7 ms·

I’m so envious of the Baltic’s use of technology at the institutional level. It seems literally infeasible for the United States to have state-issued PKI. It’s

I’m so envious of the Baltic’s use of technology at the institutional level. It seems literally infeasible for the United States to have state-issued PKI. It’s a meta-partisan issue: no side trusts the other to manage crypto or computer systems. So for example instead of a public many-to-many digital publishing platform we are stuck with the whims of grown men who want to fist fight each other in the Colosseum and all because every X is convinced every Y is so despicable and corrupt that such a public system would be much worse than what we have now.

NavinF 3y ago
tbh I can't think of many cases where I'd want state-issued PKI. I already use public key crypto secured by biometrics (faceid) to make payments, login to my bank, etc. None of that requires interacting with the state. For most normal computer use I quite like how random social media sites can't demand my identity because it'd be too expensive for them to verify it using public records.
labster 3y ago
The USA was distrustful of national ID cards decades before the current level of hyperpartisan rancor. We just don’t the government enough to let them track us everywhere. Not that the current climate helps. The REAL ID Act of 2005 has been delayed so many times, now to 2025. Maybe we should just repeal it instead.
- xp84 3y ago
  > We just don’t the government enough to let them track us everywhere. That statement is both true and emblematic of the problem. Everyone is so cynical that a clean public-key, offline, certificate-based solution, with an absolute zero visibility to the government of who is doing what, would always be assumed to be part of some nefarious Illuminati/Democrat/Republican plot. Proving it to people with technical tests wouldn't prove it. They'll always be convinced. What we need from the government is so minimal really, just to sign certificates if we prove our identity. But it'll never happen in the US due to the distrust situation.
  - jimmydorry 3y ago
    Because there has never been a proposal for a "clean public-key / offline / certificate-based solution". It's always a central database that also does x and y and will be available for w and z departments to do as they will with it.
    - xp84 3y ago
      It doesn’t matter though, because the percentage of Americans who can understand public key crypto even in a vague way sufficient to critically read a technical analysis and judge it to be true, you could count on one hand. Nobody has proposed it because if any politicians have seen such a proposal on their desks, even if they themselves grasp it (unlikely), they know most Americans would freak out on principle.
  - mindslight 3y ago
    Why are you talking about hypotheticals and abstract "distrust" ? We're already being harmed by existing central ID systems - social security numbers and drivers license numbers - with little hope for reform in sight. If there were something like the GDPR that prohibited companies from nonconsensually demanding, storing, or using these identifiers for anything but their bona fide governmental functions, then it might make sense to talk about adding a new system. But until the government is capable of reigning in abuse of the existing systems, any new identification system would inevitably be a gift to the surveillance companies.
- sangnoir 3y ago
  > The REAL ID Act of 2005 has been delayed so many times, now to 2025 Can one fly without a REAL-ID-compliant license or ID?
  - dgoldstein0 3y ago
    Yes, with a passport you can ... Probably not what you were trying to ask. I thought the deadline passed for using real ID for TSA but I haven't looked for that info in years
    - marcus0x62 3y ago
      The deadline has been pushed to May 7, 2025.
- photonerd 3y ago
  > We just don’t the government enough to let them track us everywhere. Eh, that’s the pseudo-libertarian objection (which is… dumb as bricks, practically speaking) but the most common objection is one of access. Until IDs are both free AND easy to obtain in the US (if you think they are, congrats: you’re in the lucky group) then a national id scheme will always be a non-starter. IDs face the same problem voting has in recent years (and historically): the systems of power use limiting access as a tool to control those they don’t like.
AnthonyMouse 3y ago
If the government wants to do something they should publish open source code that implements a sane authentication system, and then have no part of operating it whatsoever. If it's good and free people will use it voluntarily. If it isn't then you certainly don't want the same people implementing anything mandatory.
- rkeene2 3y ago
  The best part is that the US Government already did this -- it runs the second largest PKI. Second only to the Internet. It has issued more than 20 million certificates to individuals.
  - ethbr1 3y ago
    For those curious: https://public.cyber.mil/pki-pke/interoperability/ https://public.cyber.mil/pki-pke/interoperability/ Or in visual form: https://dl.dod.cyber.mil/wp-content/uploads/pki-pke/img/fed_crosscert.jpg https://dl.dod.cyber.mil/wp-content/uploads/pki-pke/img/fed_...
  - AnthonyMouse 3y ago
    That's the part you don't want them to do though. Centralized PKI is bad for privacy and creates a single point of compromise. You don't want this, but for the whole population: https://en.wikipedia.org/wiki/Office_of_Personnel_Management_data_breach https://en.wikipedia.org/wiki/Office_of_Personnel_Management... What you want is some well-reviewed code that a bank or utility company can "apt install" onto their server and get secure decentralized web authentication working in five minutes instead of leaving them to create some custom in-house contraption designed by a rotating committee of middle managers. And they should really endeavor to break that PKI thing into smaller, independent, less centralized pieces. It's way too big as it is. There appears to be something called "Symantec" between "Federal Bridge" and "US Senate" and then another "Symantec" between "Federal Bridge" and "Naval Reactors" -- that doesn't seem great.
matheusmoreira 3y ago
> no side trusts the other to manage crypto or computer systems Nor should they. Too much power for governments to have. Every so often some news gets posted here about some government official who just does not give a shit about people's rights, you can actually feel the contempt when you read what they say. Government solutions are non-solutions. We should solve these problems with ubiquitous technology or not solve them at all.
- hahn-kev 3y ago
  Except our only solution to this problem today IS government provided already (ID SSN or Passport).
  - matheusmoreira 3y ago
    Which is dehumanizing. We are not cattle to be identified and marked.
    - raffraffraff 3y ago
      Interesting. How do you identify criminals. Or for that matter, how do you identify anyone? "Just don't" or ... Some other solution?
      - duggan 3y ago
        I assume their version involves another individual unaffiliated with government or private industry taking their hand, gazing meaningfully into their eyes, and tearfully proclaiming “I see you” before letting them through the border or into the bank vault or whatever.
    - photonerd 3y ago
      Ah so you are the man with no name, I assume?
      - matheusmoreira 3y ago
ExoticPearTree 3y ago
> I’m so envious of the Baltic’s use of technology at the institutional level. You shouldn't. I don't know if anything changed in the last few years, but having to insert your ID into a card reader is very cumbersome from a user experience perspective. Especially since the world is moving away from having to plug stuff into computers.

NavinF 3y ago

tbh I can't think of many cases where I'd want state-issued PKI. I already use public key crypto secured by biometrics (faceid) to make payments, login to my bank, etc. None of that requires interacting with the state. For most normal computer use I quite like how random social media sites can't demand my identity because it'd be too expensive for them to verify it using public records.

labster 3y ago

The USA was distrustful of national ID cards decades before the current level of hyperpartisan rancor. We just don’t the government enough to let them track us everywhere. Not that the current climate helps. The REAL ID Act of 2005 has been delayed so many times, now to 2025. Maybe we should just repeal it instead.

xp84 3y ago
> We just don’t the government enough to let them track us everywhere. That statement is both true and emblematic of the problem. Everyone is so cynical that a clean public-key, offline, certificate-based solution, with an absolute zero visibility to the government of who is doing what, would always be assumed to be part of some nefarious Illuminati/Democrat/Republican plot. Proving it to people with technical tests wouldn't prove it. They'll always be convinced. What we need from the government is so minimal really, just to sign certificates if we prove our identity. But it'll never happen in the US due to the distrust situation.
- jimmydorry 3y ago
  Because there has never been a proposal for a "clean public-key / offline / certificate-based solution". It's always a central database that also does x and y and will be available for w and z departments to do as they will with it.
  - xp84 3y ago
    It doesn’t matter though, because the percentage of Americans who can understand public key crypto even in a vague way sufficient to critically read a technical analysis and judge it to be true, you could count on one hand. Nobody has proposed it because if any politicians have seen such a proposal on their desks, even if they themselves grasp it (unlikely), they know most Americans would freak out on principle.
- mindslight 3y ago
  Why are you talking about hypotheticals and abstract "distrust" ? We're already being harmed by existing central ID systems - social security numbers and drivers license numbers - with little hope for reform in sight. If there were something like the GDPR that prohibited companies from nonconsensually demanding, storing, or using these identifiers for anything but their bona fide governmental functions, then it might make sense to talk about adding a new system. But until the government is capable of reigning in abuse of the existing systems, any new identification system would inevitably be a gift to the surveillance companies.
sangnoir 3y ago
> The REAL ID Act of 2005 has been delayed so many times, now to 2025 Can one fly without a REAL-ID-compliant license or ID?
- dgoldstein0 3y ago
  Yes, with a passport you can ... Probably not what you were trying to ask. I thought the deadline passed for using real ID for TSA but I haven't looked for that info in years
  - marcus0x62 3y ago
    The deadline has been pushed to May 7, 2025.
photonerd 3y ago
> We just don’t the government enough to let them track us everywhere. Eh, that’s the pseudo-libertarian objection (which is… dumb as bricks, practically speaking) but the most common objection is one of access. Until IDs are both free AND easy to obtain in the US (if you think they are, congrats: you’re in the lucky group) then a national id scheme will always be a non-starter. IDs face the same problem voting has in recent years (and historically): the systems of power use limiting access as a tool to control those they don’t like.

AnthonyMouse 3y ago

If the government wants to do something they should publish open source code that implements a sane authentication system, and then have no part of operating it whatsoever. If it's good and free people will use it voluntarily. If it isn't then you certainly don't want the same people implementing anything mandatory.

rkeene2 3y ago
The best part is that the US Government already did this -- it runs the second largest PKI. Second only to the Internet. It has issued more than 20 million certificates to individuals.
- ethbr1 3y ago
  For those curious: https://public.cyber.mil/pki-pke/interoperability/ https://public.cyber.mil/pki-pke/interoperability/ Or in visual form: https://dl.dod.cyber.mil/wp-content/uploads/pki-pke/img/fed_crosscert.jpg https://dl.dod.cyber.mil/wp-content/uploads/pki-pke/img/fed_...
- AnthonyMouse 3y ago
  That's the part you don't want them to do though. Centralized PKI is bad for privacy and creates a single point of compromise. You don't want this, but for the whole population: https://en.wikipedia.org/wiki/Office_of_Personnel_Management_data_breach https://en.wikipedia.org/wiki/Office_of_Personnel_Management... What you want is some well-reviewed code that a bank or utility company can "apt install" onto their server and get secure decentralized web authentication working in five minutes instead of leaving them to create some custom in-house contraption designed by a rotating committee of middle managers. And they should really endeavor to break that PKI thing into smaller, independent, less centralized pieces. It's way too big as it is. There appears to be something called "Symantec" between "Federal Bridge" and "US Senate" and then another "Symantec" between "Federal Bridge" and "Naval Reactors" -- that doesn't seem great.

matheusmoreira 3y ago

> no side trusts the other to manage crypto or computer systems Nor should they. Too much power for governments to have. Every so often some news gets posted here about some government official who just does not give a shit about people's rights, you can actually feel the contempt when you read what they say. Government solutions are non-solutions. We should solve these problems with ubiquitous technology or not solve them at all.

hahn-kev 3y ago
Except our only solution to this problem today IS government provided already (ID SSN or Passport).
- matheusmoreira 3y ago
  Which is dehumanizing. We are not cattle to be identified and marked.
  - raffraffraff 3y ago
    Interesting. How do you identify criminals. Or for that matter, how do you identify anyone? "Just don't" or ... Some other solution?
    - duggan 3y ago
      I assume their version involves another individual unaffiliated with government or private industry taking their hand, gazing meaningfully into their eyes, and tearfully proclaiming “I see you” before letting them through the border or into the bank vault or whatever.
  - photonerd 3y ago
    Ah so you are the man with no name, I assume?
    - matheusmoreira 3y ago

ExoticPearTree 3y ago

> I’m so envious of the Baltic’s use of technology at the institutional level. You shouldn't. I don't know if anything changed in the last few years, but having to insert your ID into a card reader is very cumbersome from a user experience perspective. Especially since the world is moving away from having to plug stuff into computers.