4 ms·

You’re really missing the point of the whole conversation: account bootstrap and recovery for situations where things like verifying that a real human and not a

by dcow 3y ago

You’re really missing the point of the whole conversation: account bootstrap and recovery for situations where things like verifying that a real human and not a bot owns the account, that the real human is unique and isn't lying about their name, and that the human is legally allowed to use a service (age) are requirements. (To your example: we’re talking about bootstrapping an account at a bank not using a bank card as a bearer token. Banks won’t trust a bank card when you tell them you lost your bank card and need a new one, or walk into the branch for the first time to open an account.) Today we do an entirely shitty job across the board of meeting these requirements. We root trust in essentially the digital analog of your postal address. We TOFU any comms coming from a new address. We use crap like captcha (which is now easily defeated by AI) to try and help establish a pulse. Etc. Everything you mention about stable IDs existing, corporations abusing the relationship with their users for extra profit, etc., is already a problem today. All a service needs is name and DoB and they can sell info about how you use their service to aggregators for days. Our current system of email addresses doesn’t solve that even remotely. And it makes services that do justifiably need stable IDs reach for crummy insecure, unsafe and terrible options like asking you to upload a photo of you holding your drivers license… talk about creepy shit services shouldn’t be doing. There is no reason we can’t show the user a page that explains exactly what data will be shared with a service when they present any given credential and allow them, not you, to make the choice of whether that’s okey and warranted for the given service. You’re making multiple logical fallacies: (1) you’re moving the goalposts and arguing that a system that improves our ability to issue, hold, and consume digital versions of a government issued ID is wholesale bad because it doesn’t solve all conceivable problems in the digital ID space even though it solves many. And (2) your resounding reason for the badness is that “it will be designed poorly and used by bad guys” which is just our slippery slope du jour.

AnthonyMouse 3y ago
> account bootstrap Why does account bootstrap require any identification? It's a new account with nothing in it. You can't be reading someone else's messages or withdrawing their money because there isn't any. If you're the one opening the account, that's your account, regardless of who you are. The only reason anybody cares about this even for banks is that it's required by law. But then you show them your government ID one time when you open your account, which doesn't have to be done over the internet, and if you care about the security of it then it couldn't be. Otherwise you can't prove that the presenter of the ID is the person whose name is on the ID. And if you don't care about that (e.g. because to prevent this you're relying on the legal system deterring that with criminal penalties) you can let them provide their name without any ID. I mean let's ask the question this way: If people have their government ID on their phone and then someday there is a wormable remote root exploit in one of the major phone platforms, a criminal organization now has access to millions of IDs. Not possible when government ID is a physical thing in your wallet. Are we just setting ourselves up for doom? They can steal everyone's money and pin their crimes on whoever they want? Why would you build such an epic single point of failure? > recovery It doesn't really do that. It just pushes it one level away as if that system can do something different. What do you do if you lose your bank card? You show them your driver's license. But then what do you do if you lose your driver's license? Regardless of what that is, couldn't you just do that if you lost your bank card? It's not providing anything but another level of indirection. And in either event it's not something that needs to be done over the internet because it's needed so rarely. You don't event want it to happen over the internet, because then someone who can steal or forge a digital ID can steal your bank account from Russia instead of having to walk into a physical branch in the victim's country and put their face on a surveillance camera. > verifying that a real human and not a bot owns the account I still don't understand how this is supposed to prove anything. The human who operates the bot will have an ID for the bot to use. > that the real human is unique and isn't lying about their name This is the biggest reason to burn any such system to the ground. Because it only works against honest people. You prohibit victims of government abuse and anyone who doesn't want to be tracked from using a pseudonym, meanwhile serious criminals get IDs by remotely hacking phones or servers or bribing low-level government employees. Preventing innocent people from being anonymous is an offensive goal. > Banks won’t trust a bank card when you tell them you lost your bank card and need a new one So then you call them or sign in to the account on their website and have them mail it to the address they have on file, which they'll notify the account holder of by sending text and email. > We root trust in essentially the digital analog of your postal address. As opposed to the traditional system, which does the same thing with your actual postal address? The government does the same thing as the bank if you lose your driver's license. They mail you another one. In many cases they mail you the first one. > Everything you mention about stable IDs existing, corporations abusing the relationship with their users for extra profit, etc., is already a problem today. All a service needs is name and DoB and they can sell info about how you use their service to aggregators for days. Which is exactly why you should never have to give them that information, and any system that prevents you from making it up is to be destroyed. > And it makes services that do justifiably need stable IDs There are so few things that legitimately need this that keeping them clunky and arduous is a huge feature, to keep the demand for it from spreading to services that don't. > There is no reason we can’t show the user a page that explains exactly what data will be shared with a service when they present any given credential and allow them, not you, to make the choice of whether that’s okey and warranted for the given service. And then all the services that want to track you demand your full name and DOB, use it to track you, and you have to use them anyway because they have a network effect or some other market power, or there are only three companies in the industry and they all do it. > you’re moving the goalposts and arguing that a system that improves our ability to issue, hold, and consume digital versions of a government issued ID is wholesale bad because it doesn’t solve all conceivable problems in the digital ID space even though it solves many It not only doesn't solve all problems, it only solves one problem -- how to track people who don't want to be tracked, which is a problem that could quite beneficially carry on not being solved -- and in the process it creates multiple new problems that didn't previously exist. > your resounding reason for the badness is that “it will be designed poorly and used by bad guys” which is just our slippery slope du jour. It's the thing that will happen, because designing such a thing with effective privacy protections is actually an extremely difficult problem even when you're competent and have good motives, but you're asking the political system do to it, which is the thing with a poor track record on technical competence and corrupted by all of the interests who don't want that problem to be solved because they want to track everyone.
- dcow 3y ago
  You're massively oversimplifying reality. > The only reason anybody cares about this even for banks is that it's required by law. No it's not. Many many services ask for phone number as a proxy for "this is a unique human". Plenty of services ask me to verify my identity with those stupid "which one of these is your address from 2004" questions. Some ask me to upload photos of my drivers license or enter the info from the card. Services where I enter payment require my information. In fact I'd argue that the majority of the critical digital services I use require strong identity be it traditional or web3 crypto-style. It's just the angsty message boards that don't. Heck even social media requires at least a phone number these days. I simply don't buy your unfounded assertion that "the majority of relevant digital services don't need strong identity". Strong identity should be the default, anonymity only when needed or desired by a select digital community. > Are we just setting ourselves up for doom? They can steal everyone's money and pin their crimes on whoever they want? Why would you build such an epic single point of failure? The iPhone has been remotely exploitable since its introduction. Still, I don't know of a single Secure Enclave exfiltration exploit because it's hardware separated. Regardless, your doom and gloom scenario has yet to play out so I'm calling FUD. > But then what do you do if you lose your driver's license? Regardless of what that is, couldn't you just do that if you lost your bank card? There is no that. You get your license re-issued or maybe you can use SSN (which is so bad and doesn't solve anything because we devolve to digital SSN instead of DL). I don't know of any banks that let you bypass identity verification because you lost your credential. You have to go get a new credential. Fun fact, phone companies are now requiring ID verification via state issued credentials to make changes to your account. Simply having the account login credentials aren't enough anymore. Lost an hour at the Verizon store trying to get my mom a new phone for the holidays only to learn she needs a DL. > I still don't understand how this is supposed to prove anything. The human who operates the bot will have an ID for the bot to use. Nobody cares if the human uses a user-agent software to browse the web. What people care about is humans having multiple accounts, gaming systems, spamming communities, being bad actors, etc. All these things are enabled by a lack of scarcity in identity or anonymity (two sides of the same coin). Because strong identity is scarce, you don't get to make up accounts for a bot and then just roll a new one when that bot is banned. You get one shot and if you blow it and don't play by the rules your account is banned, your spam and abuse potential is now zero instead of one. > You prohibit victims of government abuse and anyone who doesn't want to be tracked from using a pseudonym, meanwhile serious criminals get IDs by remotely hacking phones or servers or bribing low-level government employees. If you're being targeted by your government then you can't use systems with strong identity anyway (whether it's form the 20th or 21st century isn't important), so it's a moot point. You can't use banks with KYC because all your accounts are frozen or being watched. You can't communicate using government regulated comms channels. Like it or not we cede a monopoly on violence to our governments. If you don't like yours then move elsewhere or yes reach for true anonymity and operate beyond the pale. > As opposed to the traditional system, which does the same thing with your actual postal address? The government does the same thing as the bank if you lose your driver's license. They mail you another one. In many cases they mail you the first one. Nooo. Trust is not rooted in your address. It's rooted in presentation of a birth certificate and residency documents to a government agency. Only after you attest to your name and bind your name to an address is an address trusted. They don't just say "oh you say your name is Paul? Great where's the best address to send this credential?", (and FWIW some even print you the credential on the spot avoiding the postal system). The fact that you either don't understand this or haven't taken the time to be careful enough about this nuance tells me you're firmly in the camp of tinfoil hat anonymity purists, and that your opinions on the matter of practical human identity can be pretty much discarded as such. No offense. I mean you said this: > Which is exactly why you should never have to give them that information, and any system that prevents you from making it up is to be destroyed. Any system where I can't just make up arbitrary details about myself is to be destroyed. Okay that's practical. > There are so few things that legitimately need this that keeping them clunky and arduous is a huge feature I don't even need to rebut this statement because it's so asinine it discredits itself. > And then all the services that want to track you demand your full name and DOB, use it to track you, and you have to use them anyway because they have a network effect or some other market power, or there are only three companies in the industry and they all do it. FUD and arguing past me. I said we need legislate the use of PII from digital credentials. We already live in a world where companies abuse everyone. We are beyond fucked on that front. So the solution isn't "stifle all innovation because it could make you slightly easier to stalk". The solution is build a strong robust framework around which information is clearly in the domain of user-controlled identity/PII and that shall not be abused without consequence, and then enforce the law. How is that not clear? The problem is EXACTLY that we can't stand up as a society and point to digital PII, because it doesn't actually exist in a clear form. We live in a blurry purgatory where nobody knows what exactly is an identifier and how it should be respected because we don't have strong digital identity. The ad industry doesn't need a credential document to track you. They just tag you with their own UUID when they see you and your shitty browser (also built by ad-tech) does the rest. Zzz... > It not only doesn't solve all problems, it only solves one problem -- how to track people who don't want to be tracked, which is a problem that could quite beneficially carry on not being solved -- and in the process it creates multiple new problems that didn't previously exist. That's not even a charitable interpretation of what I'm arguing. Thanks. It doesn't create a single new problem (or if it does it's strictly in the realm of unsophisticated doom and gloom tirade FUD). It makes a shitty system better for the vast majority of humans who'd aren't super fond of internet trolling, scalping, spam, bullying, and all manner of activities that our current system tacitly glorifies. > It's the thing that will happen, because designing such a thing with effective privacy protections is actually an extremely difficult problem even when you're competent and have good motives, but you're asking the political system do to it, which is the thing corrupted by all of the interests who don't want that problem to be solved because they want to track everyone. Privacy is not one dimensional. If you're competent you understand that privacy isn't "nobody knows anything about me". Privacy is about only sharing sensitive information with people you trust. A functioning social society involves trust. Trust no-one is not a valid pragmatic mantra. A system where the commons agree on a stable identifier and credential and then each individual is able to present the credential, attenuate the claims (e.g. transform a strong meatspace ID into a weaker but still unique pseudonymous ID for services that don't need meatspace details but still need functional identity), etc. is exactly what we need to solve problems and make progress. What we don't need is to tear down society and all become faceless anons by default. I guess this discussion probably boils down to a difference in philosophy. I'm a humanist. I want technology to augment and enhance human systems. I don't want to evolve into a trans-humanist hive mind type of civilization where we're all faceless interchangeable worker bees without any sort of reputation or identity. --- Addendum: FWIW I suspect the idea of a credential with everything a traditional drivers license has is tripping you up mentally. In the actual implementation the user is issued a selection of credentials with varying claims and can choose which one to present to any given service. The user only reveals the minimum information they're comfortable sharing with any given service. This is an enhancement possible with a digital system that's cumbersome with physical cards since sending your all the different permutations of a DL with different fields included would be unwieldy and expensive.

by dcow 3y ago

AnthonyMouse 3y ago

> account bootstrap Why does account bootstrap require any identification? It's a new account with nothing in it. You can't be reading someone else's messages or withdrawing their money because there isn't any. If you're the one opening the account, that's your account, regardless of who you are. The only reason anybody cares about this even for banks is that it's required by law. But then you show them your government ID one time when you open your account, which doesn't have to be done over the internet, and if you care about the security of it then it couldn't be. Otherwise you can't prove that the presenter of the ID is the person whose name is on the ID. And if you don't care about that (e.g. because to prevent this you're relying on the legal system deterring that with criminal penalties) you can let them provide their name without any ID. I mean let's ask the question this way: If people have their government ID on their phone and then someday there is a wormable remote root exploit in one of the major phone platforms, a criminal organization now has access to millions of IDs. Not possible when government ID is a physical thing in your wallet. Are we just setting ourselves up for doom? They can steal everyone's money and pin their crimes on whoever they want? Why would you build such an epic single point of failure? > recovery It doesn't really do that. It just pushes it one level away as if that system can do something different. What do you do if you lose your bank card? You show them your driver's license. But then what do you do if you lose your driver's license? Regardless of what that is, couldn't you just do that if you lost your bank card? It's not providing anything but another level of indirection. And in either event it's not something that needs to be done over the internet because it's needed so rarely. You don't event want it to happen over the internet, because then someone who can steal or forge a digital ID can steal your bank account from Russia instead of having to walk into a physical branch in the victim's country and put their face on a surveillance camera. > verifying that a real human and not a bot owns the account I still don't understand how this is supposed to prove anything. The human who operates the bot will have an ID for the bot to use. > that the real human is unique and isn't lying about their name This is the biggest reason to burn any such system to the ground. Because it only works against honest people. You prohibit victims of government abuse and anyone who doesn't want to be tracked from using a pseudonym, meanwhile serious criminals get IDs by remotely hacking phones or servers or bribing low-level government employees. Preventing innocent people from being anonymous is an offensive goal. > Banks won’t trust a bank card when you tell them you lost your bank card and need a new one So then you call them or sign in to the account on their website and have them mail it to the address they have on file, which they'll notify the account holder of by sending text and email. > We root trust in essentially the digital analog of your postal address. As opposed to the traditional system, which does the same thing with your actual postal address? The government does the same thing as the bank if you lose your driver's license. They mail you another one. In many cases they mail you the first one. > Everything you mention about stable IDs existing, corporations abusing the relationship with their users for extra profit, etc., is already a problem today. All a service needs is name and DoB and they can sell info about how you use their service to aggregators for days. Which is exactly why you should never have to give them that information, and any system that prevents you from making it up is to be destroyed. > And it makes services that do justifiably need stable IDs There are so few things that legitimately need this that keeping them clunky and arduous is a huge feature, to keep the demand for it from spreading to services that don't. > There is no reason we can’t show the user a page that explains exactly what data will be shared with a service when they present any given credential and allow them, not you, to make the choice of whether that’s okey and warranted for the given service. And then all the services that want to track you demand your full name and DOB, use it to track you, and you have to use them anyway because they have a network effect or some other market power, or there are only three companies in the industry and they all do it. > you’re moving the goalposts and arguing that a system that improves our ability to issue, hold, and consume digital versions of a government issued ID is wholesale bad because it doesn’t solve all conceivable problems in the digital ID space even though it solves many It not only doesn't solve all problems, it only solves one problem -- how to track people who don't want to be tracked, which is a problem that could quite beneficially carry on not being solved -- and in the process it creates multiple new problems that didn't previously exist. > your resounding reason for the badness is that “it will be designed poorly and used by bad guys” which is just our slippery slope du jour. It's the thing that will happen, because designing such a thing with effective privacy protections is actually an extremely difficult problem even when you're competent and have good motives, but you're asking the political system do to it, which is the thing with a poor track record on technical competence and corrupted by all of the interests who don't want that problem to be solved because they want to track everyone.

dcow 3y ago
You're massively oversimplifying reality. > The only reason anybody cares about this even for banks is that it's required by law. No it's not. Many many services ask for phone number as a proxy for "this is a unique human". Plenty of services ask me to verify my identity with those stupid "which one of these is your address from 2004" questions. Some ask me to upload photos of my drivers license or enter the info from the card. Services where I enter payment require my information. In fact I'd argue that the majority of the critical digital services I use require strong identity be it traditional or web3 crypto-style. It's just the angsty message boards that don't. Heck even social media requires at least a phone number these days. I simply don't buy your unfounded assertion that "the majority of relevant digital services don't need strong identity". Strong identity should be the default, anonymity only when needed or desired by a select digital community. > Are we just setting ourselves up for doom? They can steal everyone's money and pin their crimes on whoever they want? Why would you build such an epic single point of failure? The iPhone has been remotely exploitable since its introduction. Still, I don't know of a single Secure Enclave exfiltration exploit because it's hardware separated. Regardless, your doom and gloom scenario has yet to play out so I'm calling FUD. > But then what do you do if you lose your driver's license? Regardless of what that is, couldn't you just do that if you lost your bank card? There is no that. You get your license re-issued or maybe you can use SSN (which is so bad and doesn't solve anything because we devolve to digital SSN instead of DL). I don't know of any banks that let you bypass identity verification because you lost your credential. You have to go get a new credential. Fun fact, phone companies are now requiring ID verification via state issued credentials to make changes to your account. Simply having the account login credentials aren't enough anymore. Lost an hour at the Verizon store trying to get my mom a new phone for the holidays only to learn she needs a DL. > I still don't understand how this is supposed to prove anything. The human who operates the bot will have an ID for the bot to use. Nobody cares if the human uses a user-agent software to browse the web. What people care about is humans having multiple accounts, gaming systems, spamming communities, being bad actors, etc. All these things are enabled by a lack of scarcity in identity or anonymity (two sides of the same coin). Because strong identity is scarce, you don't get to make up accounts for a bot and then just roll a new one when that bot is banned. You get one shot and if you blow it and don't play by the rules your account is banned, your spam and abuse potential is now zero instead of one. > You prohibit victims of government abuse and anyone who doesn't want to be tracked from using a pseudonym, meanwhile serious criminals get IDs by remotely hacking phones or servers or bribing low-level government employees. If you're being targeted by your government then you can't use systems with strong identity anyway (whether it's form the 20th or 21st century isn't important), so it's a moot point. You can't use banks with KYC because all your accounts are frozen or being watched. You can't communicate using government regulated comms channels. Like it or not we cede a monopoly on violence to our governments. If you don't like yours then move elsewhere or yes reach for true anonymity and operate beyond the pale. > As opposed to the traditional system, which does the same thing with your actual postal address? The government does the same thing as the bank if you lose your driver's license. They mail you another one. In many cases they mail you the first one. Nooo. Trust is not rooted in your address. It's rooted in presentation of a birth certificate and residency documents to a government agency. Only after you attest to your name and bind your name to an address is an address trusted. They don't just say "oh you say your name is Paul? Great where's the best address to send this credential?", (and FWIW some even print you the credential on the spot avoiding the postal system). The fact that you either don't understand this or haven't taken the time to be careful enough about this nuance tells me you're firmly in the camp of tinfoil hat anonymity purists, and that your opinions on the matter of practical human identity can be pretty much discarded as such. No offense. I mean you said this: > Which is exactly why you should never have to give them that information, and any system that prevents you from making it up is to be destroyed. Any system where I can't just make up arbitrary details about myself is to be destroyed. Okay that's practical. > There are so few things that legitimately need this that keeping them clunky and arduous is a huge feature I don't even need to rebut this statement because it's so asinine it discredits itself. > And then all the services that want to track you demand your full name and DOB, use it to track you, and you have to use them anyway because they have a network effect or some other market power, or there are only three companies in the industry and they all do it. FUD and arguing past me. I said we need legislate the use of PII from digital credentials. We already live in a world where companies abuse everyone. We are beyond fucked on that front. So the solution isn't "stifle all innovation because it could make you slightly easier to stalk". The solution is build a strong robust framework around which information is clearly in the domain of user-controlled identity/PII and that shall not be abused without consequence, and then enforce the law. How is that not clear? The problem is EXACTLY that we can't stand up as a society and point to digital PII, because it doesn't actually exist in a clear form. We live in a blurry purgatory where nobody knows what exactly is an identifier and how it should be respected because we don't have strong digital identity. The ad industry doesn't need a credential document to track you. They just tag you with their own UUID when they see you and your shitty browser (also built by ad-tech) does the rest. Zzz... > It not only doesn't solve all problems, it only solves one problem -- how to track people who don't want to be tracked, which is a problem that could quite beneficially carry on not being solved -- and in the process it creates multiple new problems that didn't previously exist. That's not even a charitable interpretation of what I'm arguing. Thanks. It doesn't create a single new problem (or if it does it's strictly in the realm of unsophisticated doom and gloom tirade FUD). It makes a shitty system better for the vast majority of humans who'd aren't super fond of internet trolling, scalping, spam, bullying, and all manner of activities that our current system tacitly glorifies. > It's the thing that will happen, because designing such a thing with effective privacy protections is actually an extremely difficult problem even when you're competent and have good motives, but you're asking the political system do to it, which is the thing corrupted by all of the interests who don't want that problem to be solved because they want to track everyone. Privacy is not one dimensional. If you're competent you understand that privacy isn't "nobody knows anything about me". Privacy is about only sharing sensitive information with people you trust. A functioning social society involves trust. Trust no-one is not a valid pragmatic mantra. A system where the commons agree on a stable identifier and credential and then each individual is able to present the credential, attenuate the claims (e.g. transform a strong meatspace ID into a weaker but still unique pseudonymous ID for services that don't need meatspace details but still need functional identity), etc. is exactly what we need to solve problems and make progress. What we don't need is to tear down society and all become faceless anons by default. I guess this discussion probably boils down to a difference in philosophy. I'm a humanist. I want technology to augment and enhance human systems. I don't want to evolve into a trans-humanist hive mind type of civilization where we're all faceless interchangeable worker bees without any sort of reputation or identity. --- Addendum: FWIW I suspect the idea of a credential with everything a traditional drivers license has is tripping you up mentally. In the actual implementation the user is issued a selection of credentials with varying claims and can choose which one to present to any given service. The user only reveals the minimum information they're comfortable sharing with any given service. This is an enhancement possible with a digital system that's cumbersome with physical cards since sending your all the different permutations of a DL with different fields included would be unwieldy and expensive.