16 ms·

This is about proving identity online across the EU. Most plastic national IDs obviously don’t work for EU-wide online uses because not all EU identity cards ha

This is about proving identity online across the EU. Most plastic national IDs obviously don’t work for EU-wide online uses because not all EU identity cards have a corresponding smartcard chip, and there would not be a standardized system without an EU-level decision like the one discussed here. When eID has been rolled out at the national level, it allows you to log into, say, your tax account or social-security account by simply logging into your bank. Your bank was already compelled to do all the work of vetting your identity, so the state trusts the bank to pass on your authentication.

expertentipp 3y ago
> Your bank was already compelled to do all the work of vetting your identity, so the state trusts the bank to pass on your authentication. Long time ago I thought it's an okayish idea, but to think of it... banks and governments are separate entities with not exactly overlapping interests. Lots of heavyweight lobbying happening. Many of their interests are not in favour of an individual. I don't want to connect dots for them, it's not going to work in my favour. Ideally the only data shared between banks and governments regarding a law-abiding citizen would be only an IBAN.
AnthonyMouse 3y ago
> Most plastic national IDs obviously don’t work for EU-wide online uses because not all EU identity cards have a corresponding smartcard chip This is a good thing. It should be inconvenient to authenticate real identities over the internet because otherwise it will be used for tracking. Meanwhile there is no real problem with doing a one-time account creation with your bank or social security administration in person for the few things that actually need it.
- V__ 3y ago
  > It should be inconvenient to authenticate real identities over the internet because otherwise it will be used for tracking. Depends on how it is implemented.
  - AnthonyMouse 3y ago
    It doesn't. Once you're required to give your name, there will be political pressure to create a process for associating the name with whatever you did in the event that you did something "bad" and then tracking infrastructure will be tacked on regardless of whether it was in the original system. Meanwhile the more convenient it is, the more websites will use it, but there are people who won't risk giving their name because they're a persecuted minority. So they get excluded from spaces they can currently exist unless they put their lives at risk by hoping that the security of the system holds even though it was designed by committee and implemented by the lowest bidder. It's still tracking even if you're not supposed to store the information, when there is no way for the client to verify that.
    - V__ 3y ago
      That is a bad implementation, then. You could just as well design a system, where the only parties involved are the person and the party asking for identification. The only way to then track behavior would be to be embedded at every single business, etc. Take the German eID system, for example. Every national ID thus person has a signed certificate on the ID chip. Let's say a porn site wants to know you are over 18. They ask you to provide this. The chip response with a signed yes. No name, no other data. The site checks if the certificate is signed correctly but doesn't know anything else about you. The government also doesn't know anything about your behavior.
      - zeeZ 3y ago
        Documentation: https://www.bsi.bund.de/dok/TR-03130 https://www.bsi.bund.de/dok/TR-03130 https://www.bsi.bund.de/dok/TR-03124 https://www.bsi.bund.de/dok/TR-03124 The individual specification PDFs are in English.
      - AnthonyMouse 3y ago
        > Every national ID thus person has a signed certificate on the ID chip. Let's say a porn site wants to know you are over 18. They ask you to provide this. The chip response with a signed yes. No name, no other data. The site checks if the certificate is signed correctly but doesn't know anything else about you. The government also doesn't know anything about your behavior. If the government knows when or how often you're requesting/generating a signature, you have a timing attack that allows use of the service to be correlated with the signatures. If anyone can generate completely anonymous signatures that no one can ever trace back to them then the system is pointless because someone will set up a service that will sign for anyone and there is no way to know who is operating it. You can't know how old someone is without knowing who they are. Otherwise they can just use someone else's ID.
- OfSanguineFire 3y ago
  > doing a one-time account creation with your bank or social security administration in person You think people like going to a government office and standing in a queue forever? The whole purpose of this stuff is to reduce hassles that people commonly complain about. Especially when dealing with tax and social security, it is a point in many countries’ favor for entrepreneurs that, thanks to eID through the bank, you can run your whole business without having to visit the office in person. As far as tracking concerns, those were already dealt with during the long period that this legislation was being drafted.
  - AnthonyMouse 3y ago
    > You think people like going to a government office and standing in a queue forever? You do it once in your life. Then you have a sign on to the social security website and never have to go back to the office. It's not that bad. > As far as tracking concerns, those were already dealt with during the long period that this legislation was being drafted. It isn't possible to deal with them except by not building the system. Its existence is the vulnerability.
    - OfSanguineFire 3y ago
      > You do it once in your life. This discussion is about the EU, a region well known for mobility. People commonly have to do this more than once, whether they are moving to another country or only registering a business there. In-person visits to offices in other EU countries can, besides the usual hassles of waiting in queues, involve annoyances of unfamiliar language or culture. All this stuff already exists at the national level, and ordinary people have overwhelmingly found it convenient and time-saving. This legislation simply ensures that it works EU-wide so that it can solve the inconveniences that arise at that level.
      - AnthonyMouse 3y ago
        So you're saying what the EU needs is not this but rather the Full Faith and Credit clause. But that still doesn't seem like a real justification. How often do people actually move? Once every five or ten years? Even if it was every year, going to the local government office to show them your ID and set up an account once a year is hardly an ordeal, and you shouldn't even need to talk to them. Just print out a form from the website -- in your own language -- and show them your ID when you hand it to them.
- dkjaudyeqooe 3y ago
  > Meanwhile there is no real problem with doing a one-time account creation with your bank or social security administration in person for the few things that actually need it. How the fuck would you know? I live in a country where I don't speak the local language and on an island in the Adriatic sea. Dealing with banks and government online is a godsend. I use Google translate. I don't even have to get out of bed.
  - AnthonyMouse 3y ago
    And yet you're doing it already, before the centralized identity system is active. Because you don't actually need it for that after you've created your account with whoever it is you're interacting with.

expertentipp 3y ago

> Your bank was already compelled to do all the work of vetting your identity, so the state trusts the bank to pass on your authentication. Long time ago I thought it's an okayish idea, but to think of it... banks and governments are separate entities with not exactly overlapping interests. Lots of heavyweight lobbying happening. Many of their interests are not in favour of an individual. I don't want to connect dots for them, it's not going to work in my favour. Ideally the only data shared between banks and governments regarding a law-abiding citizen would be only an IBAN.

AnthonyMouse 3y ago

> Most plastic national IDs obviously don’t work for EU-wide online uses because not all EU identity cards have a corresponding smartcard chip This is a good thing. It should be inconvenient to authenticate real identities over the internet because otherwise it will be used for tracking. Meanwhile there is no real problem with doing a one-time account creation with your bank or social security administration in person for the few things that actually need it.

V__ 3y ago
> It should be inconvenient to authenticate real identities over the internet because otherwise it will be used for tracking. Depends on how it is implemented.
- AnthonyMouse 3y ago
  It doesn't. Once you're required to give your name, there will be political pressure to create a process for associating the name with whatever you did in the event that you did something "bad" and then tracking infrastructure will be tacked on regardless of whether it was in the original system. Meanwhile the more convenient it is, the more websites will use it, but there are people who won't risk giving their name because they're a persecuted minority. So they get excluded from spaces they can currently exist unless they put their lives at risk by hoping that the security of the system holds even though it was designed by committee and implemented by the lowest bidder. It's still tracking even if you're not supposed to store the information, when there is no way for the client to verify that.
  - V__ 3y ago
    That is a bad implementation, then. You could just as well design a system, where the only parties involved are the person and the party asking for identification. The only way to then track behavior would be to be embedded at every single business, etc. Take the German eID system, for example. Every national ID thus person has a signed certificate on the ID chip. Let's say a porn site wants to know you are over 18. They ask you to provide this. The chip response with a signed yes. No name, no other data. The site checks if the certificate is signed correctly but doesn't know anything else about you. The government also doesn't know anything about your behavior.
    - zeeZ 3y ago
      Documentation: https://www.bsi.bund.de/dok/TR-03130 https://www.bsi.bund.de/dok/TR-03130 https://www.bsi.bund.de/dok/TR-03124 https://www.bsi.bund.de/dok/TR-03124 The individual specification PDFs are in English.
    - AnthonyMouse 3y ago
      > Every national ID thus person has a signed certificate on the ID chip. Let's say a porn site wants to know you are over 18. They ask you to provide this. The chip response with a signed yes. No name, no other data. The site checks if the certificate is signed correctly but doesn't know anything else about you. The government also doesn't know anything about your behavior. If the government knows when or how often you're requesting/generating a signature, you have a timing attack that allows use of the service to be correlated with the signatures. If anyone can generate completely anonymous signatures that no one can ever trace back to them then the system is pointless because someone will set up a service that will sign for anyone and there is no way to know who is operating it. You can't know how old someone is without knowing who they are. Otherwise they can just use someone else's ID.
OfSanguineFire 3y ago
> doing a one-time account creation with your bank or social security administration in person You think people like going to a government office and standing in a queue forever? The whole purpose of this stuff is to reduce hassles that people commonly complain about. Especially when dealing with tax and social security, it is a point in many countries’ favor for entrepreneurs that, thanks to eID through the bank, you can run your whole business without having to visit the office in person. As far as tracking concerns, those were already dealt with during the long period that this legislation was being drafted.
- AnthonyMouse 3y ago
  > You think people like going to a government office and standing in a queue forever? You do it once in your life. Then you have a sign on to the social security website and never have to go back to the office. It's not that bad. > As far as tracking concerns, those were already dealt with during the long period that this legislation was being drafted. It isn't possible to deal with them except by not building the system. Its existence is the vulnerability.
  - OfSanguineFire 3y ago
    > You do it once in your life. This discussion is about the EU, a region well known for mobility. People commonly have to do this more than once, whether they are moving to another country or only registering a business there. In-person visits to offices in other EU countries can, besides the usual hassles of waiting in queues, involve annoyances of unfamiliar language or culture. All this stuff already exists at the national level, and ordinary people have overwhelmingly found it convenient and time-saving. This legislation simply ensures that it works EU-wide so that it can solve the inconveniences that arise at that level.
    - AnthonyMouse 3y ago
      So you're saying what the EU needs is not this but rather the Full Faith and Credit clause. But that still doesn't seem like a real justification. How often do people actually move? Once every five or ten years? Even if it was every year, going to the local government office to show them your ID and set up an account once a year is hardly an ordeal, and you shouldn't even need to talk to them. Just print out a form from the website -- in your own language -- and show them your ID when you hand it to them.
dkjaudyeqooe 3y ago
> Meanwhile there is no real problem with doing a one-time account creation with your bank or social security administration in person for the few things that actually need it. How the fuck would you know? I live in a country where I don't speak the local language and on an island in the Adriatic sea. Dealing with banks and government online is a godsend. I use Google translate. I don't even have to get out of bed.
- AnthonyMouse 3y ago
  And yet you're doing it already, before the centralized identity system is active. Because you don't actually need it for that after you've created your account with whoever it is you're interacting with.