4 ms·

Very cool, I hope this gets widespread enough to become the default way to prove identity online. I know a lot of people are very concerned about preserving th

Very cool, I hope this gets widespread enough to become the default way to prove identity online. I know a lot of people are very concerned about preserving the right to be anonymous, but it should be equally concerning that it's difficult to not be anonymous without involving a giant corporation. Would it be too much to ask for a Keybase style app on top of this? One can hope...

AdamJacobMuller 3y ago
That was my first thought with too. I hope it doesn't become the default for most sites (which have no need for your actual identity) but for many use cases I can see the need for varying levels of identity tied to your real identity. Minimally, login.gov could issue a (globally) unique token which they will only issue one per user per site, which would effectively allow the site to enforce a 1:1 human:account ratio (or at least know which accounts are linked to which humans) without disclosing any actual details of the human.
- tzs 3y ago
  > I hope it doesn't become the default for most sites (which have no need for your actual identity) but for many use cases I can see the need for varying levels of identity tied to your real identity Varying levels is probably the right approach. For most sites all they need to know when I create an account is that I control the email address that I am using to sign up. If I ever again need to prove my identity to them proving that I receive email at that address is good enough. For the site that provides my email address they need something other than email to identify me. If I'm using an email provider that lets you bring your own domain, they could use proof that I control the DNS for that domain as proof of identity. How to prove identity to my domain registrar? I could use an email address that is not hosted somewhere that depends on my proof of domain ownership, like gmail or my ISP, but that is probably not a good idea. Ultimately, my ability to prove my identity at most sites would depend on proving identity to my domain registrar (or to my email host if I don't have my own domain), and so making that depend on remaining in good standing with Google might not be wise. What we need for proving identity to a domain register (or an email provider if you don't have your own domain) is something that we can be sure we can rely on, because in the worst case when you've been massively hacked and your identity has been stolen at multiple sites and services that is going to be the identity proof you count on to let you recover everything else. For that something like the USPS identity service would be great.
TheHappyOddish 3y ago
95% of the worlds population are not in the US, and I expect most of us have no interest in handing our personal data over to an entity that had proven over and over it can't even avoid abusing its own citizens data, let alone foreigners.
ratg13 3y ago
The system only works for US residents. If you’re a US citizen that resides abroad, you’re already denied a login. It’s a good start, but it’s a long way from being a “default”

AdamJacobMuller 3y ago

That was my first thought with too. I hope it doesn't become the default for most sites (which have no need for your actual identity) but for many use cases I can see the need for varying levels of identity tied to your real identity. Minimally, login.gov could issue a (globally) unique token which they will only issue one per user per site, which would effectively allow the site to enforce a 1:1 human:account ratio (or at least know which accounts are linked to which humans) without disclosing any actual details of the human.

tzs 3y ago
> I hope it doesn't become the default for most sites (which have no need for your actual identity) but for many use cases I can see the need for varying levels of identity tied to your real identity Varying levels is probably the right approach. For most sites all they need to know when I create an account is that I control the email address that I am using to sign up. If I ever again need to prove my identity to them proving that I receive email at that address is good enough. For the site that provides my email address they need something other than email to identify me. If I'm using an email provider that lets you bring your own domain, they could use proof that I control the DNS for that domain as proof of identity. How to prove identity to my domain registrar? I could use an email address that is not hosted somewhere that depends on my proof of domain ownership, like gmail or my ISP, but that is probably not a good idea. Ultimately, my ability to prove my identity at most sites would depend on proving identity to my domain registrar (or to my email host if I don't have my own domain), and so making that depend on remaining in good standing with Google might not be wise. What we need for proving identity to a domain register (or an email provider if you don't have your own domain) is something that we can be sure we can rely on, because in the worst case when you've been massively hacked and your identity has been stolen at multiple sites and services that is going to be the identity proof you count on to let you recover everything else. For that something like the USPS identity service would be great.

TheHappyOddish 3y ago

95% of the worlds population are not in the US, and I expect most of us have no interest in handing our personal data over to an entity that had proven over and over it can't even avoid abusing its own citizens data, let alone foreigners.

ratg13 3y ago

The system only works for US residents. If you’re a US citizen that resides abroad, you’re already denied a login. It’s a good start, but it’s a long way from being a “default”