7 ms·

> or maybe your Electronic National ID card This is the actual missing key bit. The problem that Google is trying to solve here is not actually a hardware / co

> or maybe your Electronic National ID card This is the actual missing key bit. The problem that Google is trying to solve here is not actually a hardware / computational problem, it's a Real Identity problem. Hardware / TPMs are a poor proxy for solving that problem. There's drastically less eWaste and impact on software freedom if you seek attestation from a national ID provider than if you seek attestation from one of a handful of personal electronics OEMs. National ID providers can offer to sign not only Real Identity attestations, but also anonymized attestations to protect citizen privacy. A web operator can decide whether to allow for attestations from only their own national ID provider, foreign national ID providers, private ID providers, or none at all if they just have a read-only site and don't really care. The truth is that government inaction is forcing Big Tech down the road of violating user privacy and freedoms to solve Big Tech's problems. But getting the government to offer a flat Identity Provider playing field would solve these problems in a way that doesn't require such violation.

AnthonyMouse 3y ago
Any kind of digital National ID is a privacy disaster in itself because then things will use it to correlate your activity across different devices and services. That should not exist.
- Knee_Pain 3y ago
  That entirely depends on how the mechanism is implemented. For example you could have the website never knowing your actual ID but simply passing an encrypted string to the national server, which would return a 200 response if the document is valid. You could also have additional requests like "is the user 18+". The website will just know the request is coming from something which has a valid ID available. The state will also not know which pages you browsed, only the domain of the request, just like with HTTPs your ISP does not know exactly the pages you browse but just the websites themselves. And before someone talks about the state knowing your browser history: they already can by calling up your ISP, and they would get a lot more information than this mechanism would provide.
  - salawat 3y ago
    It will never work. It'll all come down to a single ID. No one is going to do an ipta more eork than necessary Dissuade yourself of this illusion. Besides which, any type of "nerfed" system that avoids abusive patterns by design will just get A) used as political chaff for jockeying by power hungry politicians as distraction fodder or FUD material B) centralized by the intelligence community of your country, or an allied country with an agreement that they'll do the work for your government that your government can't. There are things that simply should not, nay, must not be made. The Single Identification Number is one. We have all the tools to do it today. The only thing keeping it from happening is refusal to implement at the grassroots level.
  - quazar 3y ago
    time correlation between the isp and the authentication system
  - flagrant_taco 3y ago
    There's a lot of trust in that model. I would have to trust that the web server isn't passing extra information like the page I visited, that the government isn't passing back extra info like a unique identifier, and that the scripted strong is completely anonymous and single use. If any of that trust is broken my privacy is at risk. > And before someone talks about the state knowing your browser history: they already can by calling up your ISP, and they would get a lot more information than this mechanism would provide. That depends on how you browse the internet today, and how the ISP tracks it. Simply using a different DNS service goes a long way, and using a VPN or the tor network may not be totally fool proof but should get around the basic drag nets am ISP is likely to use.
    - solatic 3y ago
      > there's a lot of trust in that model No, there isn't. It's basically an OAuth login flow. The spec is publicly documented, anyone can register applications and check if the government is responding as desired, both by correctly requesting auth for the correct scopes in the government-hosted auth page, and by checking that the data returned from the gov matches what the spec promises.
- EvanAnderson 3y ago
  > Any kind of digital National ID is a privacy disaster in itself… Ah, ha! The PR spin necessary to kill this in the US would be to connect it national ID. I hadn’t thought of that. A narrative about national ID with some vague “mark of the beast” insinuation thrown in and suddenly a large political faction who otherwise would care about this would be opposed. I like it.
  - jpadkins 3y ago
    I know your post is in jest, but I think you might not be aware of how suspicious right wing populists (especially bible reading right wing populists) are of Fed + Big Tech alliance. It will not take much to rally this group against these types of initiatives. There has been plenty of evidence of collaboration between Feds and Big Tech to suppress their political voice in the last 12 months (twitter files, FBI whistleblowers, etc) I think a political strategy of getting rural school districts + 20 State governments to go on record saying they will not purchase or use computers that have Google WEI could be very effective.
    - EvanAnderson 3y ago
      No jesting on my part. I don’t buy into the “mark of the beast” narrative but if it works to help hold on to the freedom we have with personal computers I’ll hitch my wagon to it.
      - userbinator 3y ago
        As the saying goes, an enemy of an enemy is a friend.
        flir 3y ago
        Type up a nice PR release (with lots of pictures) and start emailing to the griftier end of the youtube influencers.
      - AnthonyMouse 3y ago
        > I don’t buy into the “mark of the beast” narrative but if it works to help hold on to the freedom we have with personal computers I’ll hitch my wagon to it. It's also worth considering where this stuff comes from instead of ascribing anything the other team says to superstitious fools and their invisible sky man. Branding people like cattle wasn't invented in modernity. It's infamous Nazi behavior, and the Nazis weren't the first to do it either. It's so old that people centuries ago saw how bad it turns out and put a warning against it in their ancient book. You don't have to believe in the devil to believe that history repeats and learn a lesson from the people who came before.
- nonameiguess 3y ago
  This entirely depends on what uses it. If every website on the planet starts requiring you to attest to your identity to view the site, then yes. If it's actually just banking and e-filing taxes, even if you're doing that over Tor from a burner laptop running Tails on library WiFi, the activity is attached to your identity anyway.
  - AnthonyMouse 3y ago
    But if it's actually just banking and e-filing taxes then you don't need a "digital National ID" you just need a login to your bank and one government website, which have no real reason to even be the same login.
dmantis 3y ago
And what if I don't trust and don't want to rely on my citizenship government? Being a Russian passport holder who lives abroad for years, I don't want to be in touch with my gov in any way possible, and moreover depend on it. That's actually the case for millions of people from different countries with dictatorships, do you propose just to discriminate everyone outside of 20-30 countries with more or less democratic systems ? Those countries don't care about "citizen privacy". Apart from that, we all see the bill in the UK which is as much a disaster to human freedoms as Russian and Chinese laws, for example. So even being a citizen of a more modern country is not a guarantee. People don't always live in their country of citizenship, they don't always live in one place (see digital nomads) and have a residence, they don't always trust their government and they should not be discriminated on internet usage because of that. That makes a person more of a government property rather than a human being.
- fsflover 3y ago
  How about getting such ID from your residence country?
  - sempron64 3y ago
    I think the pushback against Voter ID laws is ridiculous, but not allowing the disenfranchised to use a computer is ridiculously dystopian.
    - flir 3y ago
      It disenfranchises more people than fraudulent votes it prevents. Like, orders of magnitude more. If your goal is to accurately assess the opinion of the electorate, voter ID laws get you further from that goal, not closer to it.
    - tzs 3y ago
      Pushback against voter ID laws would be ridiculous if those laws were accompanied with measures to make it cheap and easy for citizens to obtains the necessary ID. If those laws were accompanied by such measures most of the pushback would go away. But in most of the states that have been pushing such laws that is very much not the case. The deliberately pick forms of ID that are less prevalent among poor and minority voters and that for many are expensive to obtain. In several they have also taken measures to make it even more difficult for those people to obtain ID. For example if they require an ID that you get from the state's department of motor vehicles (DMV) they (in the name of budget cuts) close many DMV offices, and in the ones that remain open the cut back on the hours during which they will issue licenses to a few hours on weekdays. The closures mostly hit in poor and minority districts. Yes, some of those laws do make some forms of acceptable ID free, but only in the sense that there is no fee to obtain that ID. Obtaining the documents necessary to obtain the ID will still have fees.
LelouBil 3y ago
France has an app in beta right now called "France identité". It can replace your physical ID but it also has other useful features. The most useful one is the ability to generate Identity Proofs that contain only the minimum required information to prove your identity. They even have an expiration date, a named recever and a motive. Of course the receiver can verify their legitimacy in the app. No more sending copies of your ID ! I also think one of the features is proof of majority without revealing your identity. Probably made for adult websites because a ruling was made a while ago that they would have to enforce age restrictions better.
JohnFen 3y ago
> if you seek attestation from one of a handful of personal electronics OEMs. This is just an enormous nope for me. No better than this WEI stuff. > The truth is that government inaction is forcing Big Tech down the road of violating user privacy and freedoms to solve Big Tech's problems. Whether is governmental or private action, how is it right or good that everyone has to suffer just because big tech has business model problems?

AnthonyMouse 3y ago

Any kind of digital National ID is a privacy disaster in itself because then things will use it to correlate your activity across different devices and services. That should not exist.

Knee_Pain 3y ago
That entirely depends on how the mechanism is implemented. For example you could have the website never knowing your actual ID but simply passing an encrypted string to the national server, which would return a 200 response if the document is valid. You could also have additional requests like "is the user 18+". The website will just know the request is coming from something which has a valid ID available. The state will also not know which pages you browsed, only the domain of the request, just like with HTTPs your ISP does not know exactly the pages you browse but just the websites themselves. And before someone talks about the state knowing your browser history: they already can by calling up your ISP, and they would get a lot more information than this mechanism would provide.
- salawat 3y ago
  It will never work. It'll all come down to a single ID. No one is going to do an ipta more eork than necessary Dissuade yourself of this illusion. Besides which, any type of "nerfed" system that avoids abusive patterns by design will just get A) used as political chaff for jockeying by power hungry politicians as distraction fodder or FUD material B) centralized by the intelligence community of your country, or an allied country with an agreement that they'll do the work for your government that your government can't. There are things that simply should not, nay, must not be made. The Single Identification Number is one. We have all the tools to do it today. The only thing keeping it from happening is refusal to implement at the grassroots level.
- quazar 3y ago
  time correlation between the isp and the authentication system
- flagrant_taco 3y ago
  There's a lot of trust in that model. I would have to trust that the web server isn't passing extra information like the page I visited, that the government isn't passing back extra info like a unique identifier, and that the scripted strong is completely anonymous and single use. If any of that trust is broken my privacy is at risk. > And before someone talks about the state knowing your browser history: they already can by calling up your ISP, and they would get a lot more information than this mechanism would provide. That depends on how you browse the internet today, and how the ISP tracks it. Simply using a different DNS service goes a long way, and using a VPN or the tor network may not be totally fool proof but should get around the basic drag nets am ISP is likely to use.
  - solatic 3y ago
    > there's a lot of trust in that model No, there isn't. It's basically an OAuth login flow. The spec is publicly documented, anyone can register applications and check if the government is responding as desired, both by correctly requesting auth for the correct scopes in the government-hosted auth page, and by checking that the data returned from the gov matches what the spec promises.
EvanAnderson 3y ago
> Any kind of digital National ID is a privacy disaster in itself… Ah, ha! The PR spin necessary to kill this in the US would be to connect it national ID. I hadn’t thought of that. A narrative about national ID with some vague “mark of the beast” insinuation thrown in and suddenly a large political faction who otherwise would care about this would be opposed. I like it.
- jpadkins 3y ago
  I know your post is in jest, but I think you might not be aware of how suspicious right wing populists (especially bible reading right wing populists) are of Fed + Big Tech alliance. It will not take much to rally this group against these types of initiatives. There has been plenty of evidence of collaboration between Feds and Big Tech to suppress their political voice in the last 12 months (twitter files, FBI whistleblowers, etc) I think a political strategy of getting rural school districts + 20 State governments to go on record saying they will not purchase or use computers that have Google WEI could be very effective.
  - EvanAnderson 3y ago
    No jesting on my part. I don’t buy into the “mark of the beast” narrative but if it works to help hold on to the freedom we have with personal computers I’ll hitch my wagon to it.
    - userbinator 3y ago
      As the saying goes, an enemy of an enemy is a friend.
      - flir 3y ago
        Type up a nice PR release (with lots of pictures) and start emailing to the griftier end of the youtube influencers.
    - AnthonyMouse 3y ago
      > I don’t buy into the “mark of the beast” narrative but if it works to help hold on to the freedom we have with personal computers I’ll hitch my wagon to it. It's also worth considering where this stuff comes from instead of ascribing anything the other team says to superstitious fools and their invisible sky man. Branding people like cattle wasn't invented in modernity. It's infamous Nazi behavior, and the Nazis weren't the first to do it either. It's so old that people centuries ago saw how bad it turns out and put a warning against it in their ancient book. You don't have to believe in the devil to believe that history repeats and learn a lesson from the people who came before.
nonameiguess 3y ago
This entirely depends on what uses it. If every website on the planet starts requiring you to attest to your identity to view the site, then yes. If it's actually just banking and e-filing taxes, even if you're doing that over Tor from a burner laptop running Tails on library WiFi, the activity is attached to your identity anyway.
- AnthonyMouse 3y ago
  But if it's actually just banking and e-filing taxes then you don't need a "digital National ID" you just need a login to your bank and one government website, which have no real reason to even be the same login.

dmantis 3y ago

And what if I don't trust and don't want to rely on my citizenship government? Being a Russian passport holder who lives abroad for years, I don't want to be in touch with my gov in any way possible, and moreover depend on it. That's actually the case for millions of people from different countries with dictatorships, do you propose just to discriminate everyone outside of 20-30 countries with more or less democratic systems ? Those countries don't care about "citizen privacy". Apart from that, we all see the bill in the UK which is as much a disaster to human freedoms as Russian and Chinese laws, for example. So even being a citizen of a more modern country is not a guarantee. People don't always live in their country of citizenship, they don't always live in one place (see digital nomads) and have a residence, they don't always trust their government and they should not be discriminated on internet usage because of that. That makes a person more of a government property rather than a human being.

fsflover 3y ago
How about getting such ID from your residence country?
- sempron64 3y ago
  I think the pushback against Voter ID laws is ridiculous, but not allowing the disenfranchised to use a computer is ridiculously dystopian.
  - flir 3y ago
    It disenfranchises more people than fraudulent votes it prevents. Like, orders of magnitude more. If your goal is to accurately assess the opinion of the electorate, voter ID laws get you further from that goal, not closer to it.
  - tzs 3y ago
    Pushback against voter ID laws would be ridiculous if those laws were accompanied with measures to make it cheap and easy for citizens to obtains the necessary ID. If those laws were accompanied by such measures most of the pushback would go away. But in most of the states that have been pushing such laws that is very much not the case. The deliberately pick forms of ID that are less prevalent among poor and minority voters and that for many are expensive to obtain. In several they have also taken measures to make it even more difficult for those people to obtain ID. For example if they require an ID that you get from the state's department of motor vehicles (DMV) they (in the name of budget cuts) close many DMV offices, and in the ones that remain open the cut back on the hours during which they will issue licenses to a few hours on weekdays. The closures mostly hit in poor and minority districts. Yes, some of those laws do make some forms of acceptable ID free, but only in the sense that there is no fee to obtain that ID. Obtaining the documents necessary to obtain the ID will still have fees.

LelouBil 3y ago

France has an app in beta right now called "France identité". It can replace your physical ID but it also has other useful features. The most useful one is the ability to generate Identity Proofs that contain only the minimum required information to prove your identity. They even have an expiration date, a named recever and a motive. Of course the receiver can verify their legitimacy in the app. No more sending copies of your ID ! I also think one of the features is proof of majority without revealing your identity. Probably made for adult websites because a ruling was made a while ago that they would have to enforce age restrictions better.

JohnFen 3y ago

> if you seek attestation from one of a handful of personal electronics OEMs. This is just an enormous nope for me. No better than this WEI stuff. > The truth is that government inaction is forcing Big Tech down the road of violating user privacy and freedoms to solve Big Tech's problems. Whether is governmental or private action, how is it right or good that everyone has to suffer just because big tech has business model problems?