3 ms·

That was my first thought with too. I hope it doesn't become the default for most sites (which have no need for your actual identity) but for many use cases I

That was my first thought with too. I hope it doesn't become the default for most sites (which have no need for your actual identity) but for many use cases I can see the need for varying levels of identity tied to your real identity. Minimally, login.gov could issue a (globally) unique token which they will only issue one per user per site, which would effectively allow the site to enforce a 1:1 human:account ratio (or at least know which accounts are linked to which humans) without disclosing any actual details of the human.

tzs 3y ago
> I hope it doesn't become the default for most sites (which have no need for your actual identity) but for many use cases I can see the need for varying levels of identity tied to your real identity Varying levels is probably the right approach. For most sites all they need to know when I create an account is that I control the email address that I am using to sign up. If I ever again need to prove my identity to them proving that I receive email at that address is good enough. For the site that provides my email address they need something other than email to identify me. If I'm using an email provider that lets you bring your own domain, they could use proof that I control the DNS for that domain as proof of identity. How to prove identity to my domain registrar? I could use an email address that is not hosted somewhere that depends on my proof of domain ownership, like gmail or my ISP, but that is probably not a good idea. Ultimately, my ability to prove my identity at most sites would depend on proving identity to my domain registrar (or to my email host if I don't have my own domain), and so making that depend on remaining in good standing with Google might not be wise. What we need for proving identity to a domain register (or an email provider if you don't have your own domain) is something that we can be sure we can rely on, because in the worst case when you've been massively hacked and your identity has been stolen at multiple sites and services that is going to be the identity proof you count on to let you recover everything else. For that something like the USPS identity service would be great.

tzs 3y ago

> I hope it doesn't become the default for most sites (which have no need for your actual identity) but for many use cases I can see the need for varying levels of identity tied to your real identity Varying levels is probably the right approach. For most sites all they need to know when I create an account is that I control the email address that I am using to sign up. If I ever again need to prove my identity to them proving that I receive email at that address is good enough. For the site that provides my email address they need something other than email to identify me. If I'm using an email provider that lets you bring your own domain, they could use proof that I control the DNS for that domain as proof of identity. How to prove identity to my domain registrar? I could use an email address that is not hosted somewhere that depends on my proof of domain ownership, like gmail or my ISP, but that is probably not a good idea. Ultimately, my ability to prove my identity at most sites would depend on proving identity to my domain registrar (or to my email host if I don't have my own domain), and so making that depend on remaining in good standing with Google might not be wise. What we need for proving identity to a domain register (or an email provider if you don't have your own domain) is something that we can be sure we can rely on, because in the worst case when you've been massively hacked and your identity has been stolen at multiple sites and services that is going to be the identity proof you count on to let you recover everything else. For that something like the USPS identity service would be great.