5 ms·

The other option is self-sovereign identity. We desperately need to break the assumption that email is your identity. It’s like saying your postal address is

by dcow 4y ago

The other option is self-sovereign identity. We desperately need to break the assumption that email is your identity. It’s like saying your postal address is your identity and if it changes everything gets messy. It doesn't work: it’s not universal and some people don’t even have addresses. The problem is not that email is privatized (though I agree I’d love to see ssn@id.gov as a usable recovery address), it’s that we’re tied to it as the only way to identify people online. Hopefully webauthn will change this and as long as services accept any signature, we aren't tied to blessed identity providers. So in my book, legislation and political effort need to focus around the “right to self-sign”. Less abstractly, we cannot allow Google, Apple, and Facebook to become the de-facto blessed ID providers. It’s silly and there’s no meatspace equivalent because it would be absurd like the article points out. We need to require that services accept any email (side rant and any oauth provider url so you can run self-hosted oauth) and, as webauthn proliferates, any signature. Finally, we need a political solution here because this is not behavior that has or will come naturally. Platforms want to own identity for profit and lock in. Other companies using identity want to only trust certain platforms/oauth providers/vendors for “security” and product simplicity. Nobody is thinking about protecting users’ rights so we must take that upon ourselves.

ghoshbishakh 4y ago
I was also about to mention SSI. The Decentralized Identifiers (DIDs) [1], and Verifiable Credentials [2] are W3C Recommendations for solving this exact problem. There are implementations of these also - check Hyperledger Indy and the Identity Foundation projects [3]. I along with IBM Research folks wrote a paper on even more interesting ways of exchanging identity information between two entities called Private Certifier Intersection [4]. [1] https://www.w3.org/TR/did-core/ https://www.w3.org/TR/did-core/ [2] https://www.w3.org/TR/vc-data-model/ https://www.w3.org/TR/vc-data-model/ [3] https://identity.foundation/ https://identity.foundation/ [4] https://www.ndss-symposium.org/ndss-paper/private-certifier-intersection/ https://www.ndss-symposium.org/ndss-paper/private-certifier-...
ineptech 4y ago
Nobody really wants government-run auth, but we need it nonetheless. For extreme cases like having your identity stolen, the solution of last resort is "go to a place and talk to a human." No tech company will pay all those salaries to run a free service, so realistically that place is going to the be the DMV or similar.
- vorpalhex 4y ago
  > No tech company will pay all those salaries to run a free service, so realistically that place is going to the be the DMV or similar. Or we legislate and make companies provide a minimum amount of service. You can't offload your operating expenses to the government.
  - shagie 4y ago
    The advantage of the government is that it is rather difficult for it to ignore you. If you exist, you pay taxes type "you won't be ignored." However, if you are fraudster and get to the point where Apple and Facebook and Google all cancel their accounts with you for non-payment or use of stolen credit cards of whatever other reason that a company would decline to do business with an individual... Well, now you don't exist since the big IDPs won't auth you. Or, are we suggesting that we legislate so that companies are required to do business with individuals who are making fraudulent use of their services? The only reasonable organization to do this is the one that has an inherent obligation to do it and for better or worse, that's the government.
    - vorpalhex 4y ago
      > The advantage of the government is that it is rather difficult for it to ignore you. If you exist, you pay taxes type "you won't be ignored." No, the Government has a long track record of successfully ignoring people who have hard to solve problems.[1] > ...we legislate so that companies are required to do business with individuals who are making fraudulent use of their services I suppose instead of just canceling your account and you losing your email, you could get arrested and charged. Or more likely end up having to use facial recognition[2] administered by a third party which is incapable of verifying people. If you think going to the Social Security Administration to have a paper card printed for you is bad, wait until you have to go to have your password reset... Or we can legislate Google, Apple and co that if someone holds an account with them and is banned they are entitled to a human led review process, possibly by a third party or other group. We can legislate that if you're a customer in good standing, they have to have human support available. Does this mean they might be more stingy with "free" services? Probably - that isn't a bad thing. Most people take offense to Walmart moving in to areas, taking a loss for a year or two to steal customers and close local stores and then jacking up prices. I don't understand why we're ok with big tech getting a pass to do the same thing digitally. [1]: https://www.grandforksherald.com/newsmd/va-audit-finds-thousands-of-u-s-veterans-waiting-for-health-care https://www.grandforksherald.com/newsmd/va-audit-finds-thous... [2]: https://www.foxbusiness.com/economy/irs-facial-recognition-scans-tax-returns https://www.foxbusiness.com/economy/irs-facial-recognition-s...
pphysch 4y ago
"Self-sovereign identity" is an oxymoron. "Self-sovereign" means each individual is their own identity provider. "Identities" must be uniquely identifiable, otherwise... they're not identities, they're just bits of data. Practically, that means there must be a centrally-managed namespace of identities that is tightly regulated, ACID-compliant, etc. Federation is practical here, but it will all tie back to the central entity (e.g. government).
- vineyardmike 4y ago
  PKI can be both self-sovereign and unique. Look at crypto currencies- wallets are uniquely yours and also free from a central identity provider (since you only need the private key). You don’t need a blockchain. Self-signed certs are enough for people to auth their candy crush accounts.
  - Pxtl 4y ago
    They fail the uniqueness test. I can create as many self-signed certs and wallets as I like, allowing me infinite sockpuppets. That's not an identity.
    - gnramires 4y ago
      I think you're conflating two things. Creating infinite identities is known as the sybil problem is cybersecurity, or sybil attacks. Indeed you need a way to verify identity in the real world with trusted parties to defeat this. (In my interpretation 'uniquely identifiable' should be satisfied by your unique ability to sign data -- actions, statements, etc. associated with that key. there's a problem of making the identity itself human readable, which essentially needs a name system on top) That said, I think the government de facto already has many useful functions around identity verification, I think making it more accessible, modern and useful is a good idea. Also with good design practices of digital systems, we can also make things more transparent, auditable, etc.. The downside I would say is the possibility of some kind of catastrophic breach or denial of service event having a large impact (any of our usual web services are subject to that though), and having a fallback offline infrastructure should be worthwhile.
numpad0 4y ago
> It’s silly and there’s no meatspace equivalent because it would be absurd like the article points out There is meatspace equivalent that is landline phone numbers and telecommunications companies
nathias 4y ago
I agree, but this sounds like it was written in 2000, Google Apple and Facebook have been the defacto ID providers for years and I don't see that changing without some form of goverment enforced protocol. This won't happen because the goverments just see the power of platforms and want it for themselves.
- dcow 4y ago
  I'm talking about in a webauthn world. Luckily email being self-hosted is totally normal right now and thank god platforms don't lock that down. However, with webauthn platforms has the chance to nefariously lock down who can sign webauthn challenges. I hope to God they don't or we prevent it.

by dcow 4y ago

ghoshbishakh 4y ago

I was also about to mention SSI. The Decentralized Identifiers (DIDs) [1], and Verifiable Credentials [2] are W3C Recommendations for solving this exact problem. There are implementations of these also - check Hyperledger Indy and the Identity Foundation projects [3]. I along with IBM Research folks wrote a paper on even more interesting ways of exchanging identity information between two entities called Private Certifier Intersection [4]. [1] https://www.w3.org/TR/did-core/ https://www.w3.org/TR/did-core/ [2] https://www.w3.org/TR/vc-data-model/ https://www.w3.org/TR/vc-data-model/ [3] https://identity.foundation/ https://identity.foundation/ [4] https://www.ndss-symposium.org/ndss-paper/private-certifier-intersection/ https://www.ndss-symposium.org/ndss-paper/private-certifier-...

ineptech 4y ago

Nobody really wants government-run auth, but we need it nonetheless. For extreme cases like having your identity stolen, the solution of last resort is "go to a place and talk to a human." No tech company will pay all those salaries to run a free service, so realistically that place is going to the be the DMV or similar.

vorpalhex 4y ago
> No tech company will pay all those salaries to run a free service, so realistically that place is going to the be the DMV or similar. Or we legislate and make companies provide a minimum amount of service. You can't offload your operating expenses to the government.
- shagie 4y ago
  The advantage of the government is that it is rather difficult for it to ignore you. If you exist, you pay taxes type "you won't be ignored." However, if you are fraudster and get to the point where Apple and Facebook and Google all cancel their accounts with you for non-payment or use of stolen credit cards of whatever other reason that a company would decline to do business with an individual... Well, now you don't exist since the big IDPs won't auth you. Or, are we suggesting that we legislate so that companies are required to do business with individuals who are making fraudulent use of their services? The only reasonable organization to do this is the one that has an inherent obligation to do it and for better or worse, that's the government.
  - vorpalhex 4y ago
    > The advantage of the government is that it is rather difficult for it to ignore you. If you exist, you pay taxes type "you won't be ignored." No, the Government has a long track record of successfully ignoring people who have hard to solve problems.[1] > ...we legislate so that companies are required to do business with individuals who are making fraudulent use of their services I suppose instead of just canceling your account and you losing your email, you could get arrested and charged. Or more likely end up having to use facial recognition[2] administered by a third party which is incapable of verifying people. If you think going to the Social Security Administration to have a paper card printed for you is bad, wait until you have to go to have your password reset... Or we can legislate Google, Apple and co that if someone holds an account with them and is banned they are entitled to a human led review process, possibly by a third party or other group. We can legislate that if you're a customer in good standing, they have to have human support available. Does this mean they might be more stingy with "free" services? Probably - that isn't a bad thing. Most people take offense to Walmart moving in to areas, taking a loss for a year or two to steal customers and close local stores and then jacking up prices. I don't understand why we're ok with big tech getting a pass to do the same thing digitally. [1]: https://www.grandforksherald.com/newsmd/va-audit-finds-thousands-of-u-s-veterans-waiting-for-health-care https://www.grandforksherald.com/newsmd/va-audit-finds-thous... [2]: https://www.foxbusiness.com/economy/irs-facial-recognition-scans-tax-returns https://www.foxbusiness.com/economy/irs-facial-recognition-s...

pphysch 4y ago

"Self-sovereign identity" is an oxymoron. "Self-sovereign" means each individual is their own identity provider. "Identities" must be uniquely identifiable, otherwise... they're not identities, they're just bits of data. Practically, that means there must be a centrally-managed namespace of identities that is tightly regulated, ACID-compliant, etc. Federation is practical here, but it will all tie back to the central entity (e.g. government).

vineyardmike 4y ago
PKI can be both self-sovereign and unique. Look at crypto currencies- wallets are uniquely yours and also free from a central identity provider (since you only need the private key). You don’t need a blockchain. Self-signed certs are enough for people to auth their candy crush accounts.
- Pxtl 4y ago
  They fail the uniqueness test. I can create as many self-signed certs and wallets as I like, allowing me infinite sockpuppets. That's not an identity.
  - gnramires 4y ago
    I think you're conflating two things. Creating infinite identities is known as the sybil problem is cybersecurity, or sybil attacks. Indeed you need a way to verify identity in the real world with trusted parties to defeat this. (In my interpretation 'uniquely identifiable' should be satisfied by your unique ability to sign data -- actions, statements, etc. associated with that key. there's a problem of making the identity itself human readable, which essentially needs a name system on top) That said, I think the government de facto already has many useful functions around identity verification, I think making it more accessible, modern and useful is a good idea. Also with good design practices of digital systems, we can also make things more transparent, auditable, etc.. The downside I would say is the possibility of some kind of catastrophic breach or denial of service event having a large impact (any of our usual web services are subject to that though), and having a fallback offline infrastructure should be worthwhile.

numpad0 4y ago

> It’s silly and there’s no meatspace equivalent because it would be absurd like the article points out There is meatspace equivalent that is landline phone numbers and telecommunications companies

nathias 4y ago

I agree, but this sounds like it was written in 2000, Google Apple and Facebook have been the defacto ID providers for years and I don't see that changing without some form of goverment enforced protocol. This won't happen because the goverments just see the power of platforms and want it for themselves.

dcow 4y ago
I'm talking about in a webauthn world. Luckily email being self-hosted is totally normal right now and thank god platforms don't lock that down. However, with webauthn platforms has the chance to nefariously lock down who can sign webauthn challenges. I hope to God they don't or we prevent it.