6 ms·

I usually dislike the idea of inviting government into this space, but if there's anything that governments have traditionally done decently well and should do

by api 3y ago

I usually dislike the idea of inviting government into this space, but if there's anything that governments have traditionally done decently well and should do (it's usually within their mission statement) its identity. Passports are really the primary identity layer of Earth. Ideally in a perfect world we'd have governments run OIDC systems similar to the US login.gov and these would delegate from an international master OIDC system at the UN. Everyone would have their citizenship passport ID and their UN ID, and the latter could serve as a "break glass" master key to support immigration and also limit the ability of countries to "digital death penalty" people. I can think of some dystopian outcomes here, but IMHO they are not worse than the dystopian outcomes that come from corporate monopolist control of digital identity. At least in democracies one has some nominal influence over one's government and the latter is bound by the rule of law, and if you don't live in a democracy you can (or should be able to) leave. You're right that identity is hard, and I think most of why it's hard is human rather than technical. One could create a decentralized identity layer from a block chain fairly easily but people would lose their keys etc.

logifail 3y ago
> Passports are really the primary identity layer of Earth. Umm, I'm not they're not that great as a primary identity either. One edge case is that you can have have more than one valid passport for the one nationality. Another is of course that one can have more than one nationality.
- api 3y ago
  I have a Google, Apple, Microsoft, and GitHub OIDC account among others. That's a feature not a bug.
- paganel 3y ago
  Also, passports become useless once your government actively turns against you, see the current fate of adult Ukrainian men still residing in Ukraine. The same thing risks happening with this government-approved online identity, I mean, how will the EU bureaucrats “handle” people like me that are openly against the West’s take in Ukraine? Will we get our accounts banned from posting pro-Russia content online?
  - logifail 3y ago
    > The same thing risks happening with this government-approved online identity [..] Don't forget the Covid QR codes.
vlovich123 3y ago
I don’t know. I wouldn’t say that governments do identity better than anyone else and adding more dependency on it just increases the value of the government ID making it an even more lucrative target to steal/forge. Fake ids are a thing and the quality depends on how much you spend. Governments also have reasons to lie about identity themselves (think spies). A true identity solution means being able to cross reference your identity across multiple entities (federal government, state and municipal, employers you’ve worked for, businesses you’ve interacted with, etc etc).
- fragmede 3y ago
  I'm sure there's a criminal underworld where you can just buy a passport to get you into a country, but for the average person, passports are really hard to fake, which makes them good enough as identity for logging into your average dog photo sharing site.
  - maxcoder4 3y ago
    Why would I want to log in to a dog sharing website using my real identity? Maybe I'm an outlier but I really value the pseudonymity possible thanks to the internet. I can share as much or as little about me as I want, and the dumb things I probably wrote when I was 14 are not immortalized with my name next to them.
    - Cyberdog 3y ago
      A dog what web site?
      - CatWChainsaw 3y ago
        They said dogs, not cyberdogs, so you might be safe?
buro9 3y ago
Governments do a bad job here, not a good one. They restrict people to a single immutable identity, that may not conform to other governments, that may not accommodate different languages and character sets, that are not flexible of gender, that do not reflect relationship types that aren't typically monogamous... the list goes on. They offer a poor base implementation that is only sufficient due to the legal identity seldom actually being needed online. Which is a good thing, because identity theft would be so much worse if that was everywhere. In the UK we don't have as fixed an idea of an identity as people think, Cherie Blair is also Cherie Booth Q.C. , Elton John is also Reginald Dwight, and for both people, both identities are real identities and sufficient to get bank accounts in the name of, it's only when it comes to a tax record and passport that you are reduced to a single identifier, but who is to say that the name on that is the preferred name of a person? My bank account, bank card, accounts on most of my things, do not match my passport and birth certificate.
- api 3y ago
  The alternative is corporate monopolist control, which is what is developing right now with OIDC where Google can "digital death penalty" you and lock you out of your life. The biggest realistic risk is this happening "accidentally" because some stupid bot at Google or Microsoft decides you are violating ToS, and since these companies have basically zero tech support it takes you weeks to unlock your account if at all. I don't actually like governments owning the identity layer, but then again I am of the "necessary evil" school of thought regarding most of what governments do. It's marginally better than having corporate monopolies own it. I'm a giant fan of decentralized identity, but there are two insanely hard problems with it: (1) People lose keys, forget passwords, or get them stolen. They also lose or break security key hardware. I've heard stories of people paying people to actually excavate dumps to find lost Bitcoin keys for example. (2) There's a chicken or egg problem of getting sites to support any decentralized login scheme without a monopolist like Google pushing it, and the latter have no reason to do so since they want to monopolize the identity layer. Problem (1) is solvable to some extent by having companies that escrow keys for you. Escrowing with them would not be mandatory but they'd offer a "break glass" service for people who are willing to trade a bit of (potential) privacy for it. A good escrowing service would have a terms of service that forbids misuse of your identity. Problem (2) is probably harder. Big tech will actively refuse to support any system that doesn't hand them a monopoly or at least an oligopoly. BTW this is one area where cryptocurrency could have found an actual bona fide beneficial use case! But it's not as profitable as running scams and casinos so nobody did it.
sureglymop 3y ago
I think it's not a good idea. What if, due to unforeseen circumstances, you become homeless and passport-less?
t_mann 3y ago
We'll know soon, something pretty close to what you're asking for is about to be rolled out in the EU: https://commission.europa.eu/strategy-and-policy/priorities-2019-2024/europe-fit-digital-age/european-digital-identity_en https://commission.europa.eu/strategy-and-policy/priorities-...
- paganel 3y ago
  Fortunately that will be another nail in the coffin for the EU, at this point they’re just throwing the proverbial excrements at the wall and seeing what will stick. That’s how you get parties like the AfD at more than 30% of the vote (the NSDAP themselves were just a little over 30% too in early 1933).
TimedToasts 3y ago
It'll be a cold day in Cupertino before I accept a UN ID. I'll reconsider once the corporate death counts begin to match the governmental ones but until then I'll take my chances.
- gossamer 3y ago
  The temperature in Cupertino is currently 50F. That probably doesn't meet your definition of cold though.
  - saagarjha 3y ago
    A bit chilly.
  - bigstrat2003 3y ago
    That is unironically shorts weather.
tim333 3y ago
60% of Americans approx don't have passports. In India about 93%. It's not an ideal solution to logging in to your website. Also in the UK various government types have tried to bring in national ID and the people rebel. People eh?
klabb3 3y ago
> Everyone would have their citizenship passport ID and their UN ID, and the latter could serve as a "break glass" master key to support immigration Immigration doesn’t work that way. You don’t lose or transition from one identity federation to another. You maintain both, typically for the rest of your life. My personal wishlist is that decision makers and designers of identity systems must include people with real world experience of multiple nationalities, tax residencies, migration and so on. Currently, these systems are already built on false premises and immigrants suffer a lot – not only because of malice but to a large extent because the bureaucrats didn’t think like security-minded engineers. The edge cases are extremely important when it comes to identity, because identity is required for a lot of basic needs. As the world is become more globalized, these issues are a lot more prevalent. > and I think most of why it's hard is human rather than technical Yes but I don’t see why that’s so surprising. It’s the identity of humans that’s the problem. FWIW I think email is fantastic as identity, compared to the abysmal state of the alternatives. It doesn’t change when you cross a border like phone numbers. It’s not perfect when it comes to self-sovereignty and account recovery.

by api 3y ago

logifail 3y ago

> Passports are really the primary identity layer of Earth. Umm, I'm not they're not that great as a primary identity either. One edge case is that you can have have more than one valid passport for the one nationality. Another is of course that one can have more than one nationality.

api 3y ago
I have a Google, Apple, Microsoft, and GitHub OIDC account among others. That's a feature not a bug.
paganel 3y ago
Also, passports become useless once your government actively turns against you, see the current fate of adult Ukrainian men still residing in Ukraine. The same thing risks happening with this government-approved online identity, I mean, how will the EU bureaucrats “handle” people like me that are openly against the West’s take in Ukraine? Will we get our accounts banned from posting pro-Russia content online?
- logifail 3y ago
  > The same thing risks happening with this government-approved online identity [..] Don't forget the Covid QR codes.

vlovich123 3y ago

I don’t know. I wouldn’t say that governments do identity better than anyone else and adding more dependency on it just increases the value of the government ID making it an even more lucrative target to steal/forge. Fake ids are a thing and the quality depends on how much you spend. Governments also have reasons to lie about identity themselves (think spies). A true identity solution means being able to cross reference your identity across multiple entities (federal government, state and municipal, employers you’ve worked for, businesses you’ve interacted with, etc etc).

fragmede 3y ago
I'm sure there's a criminal underworld where you can just buy a passport to get you into a country, but for the average person, passports are really hard to fake, which makes them good enough as identity for logging into your average dog photo sharing site.
- maxcoder4 3y ago
  Why would I want to log in to a dog sharing website using my real identity? Maybe I'm an outlier but I really value the pseudonymity possible thanks to the internet. I can share as much or as little about me as I want, and the dumb things I probably wrote when I was 14 are not immortalized with my name next to them.
  - Cyberdog 3y ago
    A dog what web site?
    - CatWChainsaw 3y ago
      They said dogs, not cyberdogs, so you might be safe?

buro9 3y ago

Governments do a bad job here, not a good one. They restrict people to a single immutable identity, that may not conform to other governments, that may not accommodate different languages and character sets, that are not flexible of gender, that do not reflect relationship types that aren't typically monogamous... the list goes on. They offer a poor base implementation that is only sufficient due to the legal identity seldom actually being needed online. Which is a good thing, because identity theft would be so much worse if that was everywhere. In the UK we don't have as fixed an idea of an identity as people think, Cherie Blair is also Cherie Booth Q.C. , Elton John is also Reginald Dwight, and for both people, both identities are real identities and sufficient to get bank accounts in the name of, it's only when it comes to a tax record and passport that you are reduced to a single identifier, but who is to say that the name on that is the preferred name of a person? My bank account, bank card, accounts on most of my things, do not match my passport and birth certificate.

api 3y ago
The alternative is corporate monopolist control, which is what is developing right now with OIDC where Google can "digital death penalty" you and lock you out of your life. The biggest realistic risk is this happening "accidentally" because some stupid bot at Google or Microsoft decides you are violating ToS, and since these companies have basically zero tech support it takes you weeks to unlock your account if at all. I don't actually like governments owning the identity layer, but then again I am of the "necessary evil" school of thought regarding most of what governments do. It's marginally better than having corporate monopolies own it. I'm a giant fan of decentralized identity, but there are two insanely hard problems with it: (1) People lose keys, forget passwords, or get them stolen. They also lose or break security key hardware. I've heard stories of people paying people to actually excavate dumps to find lost Bitcoin keys for example. (2) There's a chicken or egg problem of getting sites to support any decentralized login scheme without a monopolist like Google pushing it, and the latter have no reason to do so since they want to monopolize the identity layer. Problem (1) is solvable to some extent by having companies that escrow keys for you. Escrowing with them would not be mandatory but they'd offer a "break glass" service for people who are willing to trade a bit of (potential) privacy for it. A good escrowing service would have a terms of service that forbids misuse of your identity. Problem (2) is probably harder. Big tech will actively refuse to support any system that doesn't hand them a monopoly or at least an oligopoly. BTW this is one area where cryptocurrency could have found an actual bona fide beneficial use case! But it's not as profitable as running scams and casinos so nobody did it.

sureglymop 3y ago

I think it's not a good idea. What if, due to unforeseen circumstances, you become homeless and passport-less?

t_mann 3y ago

We'll know soon, something pretty close to what you're asking for is about to be rolled out in the EU: https://commission.europa.eu/strategy-and-policy/priorities-2019-2024/europe-fit-digital-age/european-digital-identity_en https://commission.europa.eu/strategy-and-policy/priorities-...

paganel 3y ago
Fortunately that will be another nail in the coffin for the EU, at this point they’re just throwing the proverbial excrements at the wall and seeing what will stick. That’s how you get parties like the AfD at more than 30% of the vote (the NSDAP themselves were just a little over 30% too in early 1933).

TimedToasts 3y ago

It'll be a cold day in Cupertino before I accept a UN ID. I'll reconsider once the corporate death counts begin to match the governmental ones but until then I'll take my chances.

gossamer 3y ago
The temperature in Cupertino is currently 50F. That probably doesn't meet your definition of cold though.
- saagarjha 3y ago
  A bit chilly.
- bigstrat2003 3y ago
  That is unironically shorts weather.

tim333 3y ago

60% of Americans approx don't have passports. In India about 93%. It's not an ideal solution to logging in to your website. Also in the UK various government types have tried to bring in national ID and the people rebel. People eh?

klabb3 3y ago

> Everyone would have their citizenship passport ID and their UN ID, and the latter could serve as a "break glass" master key to support immigration Immigration doesn’t work that way. You don’t lose or transition from one identity federation to another. You maintain both, typically for the rest of your life. My personal wishlist is that decision makers and designers of identity systems must include people with real world experience of multiple nationalities, tax residencies, migration and so on. Currently, these systems are already built on false premises and immigrants suffer a lot – not only because of malice but to a large extent because the bureaucrats didn’t think like security-minded engineers. The edge cases are extremely important when it comes to identity, because identity is required for a lot of basic needs. As the world is become more globalized, these issues are a lot more prevalent. > and I think most of why it's hard is human rather than technical Yes but I don’t see why that’s so surprising. It’s the identity of humans that’s the problem. FWIW I think email is fantastic as identity, compared to the abysmal state of the alternatives. It doesn’t change when you cross a border like phone numbers. It’s not perfect when it comes to self-sovereignty and account recovery.