4 ms·

Of course there is no text so it’s difficult to know exactly what is happening. But, a digital ID (we have DigiD in the Netherlands) is quite handy for anything

Of course there is no text so it’s difficult to know exactly what is happening. But, a digital ID (we have DigiD in the Netherlands) is quite handy for anything government concerned. Of course if ever a service like Facebook would start to use it, I will stay very far away from it. But it’s nice that my taxes, pension, healthcare etc is all available under 1 “account” (one identity). It does perhaps open the door to nefarious things but I don’t really see it? At least not from this text. We do really need more transparency I agree there.

alkonaut 3y ago
Yeah having government services done online but NOT having a reasonable e-ID seems like a recipe for disaster. I mean how do you validate your identity if you log in to e.g. do your taxes? I guess each authority could send out some validation code (e.g. tax authority could send out a code on a paper slip with the tax info). But that still feels a bit insecure if that's the only thing validated.
bradley13 3y ago
What you say is true. However, the dangers are at least as large as the benefits. There are two kinds of danger that we need to keep in mind. First, and most obvious, is hacking. Government services are hacked as least as often as private services. If all of your information is centrally accessible under a single ID, that is a single point of serious danger. Second, we tend to think of government as a monolithic organization. It is not - government is made up of people. Some good, some evil, most just trying to get through the day. There have been plenty of cases of individuals, with government access, avenging themselves on their ex-spouses, on their rivals, or on people they just don't like. Centralized access to all your government services makes you much more vulnerable to such attacks. That's not so say a centralized ID is a bad idea. However, we need to be aware of the associated problems, and ensure that there is security, and that mitigations are already planned in advance for when (not if) a security breech occurs.
- hcfman 3y ago
  A big problem with government having large power is that there is absolutely not repercussions for abuse and absolutely no functional way to address any abuse of power if discovered. The Dutch government used a neighbor of mine in a drastically illegal way, faciliating criminality by proxy (Through the neighbor) and protecting said neighbor for more than 10 years. They call it an "intervention" and it's intended to be actions to interfere with organised crime. However, I was simply literally living between the civilian that this proxy intervention was being carried out and the person that once way back in 1995 was arrested and convicted for growing hennep. I became a target of this "intervention" simply because I objected to the collateral harrassment. Not a simple safe guard succeeded. Every government department simply ignored my formal complaints. The police turned off all response to my calls simply because the public prosecutor told them to. I had to force my stalking case to caught by means of the national ombudsman and it took 5 years to get it to court. Then the prosecutors involved got involved in this caught case and made it fail. The main prosecutor was in fact pretending to prosecute someone for stalking that was his own illegally run informant. The other prosecutor moved to a position on the board of directors of the court of Maastricht so that they could interfere with the prosecution both directly by the prosecutor and behind the scenes. The one interfering behind the scenes is now the president of the court of Maastrict. I filed police charges against one of the prosecutors. They simply refused to accept the evidence. I appealed and the attorney general simply ignored and refused to comment on the evidence. If there is absolutely no functional safe guards for abuse, laws with this sort of power simply should not be passed!!
Dries007 3y ago
Facebook etc are simply not allowed to use it. At least in Belgium, by law, you cannot require people to use their ID, or even ask to show it, without legal authority. Some stores will ask to scan your ID for loyalty points, but they're not allowed to treat you differently if you refuse, so normally you can also just tell them your info if you want to participate. Source (unfortunately not available in English): https://www.gegevensbeschermingsautoriteit.be/professioneel/thema-s/eid https://www.gegevensbeschermingsautoriteit.be/professioneel/... Our eIDs have PIN secured digital certificates that can be used to sign documents with legal authority or confirm identity. They use some open smartcard standard and there is open source Linux software available. The downside is that a card reader is required, so they commissioned the "itsme" system that largely replaces that system with a smartphone app. The itsme authorization system can be used by most places online that require a secure identity based login like banks, HR, taxes, healthcare (state & private), pension, ... while the eID remains for use in-person. You cannot simply sign up to itsme as a developer without a valid reason. I like this system a lot. It's relatively simple and easy to use. Even my grandparents, who used to have to ask "the young people", can now manage most of their own affairs on a tablet.
- WirelessGigabit 3y ago
  Itsme is private. myid.be is the non private variant. Very annoying when itsme came out, it still isn't available in the USA, where I live. myid.be on the other hand is available in the US app store.
Vinnl 3y ago
There are bits of a leaked text: https://scotthelme.co.uk/what-the-qwac/ https://scotthelme.co.uk/what-the-qwac/ The concerns are about a specific article (Article 45) that prevents browsers from removing government certificates even if they are found to be malicious - not the concept of a digital ID in general. Digital IDs can still be implemented without that requirement - the certificates just have to make sure they hold themselves to the standards that browsers require of them.

alkonaut 3y ago

Yeah having government services done online but NOT having a reasonable e-ID seems like a recipe for disaster. I mean how do you validate your identity if you log in to e.g. do your taxes? I guess each authority could send out some validation code (e.g. tax authority could send out a code on a paper slip with the tax info). But that still feels a bit insecure if that's the only thing validated.

bradley13 3y ago

What you say is true. However, the dangers are at least as large as the benefits. There are two kinds of danger that we need to keep in mind. First, and most obvious, is hacking. Government services are hacked as least as often as private services. If all of your information is centrally accessible under a single ID, that is a single point of serious danger. Second, we tend to think of government as a monolithic organization. It is not - government is made up of people. Some good, some evil, most just trying to get through the day. There have been plenty of cases of individuals, with government access, avenging themselves on their ex-spouses, on their rivals, or on people they just don't like. Centralized access to all your government services makes you much more vulnerable to such attacks. That's not so say a centralized ID is a bad idea. However, we need to be aware of the associated problems, and ensure that there is security, and that mitigations are already planned in advance for when (not if) a security breech occurs.

hcfman 3y ago
A big problem with government having large power is that there is absolutely not repercussions for abuse and absolutely no functional way to address any abuse of power if discovered. The Dutch government used a neighbor of mine in a drastically illegal way, faciliating criminality by proxy (Through the neighbor) and protecting said neighbor for more than 10 years. They call it an "intervention" and it's intended to be actions to interfere with organised crime. However, I was simply literally living between the civilian that this proxy intervention was being carried out and the person that once way back in 1995 was arrested and convicted for growing hennep. I became a target of this "intervention" simply because I objected to the collateral harrassment. Not a simple safe guard succeeded. Every government department simply ignored my formal complaints. The police turned off all response to my calls simply because the public prosecutor told them to. I had to force my stalking case to caught by means of the national ombudsman and it took 5 years to get it to court. Then the prosecutors involved got involved in this caught case and made it fail. The main prosecutor was in fact pretending to prosecute someone for stalking that was his own illegally run informant. The other prosecutor moved to a position on the board of directors of the court of Maastricht so that they could interfere with the prosecution both directly by the prosecutor and behind the scenes. The one interfering behind the scenes is now the president of the court of Maastrict. I filed police charges against one of the prosecutors. They simply refused to accept the evidence. I appealed and the attorney general simply ignored and refused to comment on the evidence. If there is absolutely no functional safe guards for abuse, laws with this sort of power simply should not be passed!!

Dries007 3y ago

Facebook etc are simply not allowed to use it. At least in Belgium, by law, you cannot require people to use their ID, or even ask to show it, without legal authority. Some stores will ask to scan your ID for loyalty points, but they're not allowed to treat you differently if you refuse, so normally you can also just tell them your info if you want to participate. Source (unfortunately not available in English): https://www.gegevensbeschermingsautoriteit.be/professioneel/thema-s/eid https://www.gegevensbeschermingsautoriteit.be/professioneel/... Our eIDs have PIN secured digital certificates that can be used to sign documents with legal authority or confirm identity. They use some open smartcard standard and there is open source Linux software available. The downside is that a card reader is required, so they commissioned the "itsme" system that largely replaces that system with a smartphone app. The itsme authorization system can be used by most places online that require a secure identity based login like banks, HR, taxes, healthcare (state & private), pension, ... while the eID remains for use in-person. You cannot simply sign up to itsme as a developer without a valid reason. I like this system a lot. It's relatively simple and easy to use. Even my grandparents, who used to have to ask "the young people", can now manage most of their own affairs on a tablet.

WirelessGigabit 3y ago
Itsme is private. myid.be is the non private variant. Very annoying when itsme came out, it still isn't available in the USA, where I live. myid.be on the other hand is available in the US app store.

Vinnl 3y ago

There are bits of a leaked text: https://scotthelme.co.uk/what-the-qwac/ https://scotthelme.co.uk/what-the-qwac/ The concerns are about a specific article (Article 45) that prevents browsers from removing government certificates even if they are found to be malicious - not the concept of a digital ID in general. Digital IDs can still be implemented without that requirement - the certificates just have to make sure they hold themselves to the standards that browsers require of them.