4 ms·

> I'm in no rush to show Zuck my passport I agree, but I think your problem isn't Zuck, it's with passports. Government issued licences aren't fit for purpose

> I'm in no rush to show Zuck my passport I agree, but I think your problem isn't Zuck, it's with passports. Government issued licences aren't fit for purpose any more. They were when all you did with your paper drivers licence is show it to the police, but now they've become a form of ID you show man+dog who gets to scrape a whole pile of into from it that can be used to track you. For example, they can follow your passport number or drivers licence to connect a series of what should look like unrelated transactions. As an example, now when a car rental company wants to know you have a valid licence they demand a copy of it. If you have an accident they use the copy to prove they verified you are licenced to drive, if you do something illegal they can hand over your ID so the police can chase you down. FIDO / WebAuthn / PassKey shows how those things can be achieved without leaking all the information on the licence. It can hand over a one time token saying you have a valid licence and signed by something that chains back to a public key held by the government. The token reveals nothing more than that to the car hire firm, but should they hand it over to the police they can decrypt it to identify you. These tokens are useless if stolen. They can't link you to other transactions and don't identify you in any way, and yet are far more secure than a bunch of unsigned pixels. In other words unlike a copy of a passport, mostly harmless.

kevin_thibedeau 3y ago
> don't identify you in any way That's a critical flaw to those in power.
josephg 3y ago
Hard agree. I think making significant progress on this problem would be time consuming - but ultimately a significant win for society.
- bxff 3y ago
  Hi Seph, any updates on the paper on Replayable Event Graph, looking forward to reading that paper.
  - josephg 3y ago
    Its happening. My coauthor wanted to make some updates before sending it out to people. I'll send you a draft soon, I promise! Its just coming together slower than I'd like. Always slower :S
oliwarner 3y ago
> gets to scrape a whole pile of into from it that can be used to track you I can't help but feel your argument is with data protection [and the broad lack of it in the US] rather than government-held databases. I have a couple of online government authentication methods. There could easily be an AVS API where a website kicks me off to to my government, and they sign a request for age verification, all with very little cost and fuss. That obviously causes uproar from people who think my government doesn't suspect I touch myself when they're not looking. And a suggestion I've made in a couple of other sibling threads is having an AI watch you reading a script in realtime. I had to do this for a mortgage application a few years ago. Probably cheaper than a government API, and a high success rate on 25yo+ similar to facial-only checking in bars.
- rstuart4133 3y ago
  > I can't help but feel your argument is with data protection [and the broad lack of it in the US] rather than government-held databases. It goes deeper than that. Recently in Australia we've had two data breaches, one from a Telco [0] and another from a credit card company [1]. Both were required to collect ID by law, so they gave you a portal to upload photos of drivers licences, government medical insurance cards, credit card and so on. In both cases they leaked the lot. To say they were unpopular was an understatement. Perhaps 10% of Australia had to get new drivers licences. The were hauled up to front senate committees, CEO's fell on the sword. A lot of political theatre in other words, but while this "take a copy of a government licence as a form of ID" madness continues it will keep happening. In other news, social hacks against the government electronic ID for their website were used to collect around 1/2 a billion in fraudulent payouts (tax refunds and the like) [2]. And a few years ago the tax office was done for $2B or so for ID fraud waged against our VAT collection. [3] That one was perpetrated by thousands; the instructions went viral on TikTok. We live in a digital world now, where it's easy to take a copy of any bag of bits. Relying on ID's that don't mutually authenticate and vigorously protect the information they do hand out is downright dangerous. [0] https://en.wikipedia.org/wiki/2022_Optus_data_breach https://en.wikipedia.org/wiki/2022_Optus_data_breach [1] https://asic.gov.au/about-asic/news-centre/news-items/guidance-for-consumers-impacted-by-the-latitude-financial-services-data-breach/ https://asic.gov.au/about-asic/news-centre/news-items/guidan... [2] https://theconversation.com/the-500-million-ato-fraud-highlights-flaws-in-the-mygov-id-system-heres-how-to-keep-your-data-safe-210459 https://theconversation.com/the-500-million-ato-fraud-highli... [3] https://www.theguardian.com/australia-news/2024/feb/13/ato-staff-investigated-social-media-scam-australian-taxation-office https://www.theguardian.com/australia-news/2024/feb/13/ato-s...

kevin_thibedeau 3y ago

> don't identify you in any way That's a critical flaw to those in power.

josephg 3y ago

Hard agree. I think making significant progress on this problem would be time consuming - but ultimately a significant win for society.

bxff 3y ago
Hi Seph, any updates on the paper on Replayable Event Graph, looking forward to reading that paper.
- josephg 3y ago
  Its happening. My coauthor wanted to make some updates before sending it out to people. I'll send you a draft soon, I promise! Its just coming together slower than I'd like. Always slower :S

oliwarner 3y ago

> gets to scrape a whole pile of into from it that can be used to track you I can't help but feel your argument is with data protection [and the broad lack of it in the US] rather than government-held databases. I have a couple of online government authentication methods. There could easily be an AVS API where a website kicks me off to to my government, and they sign a request for age verification, all with very little cost and fuss. That obviously causes uproar from people who think my government doesn't suspect I touch myself when they're not looking. And a suggestion I've made in a couple of other sibling threads is having an AI watch you reading a script in realtime. I had to do this for a mortgage application a few years ago. Probably cheaper than a government API, and a high success rate on 25yo+ similar to facial-only checking in bars.

rstuart4133 3y ago
> I can't help but feel your argument is with data protection [and the broad lack of it in the US] rather than government-held databases. It goes deeper than that. Recently in Australia we've had two data breaches, one from a Telco [0] and another from a credit card company [1]. Both were required to collect ID by law, so they gave you a portal to upload photos of drivers licences, government medical insurance cards, credit card and so on. In both cases they leaked the lot. To say they were unpopular was an understatement. Perhaps 10% of Australia had to get new drivers licences. The were hauled up to front senate committees, CEO's fell on the sword. A lot of political theatre in other words, but while this "take a copy of a government licence as a form of ID" madness continues it will keep happening. In other news, social hacks against the government electronic ID for their website were used to collect around 1/2 a billion in fraudulent payouts (tax refunds and the like) [2]. And a few years ago the tax office was done for $2B or so for ID fraud waged against our VAT collection. [3] That one was perpetrated by thousands; the instructions went viral on TikTok. We live in a digital world now, where it's easy to take a copy of any bag of bits. Relying on ID's that don't mutually authenticate and vigorously protect the information they do hand out is downright dangerous. [0] https://en.wikipedia.org/wiki/2022_Optus_data_breach https://en.wikipedia.org/wiki/2022_Optus_data_breach [1] https://asic.gov.au/about-asic/news-centre/news-items/guidance-for-consumers-impacted-by-the-latitude-financial-services-data-breach/ https://asic.gov.au/about-asic/news-centre/news-items/guidan... [2] https://theconversation.com/the-500-million-ato-fraud-highlights-flaws-in-the-mygov-id-system-heres-how-to-keep-your-data-safe-210459 https://theconversation.com/the-500-million-ato-fraud-highli... [3] https://www.theguardian.com/australia-news/2024/feb/13/ato-staff-investigated-social-media-scam-australian-taxation-office https://www.theguardian.com/australia-news/2024/feb/13/ato-s...