5 ms·

A passport, or some other difficult-to-forge document, could be used right?

ghaff 3y ago
That's how it works in the US. You show the notary your passport or driver's license, they go "Yup, looks like you," you sign the doc in their presence, and they apply their stamp.
- noodlesUK 3y ago
  Yeah, but even notary seals are forged with alarming frequency. They are usually just a stamp after all.
  - dzhiurgis 3y ago
    They do keep a record of document signed (not an actual document tho)
  - ghaff 3y ago
    But, at some point, what do you do to absolutely 100% guarantee your bonafides to a complete stranger located across the country? The answer is you probably can't so you put a system in place that protects against all but the most serious and determined attacker who is willing to spend significant effort and money to impersonate you. It's true that you can physically go to the institution in question and prove your bonafides to them so no intermediate is involved but you start to add a lot of friction to all but the most serious transactions.
    - noodlesUK 3y ago
      I mean, some kind of PKI would be a nice start. Preferably with a registry at national level.
shortcake27 3y ago
Only physically though. Many years ago, possessing the values on a passport constituted verification. This data was stored and after a significant number of leaks, this data alone was useless as it became public knowledge. The next step was requiring a photo of the document. The photos were stored, and after a significant number of leaks, the same thing happened. The next step was ID selfies. Then the same thing happened. Now it’s selfie videos with the ID. This too will become useless when those videos are leaked. It’s a never ending battle. A passport is a physical document and should only be used physically. Online, we need public/private key authentication. It’s the only way.
- dzhiurgis 3y ago
  > Online, we need public/private key authentication. It’s the only way. Your credit card already has contactless chip and it's been ID verified. So does your smartphone. Why can't we just marry the two together?
- ghaff 3y ago
  And then private keys will leak. Nothing's perfect. Requiring physical presence is a pain but it's probably tolerable for sufficiently high value transactions. Only works within the US. There's a related process with more hurdles for international.
  - LinAGKar 3y ago
    Except, unlike with the other stuff, you don't need to send your private key to anyone to prove you have it
  - xvilka 3y ago
    Unlike passport or face it's easy to revoke the old key and issue a new one.
- MichaelZuo 3y ago
  I assumed this was only in regards to higher value interactions where meeting in person always makes sense. I'm having trouble imagining a scenario where such a high level of assurance for real identity verification is required but is not worthwhile to meet in person. Can you name a few examples?

That's how it works in the US. You show the notary your passport or driver's license, they go "Yup, looks like you," you sign the doc in their presence, and they apply their stamp.

noodlesUK 3y ago
Yeah, but even notary seals are forged with alarming frequency. They are usually just a stamp after all.
- dzhiurgis 3y ago
  They do keep a record of document signed (not an actual document tho)
- ghaff 3y ago
  But, at some point, what do you do to absolutely 100% guarantee your bonafides to a complete stranger located across the country? The answer is you probably can't so you put a system in place that protects against all but the most serious and determined attacker who is willing to spend significant effort and money to impersonate you. It's true that you can physically go to the institution in question and prove your bonafides to them so no intermediate is involved but you start to add a lot of friction to all but the most serious transactions.
  - noodlesUK 3y ago
    I mean, some kind of PKI would be a nice start. Preferably with a registry at national level.

shortcake27 3y ago

Only physically though. Many years ago, possessing the values on a passport constituted verification. This data was stored and after a significant number of leaks, this data alone was useless as it became public knowledge. The next step was requiring a photo of the document. The photos were stored, and after a significant number of leaks, the same thing happened. The next step was ID selfies. Then the same thing happened. Now it’s selfie videos with the ID. This too will become useless when those videos are leaked. It’s a never ending battle. A passport is a physical document and should only be used physically. Online, we need public/private key authentication. It’s the only way.

dzhiurgis 3y ago
> Online, we need public/private key authentication. It’s the only way. Your credit card already has contactless chip and it's been ID verified. So does your smartphone. Why can't we just marry the two together?
ghaff 3y ago
And then private keys will leak. Nothing's perfect. Requiring physical presence is a pain but it's probably tolerable for sufficiently high value transactions. Only works within the US. There's a related process with more hurdles for international.
- LinAGKar 3y ago
  Except, unlike with the other stuff, you don't need to send your private key to anyone to prove you have it
- xvilka 3y ago
  Unlike passport or face it's easy to revoke the old key and issue a new one.
MichaelZuo 3y ago
I assumed this was only in regards to higher value interactions where meeting in person always makes sense. I'm having trouble imagining a scenario where such a high level of assurance for real identity verification is required but is not worthwhile to meet in person. Can you name a few examples?