to connect them, for better or worse. Meanwhile, even if you somehow had secure, irrevocable ownership of some kind of identifying name or number, websites could still cancel your account with them for any reason and keep you from logging in with that ID. They can use the ID to more easily share reputation information, similar to credit scores. Your ID could be put on a list, similar to what happens with ad blockers and lists of spammers. By itself, ownership of a name or number doesn’t get you much. If you use Google to log in to a website, what it’s really providing is a minimal kind of reputation, sort of like how a captcha vouches that you’re probably not a bot. For an ID to be useful, there needs to be reputation attached, and that isn’t something you can do yourself; other people or entities need to vouch for you. It’s also not permanent. Good reputations can go bad if people decide they don’t like you anymore. Instead of centralizing using a single ID, there’s a lot to be said for having having multiple identities (alts) for when you don’t need reputation and you don’t want what you’re doing to affect unrelated activities.
- JohnFen 4y ago
  > If you use the same ID with multiple websites then it can easily be used to connect them, for better or worse. This. While I avoid creating accounts as much as I can, when I do, I do not use the same "identity" for each of them. The ability to have multiple independent identities is, in my opinion, essential. What I don't want about any kind of identity system is that I can only have one.
  - DerekBickerton 4y ago
    > What I don't want about any kind of identity system is that I can only have one The globalist types[0] are looking to implement such a system. From what I have gathered, they want a social credit score. Unvaccinated? Good luck getting a loan. Posted something 'wrong' on an online message-board? You can't travel. And the list goes on... [0] https://id2020.org/ https://id2020.org/
- gnramires 4y ago
  That's a good point. I think maybe in that case you should just not use their service (if they require you to give your identity for a web service?). I have used a few services like online banking that require me to upload documents that effectively serve as uniquely identifying me individually. This situation doesn't seem to change with a digital id of sorts. I definitely would avoid using a digital id unless absolutely necessary, such as when dealing with banks, or the government itself. In this sense I think digital id is fine (and at least in my country already exists in some ways without any of those issues). I think at the core digital id is just having a form of asking your government "Can you verify this is me to someone else?" (which is already something you do with id photos, passports, etc.). I wouldn't want to use it everywhere. I think consumer protection laws that restrict denying digital service to a customer (without something like a criminal or legal basis) or indiscriminately requiring digital ids could be useful in reaping the benefits without the downsides.
imnotlost 4y ago
They're already doing it in Estonia [1]. Is it impossible to do in the US? Why? Zero trust in government (at all levels)? [1] https://e-estonia.com/solutions/e-identity/id-card/ https://e-estonia.com/solutions/e-identity/id-card/
- ok_dad 4y ago
  The USA is approx. 250x larger than Estonia, so there's that. Also, there are vested interests that would fight a USA federal ID, due to politics and etc.
  - ryandrake 4y ago
    The population of Maine is about the size of Estonia. Why can't an individual state try to implement it? Surely that small scale is not a show-stopper.
    - krapp 4y ago
      OK... so at best you wind up with 50 independent state ID systems (although probably fewer, some states will absolutely refuse), none of which have any value outside their respective states (although more likely some do and some don't,) and no political will to integrate them into a single Federal system, out of unreasonable fears the US government will hunt down gun owners and put Christians into re-education camps, and more reasonable fears they might do those things to anyone else. Then what?
CrisMystik 4y ago
In my country, Italy, all online public services already must accept government-issued digital IDs only, by law. They come in two forms: SPID (which is just username and password + TOTP, issued by private companies on behalf of the State, but allowing you to change your provider without becoming "a completely different person" [1]), and CIE (which is the new national ID card, and can be used as an electronic ID using any NFC reader). Additionally, some services allow to log in using equivalent eIDs from other EU countries [2]. [1] https://www.spid.gov.it/en/frequently-asked-questions/ https://www.spid.gov.it/en/frequently-asked-questions/ [2] https://eid.gov.it/?lang=en-001 https://eid.gov.it/?lang=en-001
Zamicol 4y ago
Our contribution to solving the digital identity problem is Coze, an open source and cryptographic messaging specification. [https://github.com/Cyphrme/Coze https://github.com/Cyphrme/Coze] We use Coze to sign messages that authorize user actions, such as uploading images, logging in, and leaving comments.
iisan7 4y ago
An authoritative digital address increases the power of the private sector. At present, I think it will always be easy to find a new ID-card provider if your current one locked you out for your cat-video-hating ways. Having a permanent authoritative ID could actually make it harder to get services because it would be easier for the private sector to share information about you. Imagine you got that address assigned, 42@id.tld. Now, every private company you want to do business with wants you to register using that ID. Now, when you get banned, they can share that ban throughout their network. Because every company requires you to register using your national email address for password recovery, you've created a system that radically expands the power of the private sector to profile you and control your reputation, if not your identity. Maybe very careful regulation could prohibit companies from asking you for your government email address, but I recall the (apocryphal?) quote by LBJ, "You do not examine legislation in the light of the benefits it will convey if properly administered, but in the light of the wrongs it would do and the harms it would cause if improperly administered." I prefer your proposed solution of some regulation that treats email like phone or utilities so there are a few protections before services are terminated.
Hyolobrika 4y ago
How about you fuck off, wannabe(?) technocrat?
nathias 4y ago
I think from a user perspective the optimal way would be for the browser to automatically do all the logins and user just sets up identities he needs.
rektide 4y ago
Personally I think it would be pretty badass to have a system where you could get your stuff signed by government. Rather than a digital identifier you have, what I kind of want is a website where I can go & get a trust-token stamped on something I put out, at whatever level of identity I choose: "This post is authentically produced by Ged Sparrowhawk, born in Gont, living at Roke Island, a student" or "This post is authentically produced by a student" or "This post is authentically produced by someone living in Gont" or "This post is authentically produced by someone born in Roke" or "This post is authentically produced by Ged Sparrowhawk" Giving the user the ability to have an authenticating government stamp their items with whatever level of identifiers they want seems like a far preferrable solution to me than creating a strong identity system. Users can pick whatever fits their desire: residing on the planet Earthsea, the island Roke, the town Thwil, or the place the School of Wizards, or the room whatever there-at. Nation/state/county/town/area/street/address, whatever. Government can let us say what we want about ourselves. This is a far more interesting & flexible proposition to me than creating an identity system.

122 points by soopurman 4y ago

hanniabu 4y ago

Web3 offers digital identities owned by the user.

deleted 4y ago
[deleted]
liquide 4y ago
I would offer that Web3 assumes that there are digital identities owned by the user, typically by proving control of a private key. It doesn't really solve any of the traditional usability problems of maintaining a private key, which is why so many users end up just signing up for a website that will handle it for them. Specifically the issues that come to mind are key recovery and rotation.
- HPsquared 4y ago
  At least there is the prospect of full control by the user.
  - realce 4y ago
    "Full control" by being forced to engage with a protocol they never designed in order to authenticate their own existence? That sounds more like full submission to me.
  - thr717272 4y ago
    Only as long as enough others are in on the idea. I.e MyAwesomeBlockchain can be totally awesome but since no one uses kt it is useless. This will be the fate of well over 90% of the block chains that exist today I think. In fact I guess more than 90% of them.
  - shagie 4y ago
    What amount of personal hardware resources does a person need in order to have "full control?" Is there a way to guarantee that a user maintains "full control" over their identity as opposed to having it be stored on a 3rd party site? What would a 3rd party site that is operating less than trustworthy (a not uncommon situation in the web3 world) way be able to do with an identity that they hold in trust for someone who doesn't possess the consistent access to the previously mentioned hardware resources? If your only computing device is your phone and someone steals it, do you lose your identity? In the event that your house burnt down and all of your computing resources have been destroyed, is there a way to attest to be able to recover your identity? In the event that your evil twin decides to burn down your house, what mechanisms exist to prevent them from claiming your identity?
- hanniabu 4y ago
  Read up on account abstraction: https://blog.jarrodwatts.com/what-is-account-abstraction-and-how-does-eip-4337-work https://blog.jarrodwatts.com/what-is-account-abstraction-and... https://twitter.com/DefiIgnas/status/1633626349226319872 https://twitter.com/DefiIgnas/status/1633626349226319872 > 5/ Account abstraction is a huge breakthrough for crypto self-custody. > It enables: > • Create & restore a wallet with an email or a phone number > • 1-Click transactions > • App pre-approvals & limits > • 2FA protection > and much more.
AstixAndBelix 4y ago
Web3 offers digital identities owned by the type of strategy the blockchain uses. Do you use Bitcoin and tomorrow Venezuela buys up 51% of global hashing power? Your identity is now managed by Venezuela, have fun
- dcow 4y ago
  Yeah I am bearish on the web3 identity space because it’s chain infected. They are attacking the right problems but IMO not deploying the right solution. Just allow self-signed identity not backed by a chain.
  - AstixAndBelix 4y ago
    Self signed identity is meaningless, especially online
    - dcow 4y ago
      How does putting your ID on a chain or even having an identity provider vouch for it change anything? By your logic being a human is meaningless because anybody can do it. Self-signed identity means you own a private key. Being a human means you own a body. You can call yourself whatever you want in meatspace. People deal with it. You can sign whatever statements you want in cyberspace. If you need to verify that someone has passed a driving test, then yes you need an authority to issue a certificate (or whatever better tech you choose) saying this private key met these requirements. There's no inherent problem with the identity being self-signed if you just need a user-id.
      - AstixAndBelix 4y ago
        Identity cannot be self-signed. "Self signed identity" as you call it is just a pseudonym. Anyone who has access to your private key can post with your "identity" and there is no way for checking fraudolent usage. If you see two instances of an account signing something with the same private key you cannot say that those two actions belong to the same person. You can only say that those two actions were performed by some entity which knows the private key. It could be the righful owner, it could be a hacker, it could be a bot. On the other hand, a real ID check makes sure with a high degree of certainty that the person is actually the same one who performed other actions (was born, purchased a home, has money, etc.)

kornhole 4y ago

The article completely ignores domain name registration. I own a myname.com domain and email address with that domain that I use wherever I need real ID. I also maintain the home page with my latest contact methods. My contacts only need one thing to put in their address book, https://myname.com https://myname.com. I can move registrars easily if needed. I am also not dependent on platforms since people can always find me here if I leave a platform. Edit: It does not completely ignore this option but frames it a bit restrictively. I set mine for auto renewal and use my domain at an email provider. It is not necessary to run your own SMTP.

DeathArrow 4y ago
What if you fail to renew the domain or to pay for hosting? What if the registrar wants to shut you down? What if your hosting facility catches fire?
- nobody9999 4y ago
  >What if you fail to renew the domain or to pay for hosting? What if the registrar wants to shut you down? What if your hosting facility catches fire What if you[1] fail to renew your driver's license, passport, professional certification, homeowner's/renter's insurance and/or refilling your prescription for a life-saving drug? If so, you screwed up. Not paying your bills or maintaining your person-hood and infrastructure is your fault. Unless (in the US at least) you are a member of a "protected group/class"[0], no one is required to do business with you. And even if you are a member of such a group, good luck proving that you're being discriminated against because of your membership in such a group/class even if that is the case. And even then, there is more than one registrar on the planet. If my "hosting facility" catches fire, I have much bigger problems (i.e., finding a new place to live and replacing all my belongings) than not getting email. And since there is more than one "hosting facility" (including your own premise), just move to another one. It's not clear to me what, exactly, you're railing against. Each and every potential issue you mention has a "meat space" parallel that, I imagine (please do correct me if I'm wrong) you are a responsible human who makes sure to do what's necessary to maintain your life/person-hood/place in society. If those digital things you mention are so unimportant to you that you don't/won't take responsibility to manage them, that's on you, not the rest of the world. [0] https://en.wikipedia.org/wiki/Protected_group https://en.wikipedia.org/wiki/Protected_group [1] That's a general "you" rather than DeathArrow specifically. But it applies just as much to DeathArrow as it does everyone else. Including me. Edit: Removed text artifact.

specialist 4y ago

Thought provoking. I like it. I've long supported the "right to be forgotten". But, until this essay, I had never considered the corollary "right to be remembered". This real world concern is timely, relevant. Nicely done.

ciprian_craciun 4y ago
[Post author here,] thanks for nailing it! I want anyone to be able to choose any of these two extremes ("right to be forgotten" and "right to be remembered") or anything in between. I want to be able to configure my Discord or Slack "profile" to have all my messages automatically deleted after say 2 months. But at the same time I also want my email address to be permanently available (even after I die) because it's registered in so many places, tied to so many important things, so that if Google decides to erase me I'll be in a lot of pain... And although I do use a *payed* GMail account, I do it mainly because I trust them more from a security point of view than I trust myself. However I don't trust them not even 1% not to screw me over if the accountants say it's more profitable to drop GMail... At the same time I don't trust the government not even 1% not to screw the security of such a system, or not try to misuse it for political gains. But, I also don't see any way out of this situation with the technology, society, economy, and judicial system we have right now...
- brabel 4y ago
  What do you think about Decentralized Identity (DIDs - https://www.w3.org/TR/did-core/ https://www.w3.org/TR/did-core/)? With it, you can have several identities and easily generate new ones when needed (but you probably need to have a single, government-recognized identity for the real world). Europe seems to be working hard on establishing an identity for every citizen: https://commission.europa.eu/strategy-and-policy/priorities-2019-2024/europe-fit-digital-age/european-digital-identity_en https://commission.europa.eu/strategy-and-policy/priorities-... (most countries already have that, but this is about unifying the various countries' ID systems).
  - ciprian_craciun 4y ago

lancesells 4y ago

My argument to all of this, at least in the US, is you don't need the internet to do things or be a person. Yes, it's 1000x more convenient (and cheaper) but you don't need to be online to do things with the government. Maybe that changes in the near future but the internet is only as real as you make it.

dcow 4y ago
Exactly and in the US you don't need a drivers license (generally a government-issued ID) to be a person. It helps but it’s not mandatory. The digital equivalent is signatures so digital society needs to be coerced to allow any signature. That doesn't preclude having certificates issued to you when you pass a driving test or meet residency requirements, but those aren’t sources of truth. Your personhood is.
AlotOfReading 4y ago
You're going to struggle to get a job or rent a house without using the Internet. That job will almost certainly require you to use the Internet for things like email, while the utilities on that house will send you increasingly absurd volumes of mail about switching to paperless. Some of them may not even have alternative payment that allow you to avoid the Internet. Seems pretty real to me.
- dcow 4y ago
  The internet is real so we need to make it as accessible as a utility.
WallyFunk 4y ago
> you don't need the internet to do things or be a person The new paradigm is that everything has shifted online. The Internet is the proverbial town square. If you don't participate, that's on you, but all manner of discourse happens online now, and most importantly; that discourse shapes public opinion, and can have real lasting change in the world.

dcow 4y ago

The other option is self-sovereign identity. We desperately need to break the assumption that email is your identity. It’s like saying your postal address is your identity and if it changes everything gets messy. It doesn't work: it’s not universal and some people don’t even have addresses. The problem is not that email is privatized (though I agree I’d love to see ssn@id.gov as a usable recovery address), it’s that we’re tied to it as the only way to identify people online. Hopefully webauthn will change this and as long as services accept any signature, we aren't tied to blessed identity providers. So in my book, legislation and political effort need to focus around the “right to self-sign”. Less abstractly, we cannot allow Google, Apple, and Facebook to become the de-facto blessed ID providers. It’s silly and there’s no meatspace equivalent because it would be absurd like the article points out. We need to require that services accept any email (side rant and any oauth provider url so you can run self-hosted oauth) and, as webauthn proliferates, any signature. Finally, we need a political solution here because this is not behavior that has or will come naturally. Platforms want to own identity for profit and lock in. Other companies using identity want to only trust certain platforms/oauth providers/vendors for “security” and product simplicity. Nobody is thinking about protecting users’ rights so we must take that upon ourselves.

ghoshbishakh 4y ago
I was also about to mention SSI. The Decentralized Identifiers (DIDs) [1], and Verifiable Credentials [2] are W3C Recommendations for solving this exact problem. There are implementations of these also - check Hyperledger Indy and the Identity Foundation projects [3]. I along with IBM Research folks wrote a paper on even more interesting ways of exchanging identity information between two entities called Private Certifier Intersection [4]. [1] https://www.w3.org/TR/did-core/ https://www.w3.org/TR/did-core/ [2] https://www.w3.org/TR/vc-data-model/ https://www.w3.org/TR/vc-data-model/ [3] https://identity.foundation/ https://identity.foundation/ [4] https://www.ndss-symposium.org/ndss-paper/private-certifier-intersection/ https://www.ndss-symposium.org/ndss-paper/private-certifier-...
ineptech 4y ago
Nobody really wants government-run auth, but we need it nonetheless. For extreme cases like having your identity stolen, the solution of last resort is "go to a place and talk to a human." No tech company will pay all those salaries to run a free service, so realistically that place is going to the be the DMV or similar.

verisimi 4y ago

If you think government is a purely coercive entity, dedicated to enslaving humanity, why would you want the id that it provides? The reason is to access the services it licences. Government and its ids, licenses, laws and monopoly on force, is not there to help. And yet, despite all the examples of how government is by far and away the cause of most problems we experience, on hn you will find endless discussion on how to best assist it. Eg here - 'what type of id is best?'. It's amazing. Programmers, technologists, etc seem to be hardwired to develop the enslavement structure of everyone, including themselves, for the sake of some perceived comforts, such as a nice holiday, better car. Its literally turkeys voting for Christmas, as we plan and develop the hardcore enslavement of the future. Just think - do woodland creatures need id? Does any individual need an id? No. It is only useful if you want to control access to this or that for others. Ie you want to force your control on others who are doing you no wrong.

matheusmoreira 4y ago
Completely agree. The real problem is these services demanding IDs to begin with. They should just accept some random identifier without complaining. That's how it used to be on the internet and it was great. The more the web strays from that, the more painful it becomes. I don't even have to register a nick on IRC but Discord pesters me for my phone number. Why?
- micropresident 4y ago
  Spam is the reason. Phone numbers are a costly resource to spammers. Having them permanently banned from Discord after spamming is a way to keep spam down quite a lot. I've been working on this exact problem for years, and have solved it differently. If anyone is interested, here's the draft whitepaper on my solution: https://www.stampchat.io/whitepaper.pdf https://www.stampchat.io/whitepaper.pdf
  - Buildstarted 4y ago
    Not quite sure what's wrong but the FAQ on your site doesn't expand when you click the questions. Debugger says `__webpack_require__` is undefined. (no adblock or scriptblock)

fwlr 4y ago

Falsehoods programmers believe about digital identity: it exists. Attempts at creating digital identity will invariably be gored by one of the two horns of the bull: either it is recoverable like a password-protected account and therefore anyone who can pass the recovery check can steal that identity, or it is non-recoverable like a crypto wallet address and therefore it can be lost due to carelessness. Our philosophical concept of an identity is not stealable (you cannot actually become someone else, you can only pretend to be them in some way, and they don’t stop being themselves when you do) nor is it losable (you can’t stop being yourself). Note that “recoverable” and “non-recoverable” are mutually exhaustive. There really is no third way here. You might think you can asymptotically approximate a digital identity by making it exponentially hard for anyone except you to pass the recovery check; if you do, you’re also making it harder for you to pass the recovery check - you’re just offloading into the “non-recoverable” failure state (loss). Likewise, you might think you can asymptotically approximate a digital identity by making it extremely easy to keep the access code so it won’t get lost; if you do, you’re also making it easier for anyone else else to steal the access code - you’re just off-loading into the “recoverable” failure state (theft). It fundamentally cannot be done. Instead, everything must be built to work without a Single Source of Identity Truth.

zokier 4y ago
> either it is recoverable like a password-protected account and therefore anyone who can pass the recovery check can steal that identity, That is equally true for physical identity documents like passports and various id cards, and yet it isn't nullifying completely the utility of such documents.
- pessimizer 4y ago
  What you quoted was not a conclusion, it was the statement of a problem. Two options for solving the problem were presented very soon afterwards, and there was a claim that both present contradictions which create difficulties. It was very clear. > yet it isn't nullifying completely the utility of such documents. I don't think that anyone is claiming the absolute uselessness of any means of identifying anyone for any purpose, so "complete nullification" shouldn't be the standard. The standard should at least be "more benefit than cost."

zokier 4y ago

I put lot of blame for the current situation on the shortsightedness of turn of the century internet activists (cryptoanarchists and hackers and whatnot) who were extremely vocally rejecting any sort of government involvement on the internet

sparkie 4y ago
You have a problem and you think "I know, I'll get government involved." Now you have problems.
- pphysch 4y ago
  https://en.wiktionary.org/wiki/deepity https://en.wiktionary.org/wiki/deepity

mindslight 4y ago

It would be trivial for governments to create email addresses for their citizens, and it would be a good idea for general digital enfranchisement. The problem is that there needs to be laws preventing private companies from requiring this identity, otherwise it would devolve into yet another unique identifier for the surveillance industry to abuse. And in the US context, we don't even have basic privacy laws. So until the abuse of basic identifiers like social security and driver's license numbers gets reigned in, having the government create digital structure just feeds into the surveillance industry.

skybrian 4y ago

If you use the same ID with multiple websites then it can easily be used to connect them, for better or worse. Meanwhile, even if you somehow had secure, irrevocable ownership of some kind of identifying name or number, websites could still cancel your account with them for any reason and keep you from logging in with that ID. They can use the ID to more easily share reputation information, similar to credit scores. Your ID could be put on a list, similar to what happens with ad blockers and lists of spammers. By itself, ownership of a name or number doesn’t get you much. If you use Google to log in to a website, what it’s really providing is a minimal kind of reputation, sort of like how a captcha vouches that you’re probably not a bot. For an ID to be useful, there needs to be reputation attached, and that isn’t something you can do yourself; other people or entities need to vouch for you. It’s also not permanent. Good reputations can go bad if people decide they don’t like you anymore. Instead of centralizing using a single ID, there’s a lot to be said for having having multiple identities (alts) for when you don’t need reputation and you don’t want what you’re doing to affect unrelated activities.

JohnFen 4y ago
> If you use the same ID with multiple websites then it can easily be used to connect them, for better or worse. This. While I avoid creating accounts as much as I can, when I do, I do not use the same "identity" for each of them. The ability to have multiple independent identities is, in my opinion, essential. What I don't want about any kind of identity system is that I can only have one.
- DerekBickerton 4y ago
  > What I don't want about any kind of identity system is that I can only have one The globalist types[0] are looking to implement such a system. From what I have gathered, they want a social credit score. Unvaccinated? Good luck getting a loan. Posted something 'wrong' on an online message-board? You can't travel. And the list goes on... [0] https://id2020.org/ https://id2020.org/
gnramires 4y ago
That's a good point. I think maybe in that case you should just not use their service (if they require you to give your identity for a web service?). I have used a few services like online banking that require me to upload documents that effectively serve as uniquely identifying me individually. This situation doesn't seem to change with a digital id of sorts. I definitely would avoid using a digital id unless absolutely necessary, such as when dealing with banks, or the government itself. In this sense I think digital id is fine (and at least in my country already exists in some ways without any of those issues). I think at the core digital id is just having a form of asking your government "Can you verify this is me to someone else?" (which is already something you do with id photos, passports, etc.). I wouldn't want to use it everywhere. I think consumer protection laws that restrict denying digital service to a customer (without something like a criminal or legal basis) or indiscriminately requiring digital ids could be useful in reaping the benefits without the downsides.

imnotlost 4y ago

They're already doing it in Estonia [1]. Is it impossible to do in the US? Why? Zero trust in government (at all levels)? [1] https://e-estonia.com/solutions/e-identity/id-card/ https://e-estonia.com/solutions/e-identity/id-card/

ok_dad 4y ago
The USA is approx. 250x larger than Estonia, so there's that. Also, there are vested interests that would fight a USA federal ID, due to politics and etc.
- ryandrake 4y ago
  The population of Maine is about the size of Estonia. Why can't an individual state try to implement it? Surely that small scale is not a show-stopper.
  - krapp 4y ago
    OK... so at best you wind up with 50 independent state ID systems (although probably fewer, some states will absolutely refuse), none of which have any value outside their respective states (although more likely some do and some don't,) and no political will to integrate them into a single Federal system, out of unreasonable fears the US government will hunt down gun owners and put Christians into re-education camps, and more reasonable fears they might do those things to anyone else. Then what?

CrisMystik 4y ago

In my country, Italy, all online public services already must accept government-issued digital IDs only, by law. They come in two forms: SPID (which is just username and password + TOTP, issued by private companies on behalf of the State, but allowing you to change your provider without becoming "a completely different person" [1]), and CIE (which is the new national ID card, and can be used as an electronic ID using any NFC reader). Additionally, some services allow to log in using equivalent eIDs from other EU countries [2]. [1] https://www.spid.gov.it/en/frequently-asked-questions/ https://www.spid.gov.it/en/frequently-asked-questions/ [2] https://eid.gov.it/?lang=en-001 https://eid.gov.it/?lang=en-001

Zamicol 4y ago

Our contribution to solving the digital identity problem is Coze, an open source and cryptographic messaging specification. [https://github.com/Cyphrme/Coze https://github.com/Cyphrme/Coze] We use Coze to sign messages that authorize user actions, such as uploading images, logging in, and leaving comments.

iisan7 4y ago

An authoritative digital address increases the power of the private sector. At present, I think it will always be easy to find a new ID-card provider if your current one locked you out for your cat-video-hating ways. Having a permanent authoritative ID could actually make it harder to get services because it would be easier for the private sector to share information about you. Imagine you got that address assigned, 42@id.tld. Now, every private company you want to do business with wants you to register using that ID. Now, when you get banned, they can share that ban throughout their network. Because every company requires you to register using your national email address for password recovery, you've created a system that radically expands the power of the private sector to profile you and control your reputation, if not your identity. Maybe very careful regulation could prohibit companies from asking you for your government email address, but I recall the (apocryphal?) quote by LBJ, "You do not examine legislation in the light of the benefits it will convey if properly administered, but in the light of the wrongs it would do and the harms it would cause if improperly administered." I prefer your proposed solution of some regulation that treats email like phone or utilities so there are a few protections before services are terminated.

Hyolobrika 4y ago

How about you fuck off, wannabe(?) technocrat?

nathias 4y ago

I think from a user perspective the optimal way would be for the browser to automatically do all the logins and user just sets up identities he needs.

rektide 4y ago

Personally I think it would be pretty badass to have a system where you could get your stuff signed by government. Rather than a digital identifier you have, what I kind of want is a website where I can go & get a trust-token stamped on something I put out, at whatever level of identity I choose: "This post is authentically produced by Ged Sparrowhawk, born in Gont, living at Roke Island, a student" or "This post is authentically produced by a student" or "This post is authentically produced by someone living in Gont" or "This post is authentically produced by someone born in Roke" or "This post is authentically produced by Ged Sparrowhawk" Giving the user the ability to have an authenticating government stamp their items with whatever level of identifiers they want seems like a far preferrable solution to me than creating a strong identity system. Users can pick whatever fits their desire: residing on the planet Earthsea, the island Roke, the town Thwil, or the place the School of Wizards, or the room whatever there-at. Nation/state/county/town/area/street/address, whatever. Government can let us say what we want about ourselves. This is a far more interesting & flexible proposition to me than creating an identity system.