6 ms·

Is there a reputable identity provider that would verify a passport, SSN or similar, preferably in person, and link that to an OpenPGP key with metadata same as

by aborsy 3y ago

Is there a reputable identity provider that would verify a passport, SSN or similar, preferably in person, and link that to an OpenPGP key with metadata same as in the ID? Similar to this service, but linking not just the name, but more secure unique identity data. Linking the person’s name to the key is not very useful, since there are many people with that name. That’s basically a government issued smart card, that would allow the use of OpenPGP A-E-S keys for arbitrary data through a FOSS API. Keybase was a good idea, but it’s semi dead.

nailer 3y ago
> but more secure unique identity data What kind of data? eID pretty much replicates Keybase, except it's concerned with real world identity (matching your given and surname to your pubkey) rather than pseudonymous identity (matching your twitter handle or reddit account or whatever else to your pubkey). > that would allow the use of A-E-S keys for arbitrary data through a FOSS API. You can use your ECC (or RSA) keypairs to negotiate an AES or chacha+poly session key. Most cryptosystems do that (ECDHE, or DHE for RSA) now since: 1. session keys are faster (in terms of CPU) than just encrypting with the remote's pubkey. 2. if the session key is stolen, you just get access to that session (perfect forward secrecy). 3. group chats just store the session key encrypted chat, plus copies of the session key encrypted with everyone's pubkey, to save storage.
- aborsy 3y ago
  Social Security number, passport number, birth certificate data, drivers license , tax information, etc. Some numbers need to be verified every few years.
  - tomrod 3y ago
    An OpenPGP key could be the most stable of all identifiers out there!
    - lxgr 3y ago
      What if you lose it, or the private key leaks? A public key is a pretty bad identifier by itself. The combination of a good identifier with a public key/certificate binding to it is pretty powerful, though. The US has a good public identifier (SSNs), but they are completely unauthenticated. German arguably has the opposite: Widely available e-signature capable ID cards – but they only bind to your name (and DOB).
    - brnt 3y ago
      Not if Autocrypt has their way! (And I hope they will!)
  - numpad0 3y ago
    That kind of thing don't exist because it's illegal because it gets people killed and governments toppled. Privacy isn't human right for nothing.
  - aaronmdjones 3y ago
    I'm not sure you understand Germany. They barely emerged from one of the most oppressive surveillance regimes ever created and rightly vowed to make it as difficult as possible to arrive there again; everything you've just described is taboo if not illegal. Even using a dashcam is tightly regulated.
delsarto 3y ago
It's not exactly what you're saying but https://keyoxide.org/ https://keyoxide.org/ Is all the best ideas of keybase. Basically if you trust someone has control over multiple different accounts you can also trust their pgp key.
- westurner 3y ago
  Re: WoT Web of Trust, `keybase pgp -h`, and Web standards: W3C DID Decentralized Identifiers, W3C VC Verifiable Credentials, "Linked Data Signatures for GPG"; there's a URI for the GpgSignature2020 signature suite: https://news.ycombinator.com/item?id=28814802 https://news.ycombinator.com/item?id=28814802 https://news.ycombinator.com/item?id=35302650 https://news.ycombinator.com/item?id=35302650 https://news.ycombinator.com/item?id=26758099 https://news.ycombinator.com/item?id=26758099 ; blockcerts.org, blockcerts-verifier-js, ILP ledger addresses
  - westurner 3y ago
    "Verifiable Credentials Data Model v1.1" W3C Recommendation 03 March 2022 https://www.w3.org/TR/vc-data-model/#ecosystem-overview https://www.w3.org/TR/vc-data-model/#ecosystem-overview : > Holder, Issuer, Subject, Verifier, Verifiable Data Registry
howmayiannoyyou 3y ago
Clear (https://www.clearme.com https://www.clearme.com) could have the business market LOCKED UP if they would - on an opt-in basis - tie their biometic data to an OpenPGP key. Its been proposed to them in the past but I think they suffer from myopia.
- toomuchtodo 3y ago
  Their business model isn't identity. It's rev share with airports to cut the TSA line. The biometrics are theater as part of the product. (control-F "Risks Related to Our Business, Brand and Operations" from Clear Secure's most recent 10-K) > Clear doesn’t do any actual security screening of passengers, a process reserved solely for the TSA. The New York-based company verifies customers’ identities and escorts them to the front, using revenue-sharing agreements with the airports or airlines that control the lines to secure an advantage for its fliers. https://archive.is/fSiq4 https://archive.is/fSiq4
  - deleted 3y ago
    [deleted]
  - CogitoCogito 3y ago
    Wait they really do nothing more than verify identity? As in the same the the person working there does checking ID? Is the only purpose to get people to cut the line but to add smoke and mirrors so it seems like that’s not the point? If that’s the case, why don’t airports just let people pay to cut the line?
    - toomuchtodo 3y ago
      > If that’s the case, why don’t airports just let people pay to cut the line? They do. That is what Clear is for (just as Ticketmaster takes the heat for venues or artists taking more from customers via fees). You mean "why don't they make it more overt?" That's a great question.
      - CogitoCogito 3y ago
smfjaw 3y ago
In new zealand there's a log in service used by the government across all services called realme, you can't link a pgp key etc but you do verify yourself in person with license or passport. it works quite well

by aborsy 3y ago

nailer 3y ago

> but more secure unique identity data What kind of data? eID pretty much replicates Keybase, except it's concerned with real world identity (matching your given and surname to your pubkey) rather than pseudonymous identity (matching your twitter handle or reddit account or whatever else to your pubkey). > that would allow the use of A-E-S keys for arbitrary data through a FOSS API. You can use your ECC (or RSA) keypairs to negotiate an AES or chacha+poly session key. Most cryptosystems do that (ECDHE, or DHE for RSA) now since: 1. session keys are faster (in terms of CPU) than just encrypting with the remote's pubkey. 2. if the session key is stolen, you just get access to that session (perfect forward secrecy). 3. group chats just store the session key encrypted chat, plus copies of the session key encrypted with everyone's pubkey, to save storage.

aborsy 3y ago
Social Security number, passport number, birth certificate data, drivers license , tax information, etc. Some numbers need to be verified every few years.
- tomrod 3y ago
  An OpenPGP key could be the most stable of all identifiers out there!
  - lxgr 3y ago
    What if you lose it, or the private key leaks? A public key is a pretty bad identifier by itself. The combination of a good identifier with a public key/certificate binding to it is pretty powerful, though. The US has a good public identifier (SSNs), but they are completely unauthenticated. German arguably has the opposite: Widely available e-signature capable ID cards – but they only bind to your name (and DOB).
  - brnt 3y ago
    Not if Autocrypt has their way! (And I hope they will!)
- numpad0 3y ago
  That kind of thing don't exist because it's illegal because it gets people killed and governments toppled. Privacy isn't human right for nothing.
- aaronmdjones 3y ago
  I'm not sure you understand Germany. They barely emerged from one of the most oppressive surveillance regimes ever created and rightly vowed to make it as difficult as possible to arrive there again; everything you've just described is taboo if not illegal. Even using a dashcam is tightly regulated.

delsarto 3y ago

It's not exactly what you're saying but https://keyoxide.org/ https://keyoxide.org/ Is all the best ideas of keybase. Basically if you trust someone has control over multiple different accounts you can also trust their pgp key.

westurner 3y ago
Re: WoT Web of Trust, `keybase pgp -h`, and Web standards: W3C DID Decentralized Identifiers, W3C VC Verifiable Credentials, "Linked Data Signatures for GPG"; there's a URI for the GpgSignature2020 signature suite: https://news.ycombinator.com/item?id=28814802 https://news.ycombinator.com/item?id=28814802 https://news.ycombinator.com/item?id=35302650 https://news.ycombinator.com/item?id=35302650 https://news.ycombinator.com/item?id=26758099 https://news.ycombinator.com/item?id=26758099 ; blockcerts.org, blockcerts-verifier-js, ILP ledger addresses
- westurner 3y ago
  "Verifiable Credentials Data Model v1.1" W3C Recommendation 03 March 2022 https://www.w3.org/TR/vc-data-model/#ecosystem-overview https://www.w3.org/TR/vc-data-model/#ecosystem-overview : > Holder, Issuer, Subject, Verifier, Verifiable Data Registry

howmayiannoyyou 3y ago

Clear (https://www.clearme.com https://www.clearme.com) could have the business market LOCKED UP if they would - on an opt-in basis - tie their biometic data to an OpenPGP key. Its been proposed to them in the past but I think they suffer from myopia.

toomuchtodo 3y ago
Their business model isn't identity. It's rev share with airports to cut the TSA line. The biometrics are theater as part of the product. (control-F "Risks Related to Our Business, Brand and Operations" from Clear Secure's most recent 10-K) > Clear doesn’t do any actual security screening of passengers, a process reserved solely for the TSA. The New York-based company verifies customers’ identities and escorts them to the front, using revenue-sharing agreements with the airports or airlines that control the lines to secure an advantage for its fliers. https://archive.is/fSiq4 https://archive.is/fSiq4
- deleted 3y ago
  [deleted]
- CogitoCogito 3y ago
  Wait they really do nothing more than verify identity? As in the same the the person working there does checking ID? Is the only purpose to get people to cut the line but to add smoke and mirrors so it seems like that’s not the point? If that’s the case, why don’t airports just let people pay to cut the line?
  - toomuchtodo 3y ago
    > If that’s the case, why don’t airports just let people pay to cut the line? They do. That is what Clear is for (just as Ticketmaster takes the heat for venues or artists taking more from customers via fees). You mean "why don't they make it more overt?" That's a great question.
    - CogitoCogito 3y ago

smfjaw 3y ago

In new zealand there's a log in service used by the government across all services called realme, you can't link a pgp key etc but you do verify yourself in person with license or passport. it works quite well