4 ms·

Nobody really wants government-run auth, but we need it nonetheless. For extreme cases like having your identity stolen, the solution of last resort is "go to

Nobody really wants government-run auth, but we need it nonetheless. For extreme cases like having your identity stolen, the solution of last resort is "go to a place and talk to a human." No tech company will pay all those salaries to run a free service, so realistically that place is going to the be the DMV or similar.

vorpalhex 4y ago
> No tech company will pay all those salaries to run a free service, so realistically that place is going to the be the DMV or similar. Or we legislate and make companies provide a minimum amount of service. You can't offload your operating expenses to the government.
- shagie 4y ago
  The advantage of the government is that it is rather difficult for it to ignore you. If you exist, you pay taxes type "you won't be ignored." However, if you are fraudster and get to the point where Apple and Facebook and Google all cancel their accounts with you for non-payment or use of stolen credit cards of whatever other reason that a company would decline to do business with an individual... Well, now you don't exist since the big IDPs won't auth you. Or, are we suggesting that we legislate so that companies are required to do business with individuals who are making fraudulent use of their services? The only reasonable organization to do this is the one that has an inherent obligation to do it and for better or worse, that's the government.
  - vorpalhex 4y ago
    > The advantage of the government is that it is rather difficult for it to ignore you. If you exist, you pay taxes type "you won't be ignored." No, the Government has a long track record of successfully ignoring people who have hard to solve problems.[1] > ...we legislate so that companies are required to do business with individuals who are making fraudulent use of their services I suppose instead of just canceling your account and you losing your email, you could get arrested and charged. Or more likely end up having to use facial recognition[2] administered by a third party which is incapable of verifying people. If you think going to the Social Security Administration to have a paper card printed for you is bad, wait until you have to go to have your password reset... Or we can legislate Google, Apple and co that if someone holds an account with them and is banned they are entitled to a human led review process, possibly by a third party or other group. We can legislate that if you're a customer in good standing, they have to have human support available. Does this mean they might be more stingy with "free" services? Probably - that isn't a bad thing. Most people take offense to Walmart moving in to areas, taking a loss for a year or two to steal customers and close local stores and then jacking up prices. I don't understand why we're ok with big tech getting a pass to do the same thing digitally. [1]: https://www.grandforksherald.com/newsmd/va-audit-finds-thousands-of-u-s-veterans-waiting-for-health-care https://www.grandforksherald.com/newsmd/va-audit-finds-thous... [2]: https://www.foxbusiness.com/economy/irs-facial-recognition-scans-tax-returns https://www.foxbusiness.com/economy/irs-facial-recognition-s...
johnfonesca 4y ago
Speaking as a application developer (digital signatures solution) which has to integrate with government related entities, i'd love an official government-run authentication. Just give me an OAuth endpoint for the government solution which allows me to authenticate users and it will make the life simpler for everyone.
- aliceryhl 4y ago
  We have this in Denmark. It's pretty great. Two-factor authentication for bank logins, gov websites, and for online card purchases.
- youainti 4y ago
  This may become possible soon. Login.gov is an SSO provider for the federal government.
  - imwillofficial 4y ago
    Many gov agencies seem to be going the ID.me route in the US. I don't like that.
Kinrany 4y ago
It could be a network of companies that safeguard your keys. You give five parts of a key to five agencies and you need three to replace the lost/leaked keys.
- ineptech 4y ago
  The hard part isn't storing it, the hard part is updating it. What do you do when the automated process fails due to a corner case, like your angry ex using your phone to reset your credentials? The government solution might be annoying or time consuming, but the private sector answer is "Go fuck yourself."
  - Pxtl 4y ago
    Exactly. A government system providing the last line of authentication defense would be ideal. A single point of access where you can say "my credentials have been compromised please shut down those credentials and help me create new ones", and where businesses can check "hey is this person linked to a real account? Can I get a hash to confirm that the account is unique?".
  - Kinrany 4y ago
    You can't rely on either, not for auth, not if you want to actually own it. People fall through the cracks everywhere, so there shouldn't be any cracks to fall through.
  - AnthonyMouse 4y ago
    The government solution is the one that enables identity theft. Right now that means taking out credit in someone else's name etc., and we put the cost of that on some large organization or insurance company and just eat it. Start using that identity mechanism for everything and that vulnerability spreads to everything. Someone compromises your ID and then starts trying it against every service on the internet. They get your bank and retirement savings and drain your accounts, ransomware all your files and your employer's files, read through your messages on every platform to find something to blackmail you with so you don't go to the police, sign into your router and use your IP address for criminal activity etc. I'd much rather be told to go fuck myself by one service than have my life wrecked because a low level bureaucrat issued someone else a universal ID in my name.
AnthonyMouse 4y ago
> Nobody really wants government-run auth, but we need it nonetheless. We really don't. The most important thing about authentication over the internet is that it enable people to create multiple separate accounts that aren't tied to each other in any way. You can get more than one email address or even phone number. You only get one social security number. If you're required to use that on the internet, it becomes a universal tracking ID. That must never be allowed to happen. Meanwhile the US government lacks the competence to do this. All of their existing identification methods are either fully insecure (e.g. social security cards) or no better than anything corporations use (e.g. ID cards that can be lost or stolen or hacked). They don't have some special magic that allows you to prove who you are in a unique way. And trying to centralize everything into a single ID only makes it that much worse if you lose access to it or someone else gains access to it. The actual solution to identification is redundancy and decentralization. You have e.g. a password, an app and an email for any given service. If you lose one you sign in with another and update the one you lost. If all of that fails, you lose access only to the service where it failed, instead of losing your whole life at once. Never centralize identity.
- ineptech 4y ago
  > ...That must never be allowed to happen. I empathize with these concerns but think they're outdated by a decade or two. We already have universal tracking IDs, we just don't see them because they're opaque and proprietary. We already use government identification online, we just do it in the dumbest way possible: "please upload a photo of your driver's license." We've got the worst parts of centralized identity and none of the benefits. > They don't have some special magic that allows you to prove who you are in a unique way. Yes they do, the magic is called "losing money." FaceGoogAzonRosoft have done everything related to auth that's profitable, but the one thing they will never do is build an office in your hometown and staff it with a person who can do deal with you as an individual and physically hold your two recent utility bills when corner cases or fraud or whatever require it. The government has already built that office and hired that person, and you've already paid for it, so you might as well get some value out of it.
  - AnthonyMouse 4y ago
roenxi 4y ago
The Kafkaesque solution! This is the sort of stealthy approach that puts the auth in authoritarianism. It is not appropriate to make a person's personhood the call of some bureaucrat. The scope for abuse is staggering.
- deleted 4y ago
  [deleted]
- TeMPOraL 4y ago
  FWIW, an ID, digital or otherwise, is not your personhood. It's a number that allows service providers to keep track of your use of those services, which ultimately is required for them to be sustainably provided. What you're saying boils down to: we cannot allow service providers to enforce any quotas, limits, or payment requirements, on the services they provide.

vorpalhex 4y ago

> No tech company will pay all those salaries to run a free service, so realistically that place is going to the be the DMV or similar. Or we legislate and make companies provide a minimum amount of service. You can't offload your operating expenses to the government.

shagie 4y ago
The advantage of the government is that it is rather difficult for it to ignore you. If you exist, you pay taxes type "you won't be ignored." However, if you are fraudster and get to the point where Apple and Facebook and Google all cancel their accounts with you for non-payment or use of stolen credit cards of whatever other reason that a company would decline to do business with an individual... Well, now you don't exist since the big IDPs won't auth you. Or, are we suggesting that we legislate so that companies are required to do business with individuals who are making fraudulent use of their services? The only reasonable organization to do this is the one that has an inherent obligation to do it and for better or worse, that's the government.
- vorpalhex 4y ago
  > The advantage of the government is that it is rather difficult for it to ignore you. If you exist, you pay taxes type "you won't be ignored." No, the Government has a long track record of successfully ignoring people who have hard to solve problems.[1] > ...we legislate so that companies are required to do business with individuals who are making fraudulent use of their services I suppose instead of just canceling your account and you losing your email, you could get arrested and charged. Or more likely end up having to use facial recognition[2] administered by a third party which is incapable of verifying people. If you think going to the Social Security Administration to have a paper card printed for you is bad, wait until you have to go to have your password reset... Or we can legislate Google, Apple and co that if someone holds an account with them and is banned they are entitled to a human led review process, possibly by a third party or other group. We can legislate that if you're a customer in good standing, they have to have human support available. Does this mean they might be more stingy with "free" services? Probably - that isn't a bad thing. Most people take offense to Walmart moving in to areas, taking a loss for a year or two to steal customers and close local stores and then jacking up prices. I don't understand why we're ok with big tech getting a pass to do the same thing digitally. [1]: https://www.grandforksherald.com/newsmd/va-audit-finds-thousands-of-u-s-veterans-waiting-for-health-care https://www.grandforksherald.com/newsmd/va-audit-finds-thous... [2]: https://www.foxbusiness.com/economy/irs-facial-recognition-scans-tax-returns https://www.foxbusiness.com/economy/irs-facial-recognition-s...

johnfonesca 4y ago

Speaking as a application developer (digital signatures solution) which has to integrate with government related entities, i'd love an official government-run authentication. Just give me an OAuth endpoint for the government solution which allows me to authenticate users and it will make the life simpler for everyone.

aliceryhl 4y ago
We have this in Denmark. It's pretty great. Two-factor authentication for bank logins, gov websites, and for online card purchases.
youainti 4y ago
This may become possible soon. Login.gov is an SSO provider for the federal government.
- imwillofficial 4y ago
  Many gov agencies seem to be going the ID.me route in the US. I don't like that.

Kinrany 4y ago

It could be a network of companies that safeguard your keys. You give five parts of a key to five agencies and you need three to replace the lost/leaked keys.

ineptech 4y ago
The hard part isn't storing it, the hard part is updating it. What do you do when the automated process fails due to a corner case, like your angry ex using your phone to reset your credentials? The government solution might be annoying or time consuming, but the private sector answer is "Go fuck yourself."
- Pxtl 4y ago
  Exactly. A government system providing the last line of authentication defense would be ideal. A single point of access where you can say "my credentials have been compromised please shut down those credentials and help me create new ones", and where businesses can check "hey is this person linked to a real account? Can I get a hash to confirm that the account is unique?".
- Kinrany 4y ago
  You can't rely on either, not for auth, not if you want to actually own it. People fall through the cracks everywhere, so there shouldn't be any cracks to fall through.
- AnthonyMouse 4y ago
  The government solution is the one that enables identity theft. Right now that means taking out credit in someone else's name etc., and we put the cost of that on some large organization or insurance company and just eat it. Start using that identity mechanism for everything and that vulnerability spreads to everything. Someone compromises your ID and then starts trying it against every service on the internet. They get your bank and retirement savings and drain your accounts, ransomware all your files and your employer's files, read through your messages on every platform to find something to blackmail you with so you don't go to the police, sign into your router and use your IP address for criminal activity etc. I'd much rather be told to go fuck myself by one service than have my life wrecked because a low level bureaucrat issued someone else a universal ID in my name.

AnthonyMouse 4y ago

> Nobody really wants government-run auth, but we need it nonetheless. We really don't. The most important thing about authentication over the internet is that it enable people to create multiple separate accounts that aren't tied to each other in any way. You can get more than one email address or even phone number. You only get one social security number. If you're required to use that on the internet, it becomes a universal tracking ID. That must never be allowed to happen. Meanwhile the US government lacks the competence to do this. All of their existing identification methods are either fully insecure (e.g. social security cards) or no better than anything corporations use (e.g. ID cards that can be lost or stolen or hacked). They don't have some special magic that allows you to prove who you are in a unique way. And trying to centralize everything into a single ID only makes it that much worse if you lose access to it or someone else gains access to it. The actual solution to identification is redundancy and decentralization. You have e.g. a password, an app and an email for any given service. If you lose one you sign in with another and update the one you lost. If all of that fails, you lose access only to the service where it failed, instead of losing your whole life at once. Never centralize identity.

ineptech 4y ago
> ...That must never be allowed to happen. I empathize with these concerns but think they're outdated by a decade or two. We already have universal tracking IDs, we just don't see them because they're opaque and proprietary. We already use government identification online, we just do it in the dumbest way possible: "please upload a photo of your driver's license." We've got the worst parts of centralized identity and none of the benefits. > They don't have some special magic that allows you to prove who you are in a unique way. Yes they do, the magic is called "losing money." FaceGoogAzonRosoft have done everything related to auth that's profitable, but the one thing they will never do is build an office in your hometown and staff it with a person who can do deal with you as an individual and physically hold your two recent utility bills when corner cases or fraud or whatever require it. The government has already built that office and hired that person, and you've already paid for it, so you might as well get some value out of it.
- AnthonyMouse 4y ago

roenxi 4y ago

The Kafkaesque solution! This is the sort of stealthy approach that puts the auth in authoritarianism. It is not appropriate to make a person's personhood the call of some bureaucrat. The scope for abuse is staggering.

deleted 4y ago
[deleted]
TeMPOraL 4y ago
FWIW, an ID, digital or otherwise, is not your personhood. It's a number that allows service providers to keep track of your use of those services, which ultimately is required for them to be sustainably provided. What you're saying boils down to: we cannot allow service providers to enforce any quotas, limits, or payment requirements, on the services they provide.