19 ms·

There is no good identity. Emails change, people lose access to old emails. People dislike usernames, they want to be able to choose non-unique ones rather th

• prepend 3y ago
  I think email plus a robust protocol for resolving changes works as good as can get. For important stuff like banks and pensions they also have phone and physical address, so there’s a way to reconcile things like email changes, as rare as they are.
  • toomuchtodo 3y ago
    US example. Financial services orgs have your social security number. Perhaps they should be able to forward a message to the US gov to forward it to the citizen stakeholder through a government messaging delivery platform. This ensures continuity of communication but does not allow orgs to lookup emails with loose data governance (and all that leads to). Login.gov is very good from a federal gov idp perspective, and I’m hoping it slowly develops into supporting a national ID and ubiquitous identity proofing to squash identity fraud but also streamline gov digital service delivery.
    • _kb 3y ago
      This is very similar to what's happening with the Australian Digital ID Bill [0]. [0]: https://www.digitalidentity.gov.au/digital-id-bill https://www.digitalidentity.gov.au/digital-id-bill
    • tacocataco 3y ago
      I'm surprised the USPS doesn't offer email addresses. Seems pretty in line with what they do.
• MasterYoda900 3y ago
  What if every newborn received a chip implant under the skin (cryptographically unbreakable, unauthorized removal punishable by law), linked to a central government database with the chip’s unique identifier and a profile of the newborn’s DNA signature?
  • Joker_vD 3y ago
    There are reasons why SSN or its equivalents are unpopular as web identities. Can you enumerate those reasons?
    • tuwtuwtuwtuw 3y ago
      Where I live the SSN-equivalent is extremely popular as web identity. Can you explain why it shouldn't be?
      • lcnPylGDnU4H9OF 3y ago
        Not sure about where you’re from but US institutions often treat the SSN as a secret which should allow account access. Which it’s not by design but nobody wanted to make a better system; it’s why banks have claimed that they are not defrauded by people and instead the fraudsters “steal identities”. To answer the question more directly, it’s treating the identifier like a password that is problematic.
        • maxcoder4 3y ago
          Of course this is extremely stupid (basically using the "username" as a secret, something everyone in IT and itsec knows not to do). If we started using SSN-equivalent identifiers as online ID problem would solve itself because by then they're not a secret anymore. In my country my national ID numbers are nowhere near as problematic as SSN on the US (from what I understand).
        • tuwtuwtuwtuw 3y ago
          Okay, but that is then about authorization and not about "identity". I agree that treating it as a secret is a bad idea. The person said SSN and equivalents, so I guess it depends on what is meant by equivalents. Where I live my personal number is used as identity, but to actually prove I am the owner of it another mechanism is used (private keys embedded in certs). The personal number is very public info by design and can't be used as a secret.
• api 3y ago
  I usually dislike the idea of inviting government into this space, but if there's anything that governments have traditionally done decently well and should do (it's usually within their mission statement) its identity. Passports are really the primary identity layer of Earth. Ideally in a perfect world we'd have governments run OIDC systems similar to the US login.gov and these would delegate from an international master OIDC system at the UN. Everyone would have their citizenship passport ID and their UN ID, and the latter could serve as a "break glass" master key to support immigration and also limit the ability of countries to "digital death penalty" people. I can think of some dystopian outcomes here, but IMHO they are not worse than the dystopian outcomes that come from corporate monopolist control of digital identity. At least in democracies one has some nominal influence over one's government and the latter is bound by the rule of law, and if you don't live in a democracy you can (or should be able to) leave. You're right that identity is hard, and I think most of why it's hard is human rather than technical. One could create a decentralized identity layer from a block chain fairly easily but people would lose their keys etc.
  • logifail 3y ago
    > Passports are really the primary identity layer of Earth. Umm, I'm not they're not that great as a primary identity either. One edge case is that you can have have more than one valid passport for the one nationality. Another is of course that one can have more than one nationality.
    • api 3y ago
      I have a Google, Apple, Microsoft, and GitHub OIDC account among others. That's a feature not a bug.
    • paganel 3y ago
      Also, passports become useless once your government actively turns against you, see the current fate of adult Ukrainian men still residing in Ukraine. The same thing risks happening with this government-approved online identity, I mean, how will the EU bureaucrats “handle” people like me that are openly against the West’s take in Ukraine? Will we get our accounts banned from posting pro-Russia content online?
• esafak 3y ago
  > People get married, people get divorced, people transition, people move culture and choose new names... names change, and so do email addresses. Exactly the analogy I had in mind. email primary keys are "serial monogamy". Or if you want a mathematical analogy, piecewise constant :)
  • Mordisquitos 3y ago
    Speak for yourself, I'm an email polygamist!
• Solvency 3y ago
  > they want to be able to choose non-unique ones rather than end up with user53267 or something inane. Disagreed. I'm 39. I've known hundreds of people (HS, college, etc) and many close friends who willingly made email accounts like "brijacks85" (their birth year) or "sammichelson212" even when their actual names were still fully available on yahoo/gmail/hotmail, etc. I used to regularly create email accounts for these people using just their names and then ask "why didn't you just check your own name first?" and they'd usually just shrug with total indifference and never use the account I made for them.
  • buro9 3y ago
    Oh yes, some large number of people are incredibly habitual. But some also large number of people are not.
  • ForkMeOnTinder 3y ago
    I'd never use an account someone else made for me either. Who knows if after you created it, you added some recovery questions or a recovery email or saved the login cookie or who knows what else? I'll stick with my fresh account made on my own PC through my own connection, thanks.
  • mixmastamyk 3y ago
    When you get the simplest variation of a name on a popular site you’ll receive mail from all the mistaken folks who weren’t careful enough. Similarly, I get a small fraction of the mail of a texas lawyer, because her email address string is a super set of mine, and some percentage of her clients don’t bother or notice the need to add the extra suffix.
• deleted 3y ago
  [deleted]
• emilfihlman 3y ago
  This is just not true. There absolutely is a good identity, and it's one provided by countries.
  • buro9 3y ago
    maybe you are in Scandinavia, but many countries do not even have a centralised register of births, deaths, marriages... and so they do not have a centralised and canonical record of identity of all people in the country.
    • dfox 3y ago
      For example Czech republic has central register of all residents. The register is intentionally designed so that it does not provide any kind of identifier that is both long-term stable and globally meaningful (there is a number called RČ broadly equivalent to NIN in other countries, but it is not supposed to be used since 2010). Conceptually there is ZIFO (Basic ID of natural person), that should be globally unique, but this is known only to a subcomponent of the central registry that is run by different govarnment entity than rest of the system. At same time the design of that subcomponent contains provisions for allocating new ID, mainly for handling the cases when that ID was allocated wrong (both multiple IDs for one person and multiple persons sharing same ID), so even that is not necessarily stable ID. Users of that data refer to persons using AIFO, which is specific and meaningful only for particular database (called AIS) and if different databases need to identify particular person as having the same identity they have to call the central translation subcomponent (the API surfaces are designed such that the translation the calling system will not get the result of the translation, which is only sent to the destination system). Even that the AIFOs are meaningless, they are required to be not disclosed to anybody. Alternative IDs that can be used are broadly serial numbers of government issued identitty/travel documents, but these are necessarily both revocable and have limited time validity (the aforementioned technically deprecated RČ is essentially a special case of this). I believe that this design comes from some pan-EU initiative related to GDPR. For example according to Wikipedia Austria uses broadly similar, but less fine-grained system. This has interesting issue with regard to things like eIDAS as there is no sane ID that could be included in the qualified personal certificate. One Czech QCA (PostSignum) does not include any kind of personal ID in its personal certificates, second one (I.CA) can optionally include the serial number of identity document that was used for identification. Apparently you can get Swedish qualified certificate that includes Czech RČ in its CN form Zealid. You are supposed to register your certificate into the resident registry yourself, which creates the link between the certificate and your identity. The slight issue with that is that there is no sane way how a third party outside the architecture of these registers can validate that link (you can send them a signed PDF with your data from the resident register, which is apparently what you are supposed to do, but "sane" would look different).
• seydor 3y ago
  People also have a right to lose everything and start a new life. this is something that people could do just a few decades ago
  • newsclues 3y ago
    Oh really? As someone that once faced serious jail time for plants, I think that would have been a nice option, but I wasted two years of my life in court/etc.
    • micromacrofoot 3y ago
      [flagged]
      • popcalc 3y ago
        The GP didn't specify which rights they were referring to. The parent probably assumed they mean natural rights. I think that's an understandable assumption.
      • direwolf20 3y ago
        like possessing the wrong non-toxic plant
        • pc86 3y ago
          So change the law, but "this thing shouldn't be illegal" is a completely separate discussion from "breaking this law should carry no penalty."
          • fantasybroker 3y ago
            Not sure why you have such a strong opinion on this. There are countless examples of people suffering immense harm for trivial things that are considered unlawful in some jurisdictions. And no, "so change the law" is not the full answer, that's just blaming the victim.
• brewmarche 3y ago
  OIDC actually already handles this by requiring the `sub` claim to never be re-assigned and unique: https://openid.net/specs/openid-connect-core-1_0.html#IDToken https://openid.net/specs/openid-connect-core-1_0.html#IDToke... Of course this means that an ID token should not contain an e-mail address under `sub`.
  • fauigerzigerk 3y ago
    So the identity provider could just generate this unchangable ID and let the user link any number of aliases to it, right?
    • uxp8u61q 3y ago
      That is what TFA suggests, yes.
• j45 3y ago
  It’s useful to have your own domain with your own email so it stays with you as long as you like, beyond work emails. Being a tolerated guest who pays little to none in someone’s servers is another issue. Most large email providers are more like digital identity providers, and being a citizen of one of these big digital countries is neither democratic or setup for your long term preferences.
  • dotancohen 3y ago
    > It’s useful to have your own domain with your own email Until you've forgotten to renew, or were to sick too renew, or the domain is hijacked. I've had my domain for over twenty years, and I've come way too close to losing it at least twice.
    • input_sh 3y ago
      Or you decide to change the domain, but are too lazy to change the email address... everywhere, so you end up paying for 2-3 domains instead of one just for the email redirects to work.
      • dotancohen 3y ago
        Or you have financial troubles and no credit card just as you need to renew... A more permanent way to buy - not rent - domain names would solve many of these issues. And changing ownership of domains should be just as difficult as changing ownership of real estate, the only people benefiting from the current ease of changing domain ownership are speculators.
        • j45 3y ago
          There is at least one domain tld selling “lifetime” domains. I’m not sure why icann wouldn’t let anyone pay for 10-50 years for a domain.
      • j45 3y ago
        Domains can be decommissioned once no emails are coming across them, which can be reasonably tracked. I had no idea or time to figure this out and luckily we weren’t the first to come across this :)
• newsclues 3y ago
  "There is no good identity." Government has failed to adapt with modern times and technology and has failed to provide modern and secure identification and authentication services for citizens. I log in with my bank credentials to access my government tax account, talk about a total failure to do your job from the people still using SIN as an important piece of identity for some of the most important aspects of life. This is a solvable problem. Governments can adapt and use modern technology to provide identity and authentication services, but they do not. In my opinion this is a failure to be responsible for core government services, and I can only speculate why.
  • azlev 3y ago
    It would be or a chaos or very limiting expect that companies would interact with a lot of govs to get authentication. It's way cheaper leave as is.
    • LocalH 3y ago
      "Cheap" should never be the driving factor for these things.
      • jethro_tell 3y ago
        That is, in fact, the purpose of government, to do the things necessary for a functioning society for which a profit motive does not exist.
        • azlev 3y ago
          Maybe I'm mistaken but China's super apps solve this problem with profit motivation.
  • goodpoint 3y ago
    Identity is not centralized and therefore identification and accounting cannot be centralized.
  • 3y ago
• mark-r 3y ago
  I once had my email change because my ISP was bought out. Absolutely nothing I could do about it. The old email was forwarded for 12 months, then cut off completely.
  • otteromkram 3y ago
    Did you use that time to update relevant accounts? Not sure what the gripe is here, especially with a one year notification period.
    • saagarjha 3y ago
      It means you lose accounts that use the email address as your identity and don’t let you change it.
      • fshr 3y ago
        Can you give a couple examples? I can't think of any accounts that don't allow an email change.
        • saagarjha 3y ago
          Say, for example, systems that directly expose your email address as the identifier that can be used to reach you. "Send money to saagar@saagarjha.com [using our service]" kind of sites.
        • justsomehnguy 3y ago
          Not everything is a phpBB forum. Also: > Select Google Account email. If you can't open this setting, it might not be possible to change your email or username. > If your account's email address ends in @gmail.com, you usually can't change it. https://support.google.com/accounts/answer/19870 https://support.google.com/accounts/answer/19870
    • lapsed_pacifist 3y ago
      There are accounts which do not allow you to change the email the account is registered to.
• hibikir 3y ago
  My "favorite" of those email changes is the self-inflicted contractor postfix change. I've worked at places where a conversion to employee forces the creation of a completely new account, and lacking a simple, single permission systems, the act of converting means spending a good 3 weeks trying to get access to systems one had access the day before. This is extra fun when the company in question does a lot of their business offering complicated accounts to customers, and has an external facing identity solution that deals with all of this easily: just not for their own workers, including those maintaining the external-facing identity system.
  • BigTuna 3y ago
    >just not for their own workers The shoemaker's children always go barefoot
  • wlonkly 3y ago
    In a thread about email, "postfix" really threw me here! But I realize you don't mean the email server, but I'm not sure what you do mean.
• flir 3y ago
  Multiple identities at the same time, too. This is why I think email addresses are "good enough" - you can always spin up a new one for each identity you want to inhabit.
  • dcow 3y ago
    Some services explicitly want to disallow this so it’s actually an attack vector in that light.
• ianburrell 3y ago
  Also, it is good to keep concepts of account ID, public username, and login username separate. By using random account ID, can change the other values. Most accounts want email but don’t have to make it user name. Or people have multiple accounts and makes sense to have email reused. For login, it can help to have multiple methods. Then people can change from OIDC to password, or between providers.
• oooyay 3y ago
  I liked Discords old scheme where you had an email and a display name. Everyone had the numbers so they didn't matter. When they switched to unique account IDs I was kind of bummed, but I'm still curious why they switched.
  • Groxx 3y ago
    Yeah, same here. I thought it did a good job of resolving username conflicts without it really being an issue inside active social circles. Everyone can just always use their normal username, and it's only a minor friction when sharing your name outside Discord without a link or something.
  • sgjohnson 3y ago
    > but I'm still curious why they switched. Because it was trivial to impersonate someone. The old usernames supported full UTF-8, enabling a wide variety of attacks. And by paying for nitro, you could choose the numbers too, so step 1. Find someone you want to impersonate, copy their username, and replace one character with a visually identical one, but a different one. Step 2 - pay for nitro, and choose the numbers too. As usual, malicious actors are the reason why we can’t have nice things.
    • jrockway 3y ago
      I don't think they solved the impersonation problem. You can still look exactly like someone else, and you can only figure out that person X isn't who you think they are upon investigation. Most people don't investigate anything except the display name and profile picture, so are still vulnerable to impersonation. As far as I can tell, this hasn't been a big problem in practice. Calls can forge caller ID. Emails can forge the From field. It's irritating but isn't exactly halting society. I am really not sure why Discord made the change. Wanted to prune inactive users? Wanted to sell Nitro Super Mega Premium to jump ahead in line to get your username of choice? Just bored?
      • sgjohnson 3y ago
        > You can still look exactly like someone else But you can’t have a username that looks exactly the same anymore. I’m in some 140 discord servers. The amount of spam from people impersonating someone popular has reduced drastically since this change. I wouldn’t call “one click” an investigation.
• dcow 3y ago
  Passkeys aren’t device-bound. I think they’ll work just fine. The real problem, though, is that we seem to need digital identity solutions to be perfect as opposed to “good enough”. No solution is perfect and we’ll be stuck on email as long as the enterprise security nuts (who need everything device-bound and vendor attested) and anon-in-the-ether privacy schoolers (who think any stable identifier whatsoever is a heinous crime) are part of the conversation. Imagine if everyone just used mobile drivers licenses issued to whatever self-sovereign wallet the user chooses. Identity issuing, revocation, and recovery is then handled by all the things society has already built to handle meatspace identity. Account recovery involves a trip to your local gov’t office to re-issue your ID credential. Which means you need some chain of trust to your birth certificate. You’re going to treat your mDL credential wallet with a lot more reverence if that’s the recovery flow, so some of these problems solve themselves if we stop using punk short-names everywhere online. Relying parties that need human uniqueness, age, and/or nationality guarantees use the mDL verifiable credential. Law probibits relying parties from aggregating and selling/transferring information obtained for purposes of authentication from a VC. Ad-tech privacy problem solved. Services that don’t need proof of human uniqueness etc. can just skip the VC part of the equation and use basic passkeys and implement short-name reclamation.
  • fantasybroker 3y ago
    Personally, I like the idea of hardware-tied auth (phone/FIDO2 key), that could work for me eventually. However, I am also one of the "anon-in-the-ether" people and don't want a permanent identity on any public service. A permanent identity comes with many additional mechanics, far beyond just a stable identifier. The biggest one is post karma (including likes): IMO it's at the core of almost everything what's wrong with the modern web. It introduces vile personal and group incentives and leads to an eventual destruction of any honest conversation. While this mechanic exists on public forums, I won't use a permanent identity.
    • pseudalopex 3y ago
      Stable identifiers were common decades before karma or likes.
• zirgs 3y ago
  > People dislike usernames, they want to be able to choose non-unique ones rather than end up with user53267 or something inane. Google doesn't reuse usernames so if they are still around - in a few decades pretty much all unique usernames will belong to dead people.
• WhyIsItAlwaysHN 3y ago
  Long lasting usernames across websites is the worst for privacy though, unless the username is not public. In general, it's best if the unique identifier is only known to the user. Example: https://instantusername.com https://instantusername.com I've seen quite personal details being leaked because sometimes even smart people don't realise how easy it is to cross-reference given a unique username.
  • dcow 3y ago
    This isn’t a technology problem. We just need to put our foot down as a society and make tracking as illegal as sexual harassment/assault and aggressively and visibly punish and shun companies that abuse you. There isn’t a technology that magically makes you safe for creepy internet stalkers.
• laserbeam 3y ago
  My understanding of the article is: 1. Use a guid-like value as your internal identifier. All internal references in your databases to a user should use that. 2. Use a second user friendly identifier for the user to login (i.e. Email). Feel free to rebind this if the user needs to change it. Keep a 1-to-1 relationship between the two.
  • pc86 3y ago
    That was my understanding as well but it doesn't really address sufficiently what to do in the case of, for example, the user permanently losing access to #2. Sure if I am making the decision to migrate from gmail to some other provider, I can self-coordinate transitioning in your app. But if I lose access and can't regain it through my own forgetfulness, or worse I get hacked, the easiest option still seems to be creating a new unique account.
    • withinboredom 3y ago
      That's true of any identifier. I remember losing cell service after a storm, but the internet still worked. I couldn't login to gmail (~10-12 years ago when this was the only 2fa) because my phone couldn't receive text messages with the 2fa code. Even if you lose all the keys to your house, you'll need to get new locks. If the locksmith who is going to let you into your house does everything by the book, they'll need you to prove you actually live there. I had a friend thrown in jail for a day because his ID, keys, etc. were lost in a kayaking trip, and was arrested for attempting to break into his own house. My point is, there really isn't a good answer here. The platform equivalent to hiding keys in the bushes is printing out one-time passwords. That works pretty well, but also has its own drawbacks.
    • cpeterso 3y ago
      You could allow the user to add secondary email addresses or phone numbers to their account for account recovery, but then any of this becomes the weak link for hacking their account.
• renonce 3y ago
  What about domain names? Emails are bound to a domain name by definition, and indeed domain name IS designed as a good identity and can be used to host an email. See how domain names are owned by large corporations and trusted since day one and never lost, as long as you keep it carefully. It requires WHOIS information as the authoritative information of domain owner. An account based on username and password is what you usually need to access it, but if you are serious you can always choose a domain registar that is serious about keeping your domain name. It’s not free but it costs nuts compared to the cost of losing it, and let’s not forget that there is a cost behind hosting emails even if it’s given for free.
  • talldatethrow 3y ago
    I set up a Twitter account long ago with an email from a domain I used. I let the domain expire later, and now can't do the password reset because it's pointing to a domain that I don't own, and can't buy anymore. Basically lost forever.
    • renonce 3y ago
      You can buy a domain 10 years at a time. If you forgot to renew it one year ahead, the domain probably wasn’t important enough for you.
      • talldatethrow 3y ago
        Correct it was not. I let it expire. I forgot the Twitter account was registered with it. Later when I needed to relogin and couldn't remember the password, I couldn't do a password reset.
    • earthling8118 3y ago
      This happened to my primary Google account once and only by sheer luck was the domain available and I was able to recover the account. I'm the only one to blame because I changed my password at 2 in the morning when notified that someone in another country used it. I didn't put my info into a password manager or remember it because I wasn't truly awake at the time. When recovering I had to go through a bunch of steps and did great up until the email one. Well, Google was firm about wanting access to that email. Odd, considering the domain wasn't registered at the time of requesting a password reset and so I would consider it a security violation to accept that. Needless to say, I am much more stringent on making sure this stuff is set up correctly now.
• poulpy123 3y ago
  The oldest email that I can connect to is more than 20 years old. I'm not using it anymore but it's older than any of my phone number or physical address. I don't think we can do better, except with official indentifiers like I'd card or social security number
  • kube-system 3y ago
    > I'd card or social security number And even those change
    • lostlogin 3y ago
      And most the world doesn’t have them.
      • turquoisevar 3y ago
        Or won’t allow them to be recorded by private entities for privacy reasons even when they do.
      • szszrk 3y ago
        Because most world has a generic identity numbers for residents, not those related to social security: https://en.wikipedia.org/wiki/National_identification_number https://en.wikipedia.org/wiki/National_identification_number
      • FalconSensei 3y ago
        even if they did, your would change when you moved to another acountry
• kentbull 3y ago
  Have you heard of key event receipt infrastructure (KERI)? It solves the identity problem with decentralized identifiers though the secret sauce is the fractionally weighted multisig for enabling multi-device signing and account recovery with key rotation. See the specification for more details: https://www.ietf.org/id/draft-ssmith-keri-00.html https://www.ietf.org/id/draft-ssmith-keri-00.html Or the whitepaper: https://github.com/SmithSamuelM/Papers/blob/master/whitepapers/KERI_WP_2.x.web.pdf https://github.com/SmithSamuelM/Papers/blob/master/whitepape...
• pests 3y ago
  Spotify let's you add separate login methods. I have my email+pw set up as well as login with Apple and login with Facebook. They all log into the same account and all have the same permissions once logged in. I think it's a good solution.
• Rapzid 3y ago
  Pretty much everything is moving to UUID of sorts including Google auth. It's tricky because you often need to let people reference username/emails for mentions and etc, so you just have to index all of em and translate to UUIDs for references behind the scenes. It gets extra tricky with APIs. Consider AirPlane.dev which let's you specificy approvers via email. Now a user changes their name and their email. Well, that "IaC" suddenly references an invalid email or worse a different user because jane.doe joined after jane.doe-brown got their new email.
• sizzle 3y ago
  FaceID and touchID for iOS works pretty seamlessly nowadays for authenticating stuff e.g. mobile payments/banking, etc. and are pretty robust from being spoofed/hacked (uses depth sensor?). Why can’t we create some privacy agnostic universal FaceID to do away with passwords and usernames?