13 ms·

Uganda's surveillance state is built on national ID cards

spacephysics 2y ago
Same with the UAE
23B1 2y ago
Coming soon to a republic near you: https://www.aclu.org/issues/privacy-technology/national-id/real-id https://www.aclu.org/issues/privacy-technology/national-id/r...
- deleted 2y ago
  [deleted]
- lxgr 2y ago
  There's gotta be some middle ground. The US seems to have one of the most vulnerable systems when it comes to identity theft, between SSNs being used as bearer tokens and utility bills being used as proof of residency. National ID cards can be done in very concerning, but also very privacy-preserving ways. For example, the German ID card has an e-ID function that lets you assert minimal statements about yourself (e.g. you can provably assert "I'm over 18 years old and live in Berlin", without sharing your exact date of birth or name with the requesting party). Something like that seems desperately needed in the US. Security questions (largely sourced from data in the public record) and taking a photo of your driver's license isn't going to cut it much longer, in a world of daily database breaches and plausible deepfakes.
  - JumpCrisscross 2y ago
    > There's gotta be some middle ground We need a national ID without a national registry. The simplest (from a legal perspective) might be a national clearinghouse that polls states' registries.
    - vlovich123 2y ago
      I don’t think there’s any advantage to that. Also, how do you deal with immigrants who weren’t even born in any state? Or are you relying that state records track people as they move? That seems unwise given how bad states are at maintaining those records / people tend to often not update the state about moving. Or do you have a national registry for immigrants and a statewide for those those born within the US? Oh and how do you deal with children of soldiers who aren’t actually necessarily living in a state? It’s much simpler to eat the cost of a national registry and avoid all sorts of logistical challenges of coordinating across 50 States’ and 5 territories IT systems and disparate standards on record keeping.
      - JumpCrisscross 2y ago
        How is this dealt with in the EU?
        kergonath 2y ago
        Depends on the country, I think. Usually, if you move to another country, you have to register there so each country knows who is a foreigner. This is also tracked for taxes and social security, and for elections. For elections they need to keep track of each person’s status: EU citizens might be able to vote in local election in another EU country, but not national ones, so they have to record this type of information. These three things are different: you can live in a country, pay taxes in another, and vote in a third. I guess states are just good at keeping records.
        Leherenn 2y ago
        Not the EU, but in Switzerland, you need to be registered in the place you live primarily. If you move to a different town, you have two weeks to deregister at the old one and re-register at the new. To prove you live, you would do it the same way as in the US/UK if I understand correctly, with whatever evidence you have. Rental contract in your name, utility bill, property deed, ... If you live with your parents and don't have anything in your name, they need to write a signed attestation you live there. And so on. It's not uncommon for the police to knock on your door and check if you actually live where you claim to if they have a doubt.
  - mindslight 2y ago
    "Identity theft" has very little to do with ID cards, and everything to do with businesses not being held fully liable for their own negligence. If a bank contacts me thinking I owe them something, informing them once that they've seemingly been defrauded is where my responsibility should end (verbally, web form, or self-addressed stamped envelope) . If they want my help figuring out the details I should be able to give them the contact info to my attorney while they pay the attorney's rates and other costs incurred. Furthermore, the current identification systems are already being abused by surveillance companies as corroborating keys to facilitate their creation and storage of permanent dossiers on us. Until that is fixed (eg a US port of the GDPR that applies to every industry), I have absolutely no desire that the technical strength of identification be increased. People's hesitation at giving out their identifying info is basically the only thing holding back every single medium or large business from demanding even more of it.
    - nothercastle 2y ago
      Id theft would be greatly reduced if compromised ids could be revoked but obviously revoking an id is ripe for abuse
      - mindslight 2y ago
        erm, US IDs generally have no digital authentication methods, so there is nothing to be revoked. They generally consist of your picture and your identifying information, including an identifying number the state assigns because (name, birthday) wouldn't be a good database key. The authentication process is performed by examining the physical document and judging whether it seems counterfeit, and whether the picture looks similar to the person claiming to be the listed person. This hasn't stopped a lot of negligent businesses from performing a fake authentication process that skips actually verifying the physical document and having people enter various fields from the ID card for some kind of dog and pony show, but the point remains there is still nothing to revoke.
        lxgr 2y ago
        Why wouldn't it be possible to revoke IDs that don't have digital authentication methods? The absence of such digital authentication methods is also a big problem in the way photo IDs are commonly used in the US ("take a photo of it, or maybe a video and wiggle it around a bit"). But it seems orthogonal to revocation, which would help when presenting a lost/stolen ID physically, e.g. to open a bank account or apply for credit card. (Not that that seems to be the most common way identity fraud is actually done these days in the US, so the lack of digital authentication seems to be the worse problem here.)
- 29athrowaway 2y ago
  If there was high speed rail there would be no need for such nonsense.
  - aleph_minus_one 2y ago
    > If there was high speed rail there would be no need for such nonsense. I don't understand your point what high speed rails have to do with privacy.
    - 29athrowaway 2y ago
      The case for the Real IDs and TSA and all that nonsense is mostly from air travel. They are not required for trains and buses.
      - iosjunkie 2y ago
        Surely high speed rail wouldn't reduce air travel to point where there isn't a push for TSA and Read IDs.
        vlovich123 2y ago
        And it wouldn’t be long before high speed rail would require IDs anyway. There’s not some intrinsic reason why rail doesn’t require that stuff & it’s as much of a terrorist target as any other form of transportation.
        ClumsyPilot 2y ago
        A bomb on a train doesn’t bring down the train
        defrost 2y ago
        Russia opens terrorist investigation after freight train derailed https://www.reuters.com/world/europe/russia-opens-terrorist-investigation-after-freight-train-derailed-2023-11-12/ https://www.reuters.com/world/europe/russia-opens-terrorist-... Millions of Americans face risk of a toxic ‘bomb train’ https://www.washingtonpost.com/climate-environment/2024/01/29/vinyl-chloride-trains-chemical-report/ https://www.washingtonpost.com/climate-environment/2024/01/2... Less than a year ago, a disastrous train derailment sent a massive plume of dangerous chemicals billowing over East Palestine, Ohio, startling the town of nearly 5,000 residents and onlookers nationwide. Now, a new report warns that more of these catastrophes may loom: At any given moment, more than an estimated 3 million people are unknowingly at risk, as toxic trains full of a highly combustible and carcinogenic chemical used to make plastic move between Texas and New Jersey.
deleted 2y ago
[deleted]
emilfihlman 2y ago
[flagged]
- dgfitz 2y ago
  The US has a lot of illegal immigration at the moment. How would you sort that out? Also, I’m not saying the US isn’t dumb, we are. But so is everyone else. I’m tired of all this hatred.
  - emilfihlman 2y ago
    I don't really get what you mean? Only citizens can of course vote.
  - ThePowerOfFuet 2y ago
    By separating the concept of ID and legal residency.
    - rootusrootus 2y ago
      Don't some states already do something like that? Does it work?
  - ClumsyPilot 2y ago
    US gets all this ‘hatred’ because it has outsized influence on the world, either though it’s corporate or very active foreign policy. So when US is up to something dumb it spills over. No one is hating on Mongolia because their problems don’t affect anyone else. Natural consequence of exercising influence from the top is that you have a target on your back.
- jprete 2y ago
  The direct purpose of any ID system is for the state to assert more control over the population, by making it harder to plausibly deny one's identity, and therefore easier to punish for disobedience. It's historical good luck that many of us live in countries and at times where this is actually a good deal, and I think it's a mistake to dismiss the opposite end of the argument as "absurd".
nwiswell 2y ago
I guess we know that they'll regret this? https://news.ycombinator.com/item?id=40580549 https://news.ycombinator.com/item?id=40580549
kragen 2y ago
hilariously, this article about how lack of anonymity is deadly to civil liberties prompts me, 'create your account to continue reading' https://archive.is/Swy3x https://archive.is/Swy3x
- deleted 2y ago
  [deleted]
vlovich123 2y ago
I actually think national ID systems need a dual mechanism where you can hand out IDs that are unique for any given relationship you establish. That way business relationships can be formed with the government providing assurance of identity, but even if the business leaks all those ID numbers nothing can actually happen to you unless the business’ private key is stolen. Similarly, the government can only establish your identity but cannot determine your relationships with businesses or other individuals. You can also choose to revoke ID permissions for any relationship and entities are not allowed to store identifying info about you (i.e. they have to query the government database whenever they need it) similar to how they’re not allowed to store CC info.
- JumpCrisscross 2y ago
  > You can also choose to revoke ID permissions for any relationship and entities are not allowed to store identifying info about you (i.e. they have to query the government database whenever they need it) similar to how they’re not allowed to store CC info How do you propose doing this without a centralised (or public) place that tracks your relationships? If the answer is local, you'd expect to be inundated with cases within a few years of people who couldn't revoke a permission because they lost their phone or whatnot.
  - weddpros 2y ago
    You can look into "Sovereign Identity", which could offer a solution to this very problem, in theory. It's a decentralised digital identity framework using cryptography. The idea is to take identity upside down: you issue your own identity (think key pair), and an authority certifies it (aka. signature). That's why it's called sovereign. Adding zero knowledge proofs adds support for more privacy preserving tech: prove your address is in a specific country, without giving your address, or prove your age without giving your birthdate. Although it could all be implemented today, governments don't... because they love centralisation for the power it gives them. European institutions are working on Sovereign Identity projects, but it's mostly 100% centralised bullshit from what I know. As with all things cryptographic, if you don't own the keys, you own nothing.
renaudg 2y ago
The problem may have more to do with Uganda and having a surveillance state than it has to do with National ID cards. Most European countries have them and they are as uncontroversial as passports. Countries without national ID cards are not especially more privacy minded : for the purpose of identity verification they just use alternative documents & processes that are less straightforward and at least as intrusive (e.g. driving licenses, utility bills and credit checks in the US and UK). IMO it's much more honest to recognize that there's a legitimate need to be able to prove one's identity in a functioning society, and to build a dedicated system for that, instead of tying your existence as a citizen to your ability / willingness to drive a large piece of metal around.
- olyjohn 2y ago
  I'm every state that I am aware of, you can get and ID card that is not a drivers license. So it's not really got anything to do with driving.
  - deleted 2y ago
    [deleted]
- mattmaroon 2y ago
  The US functionally has it. Your driver’s license goes into a national database, as do your license plates and social security number. I can drive through Oklahoma (several states away) and their system will automatically read my plates at a toll road and a bill will arrive at my home. Our licenses now need a federal registration for us to board a plane. I think states have dropped issuing the ones that don’t. The NSA probably has everyone’s cell number, text messages, and metadata (including location) stored. With tech being what it is these days anonymity doesn’t exist.
  - rootusrootus 2y ago
    > I think states have dropped issuing the ones that don’t. Some have. Oregon, as a single example, will let you opt for a non-Real ID card.
treebeard901 2y ago
At least in the United States and many other places, the surveillance state IDs you a million ways before you ever get to an ID, even if it has some form of RFID, NFC, etc... ID cards also do not collect data like everything people give up willingly every day.
jgeada 2y ago
People get caught up in this all the damn time, and blame the wrong system. There should always 3 steps in accessing a secure system (eg bank account): Identity, Authentication, Authorization. Just because there is a unique identifier that is known publicly, it does not imply that the person presenting that identifier is the actual entity to which that identifier was issued. The identifier is just an identier, it does not prove anything. It is not really all that different than your name. Just knowing your name should not give me access to anything. To prove the entity presenting the identifier is actually the entity to which the identifier belongs you have to do authentication. And authentication does have to rely on some sort of secure exchange of secrets (ie not of publicly available information). These should be secrets known only to the correct entity and to the entity performing authentication (and authenticator need not even be the same organization that issued the identifier in the first place) And once you've matched the entity to the identifier, then the last step: does that entity with that identifier have the authorization to perform whatever task they're asking to be done? Not every entity has the equivalent of root access to everything they have legitimate access to. Identity, Authentication, Authorization. 3 different steps, with 3 different sets of constraints. The problem in the US is most organizations never perform any even vaguely valid authentication validation. SS#, phone number and an address or two (all public data, if you're willing to pay one of the credit bureaus) and you can get access to most random person's accounts.
- deleted 2y ago
  [deleted]
- M95D 2y ago
  In fact, you can have Authorization without identity, directly based on a secret, but who would use that when we can request Identity with background tracking.
- mcshicks 2y ago
  There is a bill working it's way (slowly) through the US Congress, you can write your local congressman and senators. https://www.congress.gov/bill/118th-congress/senate-bill/884/all-info#:~:text=Introduced%20in%20Senate%20(03%2F21%2F2023)&text=Act%20of%202023-,This%20bill%20establishes%20a%20temporary%20task%20force%20to%20recommend%20secure,a%20service%20online%20or%20electronically https://www.congress.gov/bill/118th-congress/senate-bill/884...).
potatoball 2y ago
https://archive.ph/Swy3x https://archive.ph/Swy3x
diebeforei485 2y ago
The problem isn't ID cards. European countries also have ID cards but don't have so much surveillance.
- was_a_dev 2y ago
  Conversely, in the UK we don't have ID cards, but have a fair bit more surveillance
impish9208 2y ago
Dupe: https://news.ycombinator.com/item?id=40580354 https://news.ycombinator.com/item?id=40580354
nxobject 2y ago
Not national ID cards - biometric ID.
nox101 2y ago
They're trying to do the same in the USA https://www.dhs.gov/real-id https://www.dhs.gov/real-id The ACLU claims to be trying to fight it but AFAICT they aren't actually doing anything https://www.aclu.org/issues/privacy-technology/national-id/real-id https://www.aclu.org/issues/privacy-technology/national-id/r... I was going to sign up for one but then they wanted so much stupid info. It was ridiculous. I can get a passport with less info than a REAL ID. They wanted billing statements and they wanted to know a "permanent address". None of my addresses are "permanent".
mobiuscog 2y ago
Most people in the West now buy things with credit cards and constantly use their phone. These are absolutely not identity providers, but they provide far more tracking in day-to-day life than an ID card would, with none of the actual benefits. ID cards only facilitate a surveillance state, when they are monitored for every purpose... mobile phones and payment cards (even loyalty cards) already provide that. UK taxes are based upon a (National Insurance) number, or at least contributions are, which is explicitly stated as 'not' being an identifier, and often has the same number used by multiple people. There seem to be many ways that identity is handled that create massive technical debt, but very few that actually try to do it correctly for the actual benefit of citizens.
- zabzonk 2y ago
  the UK NI number seems to work pretty well. i rang up the DWP last year to claim my state pension, gave them my name, dob and NI number(and bank details) and got payments starting a couple of weeks later.
dzink 2y ago
In the US, instead of a clear identifier (which saves you time and energy), you have private party intermediaries that make themselves a lazily insecure buffer to provide the same service at a cost. Some have twisted themselves to provide dual service and increase profit in the process (credit bureaus, credit card intermediaries, insurance companies, etc). Entire industries can stoke fear of privacy risks to ensure they have a place in the ecosystem, while at the same time delivering the worst breaches for millions of Americans again and again. The ability to transact without friction creates a lot more value than the perceived protection of entities that pretend to care about your privacy, but have no real incentive to actually do so.
tamiral 2y ago
the free social media app usage in a lot of east african countries is also a means of surveillance... ex (no data counted to your plan when using whataspp, instagram, messenger, facebook etc).
akasakahakada 2y ago
FYI Japan is going to (in progrees) do the same shit.

Same with the UAE

23B1 2y ago

Coming soon to a republic near you: https://www.aclu.org/issues/privacy-technology/national-id/real-id https://www.aclu.org/issues/privacy-technology/national-id/r...

deleted 2y ago
[deleted]
lxgr 2y ago
There's gotta be some middle ground. The US seems to have one of the most vulnerable systems when it comes to identity theft, between SSNs being used as bearer tokens and utility bills being used as proof of residency. National ID cards can be done in very concerning, but also very privacy-preserving ways. For example, the German ID card has an e-ID function that lets you assert minimal statements about yourself (e.g. you can provably assert "I'm over 18 years old and live in Berlin", without sharing your exact date of birth or name with the requesting party). Something like that seems desperately needed in the US. Security questions (largely sourced from data in the public record) and taking a photo of your driver's license isn't going to cut it much longer, in a world of daily database breaches and plausible deepfakes.
- JumpCrisscross 2y ago
  > There's gotta be some middle ground We need a national ID without a national registry. The simplest (from a legal perspective) might be a national clearinghouse that polls states' registries.
  - vlovich123 2y ago
    I don’t think there’s any advantage to that. Also, how do you deal with immigrants who weren’t even born in any state? Or are you relying that state records track people as they move? That seems unwise given how bad states are at maintaining those records / people tend to often not update the state about moving. Or do you have a national registry for immigrants and a statewide for those those born within the US? Oh and how do you deal with children of soldiers who aren’t actually necessarily living in a state? It’s much simpler to eat the cost of a national registry and avoid all sorts of logistical challenges of coordinating across 50 States’ and 5 territories IT systems and disparate standards on record keeping.
    - JumpCrisscross 2y ago
      How is this dealt with in the EU?
      - kergonath 2y ago
        Depends on the country, I think. Usually, if you move to another country, you have to register there so each country knows who is a foreigner. This is also tracked for taxes and social security, and for elections. For elections they need to keep track of each person’s status: EU citizens might be able to vote in local election in another EU country, but not national ones, so they have to record this type of information. These three things are different: you can live in a country, pay taxes in another, and vote in a third. I guess states are just good at keeping records.
      - Leherenn 2y ago
        Not the EU, but in Switzerland, you need to be registered in the place you live primarily. If you move to a different town, you have two weeks to deregister at the old one and re-register at the new. To prove you live, you would do it the same way as in the US/UK if I understand correctly, with whatever evidence you have. Rental contract in your name, utility bill, property deed, ... If you live with your parents and don't have anything in your name, they need to write a signed attestation you live there. And so on. It's not uncommon for the police to knock on your door and check if you actually live where you claim to if they have a doubt.
- mindslight 2y ago
  "Identity theft" has very little to do with ID cards, and everything to do with businesses not being held fully liable for their own negligence. If a bank contacts me thinking I owe them something, informing them once that they've seemingly been defrauded is where my responsibility should end (verbally, web form, or self-addressed stamped envelope) . If they want my help figuring out the details I should be able to give them the contact info to my attorney while they pay the attorney's rates and other costs incurred. Furthermore, the current identification systems are already being abused by surveillance companies as corroborating keys to facilitate their creation and storage of permanent dossiers on us. Until that is fixed (eg a US port of the GDPR that applies to every industry), I have absolutely no desire that the technical strength of identification be increased. People's hesitation at giving out their identifying info is basically the only thing holding back every single medium or large business from demanding even more of it.
  - nothercastle 2y ago
    Id theft would be greatly reduced if compromised ids could be revoked but obviously revoking an id is ripe for abuse
    - mindslight 2y ago
      erm, US IDs generally have no digital authentication methods, so there is nothing to be revoked. They generally consist of your picture and your identifying information, including an identifying number the state assigns because (name, birthday) wouldn't be a good database key. The authentication process is performed by examining the physical document and judging whether it seems counterfeit, and whether the picture looks similar to the person claiming to be the listed person. This hasn't stopped a lot of negligent businesses from performing a fake authentication process that skips actually verifying the physical document and having people enter various fields from the ID card for some kind of dog and pony show, but the point remains there is still nothing to revoke.
      - lxgr 2y ago
        Why wouldn't it be possible to revoke IDs that don't have digital authentication methods? The absence of such digital authentication methods is also a big problem in the way photo IDs are commonly used in the US ("take a photo of it, or maybe a video and wiggle it around a bit"). But it seems orthogonal to revocation, which would help when presenting a lost/stolen ID physically, e.g. to open a bank account or apply for credit card. (Not that that seems to be the most common way identity fraud is actually done these days in the US, so the lack of digital authentication seems to be the worse problem here.)
29athrowaway 2y ago
If there was high speed rail there would be no need for such nonsense.
- aleph_minus_one 2y ago
  > If there was high speed rail there would be no need for such nonsense. I don't understand your point what high speed rails have to do with privacy.
  - 29athrowaway 2y ago
    The case for the Real IDs and TSA and all that nonsense is mostly from air travel. They are not required for trains and buses.
    - iosjunkie 2y ago
      Surely high speed rail wouldn't reduce air travel to point where there isn't a push for TSA and Read IDs.
      - vlovich123 2y ago
        And it wouldn’t be long before high speed rail would require IDs anyway. There’s not some intrinsic reason why rail doesn’t require that stuff & it’s as much of a terrorist target as any other form of transportation.
        ClumsyPilot 2y ago
        A bomb on a train doesn’t bring down the train
        defrost 2y ago
        Russia opens terrorist investigation after freight train derailed https://www.reuters.com/world/europe/russia-opens-terrorist-investigation-after-freight-train-derailed-2023-11-12/ https://www.reuters.com/world/europe/russia-opens-terrorist-... Millions of Americans face risk of a toxic ‘bomb train’ https://www.washingtonpost.com/climate-environment/2024/01/29/vinyl-chloride-trains-chemical-report/ https://www.washingtonpost.com/climate-environment/2024/01/2... Less than a year ago, a disastrous train derailment sent a massive plume of dangerous chemicals billowing over East Palestine, Ohio, startling the town of nearly 5,000 residents and onlookers nationwide. Now, a new report warns that more of these catastrophes may loom: At any given moment, more than an estimated 3 million people are unknowingly at risk, as toxic trains full of a highly combustible and carcinogenic chemical used to make plastic move between Texas and New Jersey.

deleted 2y ago

[deleted]

emilfihlman 2y ago

[flagged]

dgfitz 2y ago
The US has a lot of illegal immigration at the moment. How would you sort that out? Also, I’m not saying the US isn’t dumb, we are. But so is everyone else. I’m tired of all this hatred.
- emilfihlman 2y ago
  I don't really get what you mean? Only citizens can of course vote.
- ThePowerOfFuet 2y ago
  By separating the concept of ID and legal residency.
  - rootusrootus 2y ago
    Don't some states already do something like that? Does it work?
- ClumsyPilot 2y ago
  US gets all this ‘hatred’ because it has outsized influence on the world, either though it’s corporate or very active foreign policy. So when US is up to something dumb it spills over. No one is hating on Mongolia because their problems don’t affect anyone else. Natural consequence of exercising influence from the top is that you have a target on your back.
jprete 2y ago
The direct purpose of any ID system is for the state to assert more control over the population, by making it harder to plausibly deny one's identity, and therefore easier to punish for disobedience. It's historical good luck that many of us live in countries and at times where this is actually a good deal, and I think it's a mistake to dismiss the opposite end of the argument as "absurd".

nwiswell 2y ago

I guess we know that they'll regret this? https://news.ycombinator.com/item?id=40580549 https://news.ycombinator.com/item?id=40580549

kragen 2y ago

hilariously, this article about how lack of anonymity is deadly to civil liberties prompts me, 'create your account to continue reading' https://archive.is/Swy3x https://archive.is/Swy3x

deleted 2y ago
[deleted]

vlovich123 2y ago

I actually think national ID systems need a dual mechanism where you can hand out IDs that are unique for any given relationship you establish. That way business relationships can be formed with the government providing assurance of identity, but even if the business leaks all those ID numbers nothing can actually happen to you unless the business’ private key is stolen. Similarly, the government can only establish your identity but cannot determine your relationships with businesses or other individuals. You can also choose to revoke ID permissions for any relationship and entities are not allowed to store identifying info about you (i.e. they have to query the government database whenever they need it) similar to how they’re not allowed to store CC info.

JumpCrisscross 2y ago
> You can also choose to revoke ID permissions for any relationship and entities are not allowed to store identifying info about you (i.e. they have to query the government database whenever they need it) similar to how they’re not allowed to store CC info How do you propose doing this without a centralised (or public) place that tracks your relationships? If the answer is local, you'd expect to be inundated with cases within a few years of people who couldn't revoke a permission because they lost their phone or whatnot.
- weddpros 2y ago
  You can look into "Sovereign Identity", which could offer a solution to this very problem, in theory. It's a decentralised digital identity framework using cryptography. The idea is to take identity upside down: you issue your own identity (think key pair), and an authority certifies it (aka. signature). That's why it's called sovereign. Adding zero knowledge proofs adds support for more privacy preserving tech: prove your address is in a specific country, without giving your address, or prove your age without giving your birthdate. Although it could all be implemented today, governments don't... because they love centralisation for the power it gives them. European institutions are working on Sovereign Identity projects, but it's mostly 100% centralised bullshit from what I know. As with all things cryptographic, if you don't own the keys, you own nothing.

renaudg 2y ago

The problem may have more to do with Uganda and having a surveillance state than it has to do with National ID cards. Most European countries have them and they are as uncontroversial as passports. Countries without national ID cards are not especially more privacy minded : for the purpose of identity verification they just use alternative documents & processes that are less straightforward and at least as intrusive (e.g. driving licenses, utility bills and credit checks in the US and UK). IMO it's much more honest to recognize that there's a legitimate need to be able to prove one's identity in a functioning society, and to build a dedicated system for that, instead of tying your existence as a citizen to your ability / willingness to drive a large piece of metal around.

olyjohn 2y ago
I'm every state that I am aware of, you can get and ID card that is not a drivers license. So it's not really got anything to do with driving.
- deleted 2y ago
  [deleted]
mattmaroon 2y ago
The US functionally has it. Your driver’s license goes into a national database, as do your license plates and social security number. I can drive through Oklahoma (several states away) and their system will automatically read my plates at a toll road and a bill will arrive at my home. Our licenses now need a federal registration for us to board a plane. I think states have dropped issuing the ones that don’t. The NSA probably has everyone’s cell number, text messages, and metadata (including location) stored. With tech being what it is these days anonymity doesn’t exist.
- rootusrootus 2y ago
  > I think states have dropped issuing the ones that don’t. Some have. Oregon, as a single example, will let you opt for a non-Real ID card.

treebeard901 2y ago

At least in the United States and many other places, the surveillance state IDs you a million ways before you ever get to an ID, even if it has some form of RFID, NFC, etc... ID cards also do not collect data like everything people give up willingly every day.

jgeada 2y ago

People get caught up in this all the damn time, and blame the wrong system. There should always 3 steps in accessing a secure system (eg bank account): Identity, Authentication, Authorization. Just because there is a unique identifier that is known publicly, it does not imply that the person presenting that identifier is the actual entity to which that identifier was issued. The identifier is just an identier, it does not prove anything. It is not really all that different than your name. Just knowing your name should not give me access to anything. To prove the entity presenting the identifier is actually the entity to which the identifier belongs you have to do authentication. And authentication does have to rely on some sort of secure exchange of secrets (ie not of publicly available information). These should be secrets known only to the correct entity and to the entity performing authentication (and authenticator need not even be the same organization that issued the identifier in the first place) And once you've matched the entity to the identifier, then the last step: does that entity with that identifier have the authorization to perform whatever task they're asking to be done? Not every entity has the equivalent of root access to everything they have legitimate access to. Identity, Authentication, Authorization. 3 different steps, with 3 different sets of constraints. The problem in the US is most organizations never perform any even vaguely valid authentication validation. SS#, phone number and an address or two (all public data, if you're willing to pay one of the credit bureaus) and you can get access to most random person's accounts.

deleted 2y ago
[deleted]
M95D 2y ago
In fact, you can have Authorization without identity, directly based on a secret, but who would use that when we can request Identity with background tracking.
mcshicks 2y ago
There is a bill working it's way (slowly) through the US Congress, you can write your local congressman and senators. https://www.congress.gov/bill/118th-congress/senate-bill/884/all-info#:~:text=Introduced%20in%20Senate%20(03%2F21%2F2023)&text=Act%20of%202023-,This%20bill%20establishes%20a%20temporary%20task%20force%20to%20recommend%20secure,a%20service%20online%20or%20electronically https://www.congress.gov/bill/118th-congress/senate-bill/884...).

potatoball 2y ago

https://archive.ph/Swy3x https://archive.ph/Swy3x

diebeforei485 2y ago

The problem isn't ID cards. European countries also have ID cards but don't have so much surveillance.

was_a_dev 2y ago
Conversely, in the UK we don't have ID cards, but have a fair bit more surveillance

impish9208 2y ago

Dupe: https://news.ycombinator.com/item?id=40580354 https://news.ycombinator.com/item?id=40580354

nxobject 2y ago

Not national ID cards - biometric ID.

nox101 2y ago

They're trying to do the same in the USA https://www.dhs.gov/real-id https://www.dhs.gov/real-id The ACLU claims to be trying to fight it but AFAICT they aren't actually doing anything https://www.aclu.org/issues/privacy-technology/national-id/real-id https://www.aclu.org/issues/privacy-technology/national-id/r... I was going to sign up for one but then they wanted so much stupid info. It was ridiculous. I can get a passport with less info than a REAL ID. They wanted billing statements and they wanted to know a "permanent address". None of my addresses are "permanent".

mobiuscog 2y ago

Most people in the West now buy things with credit cards and constantly use their phone. These are absolutely not identity providers, but they provide far more tracking in day-to-day life than an ID card would, with none of the actual benefits. ID cards only facilitate a surveillance state, when they are monitored for every purpose... mobile phones and payment cards (even loyalty cards) already provide that. UK taxes are based upon a (National Insurance) number, or at least contributions are, which is explicitly stated as 'not' being an identifier, and often has the same number used by multiple people. There seem to be many ways that identity is handled that create massive technical debt, but very few that actually try to do it correctly for the actual benefit of citizens.

zabzonk 2y ago
the UK NI number seems to work pretty well. i rang up the DWP last year to claim my state pension, gave them my name, dob and NI number(and bank details) and got payments starting a couple of weeks later.

dzink 2y ago

In the US, instead of a clear identifier (which saves you time and energy), you have private party intermediaries that make themselves a lazily insecure buffer to provide the same service at a cost. Some have twisted themselves to provide dual service and increase profit in the process (credit bureaus, credit card intermediaries, insurance companies, etc). Entire industries can stoke fear of privacy risks to ensure they have a place in the ecosystem, while at the same time delivering the worst breaches for millions of Americans again and again. The ability to transact without friction creates a lot more value than the perceived protection of entities that pretend to care about your privacy, but have no real incentive to actually do so.

tamiral 2y ago

the free social media app usage in a lot of east african countries is also a means of surveillance... ex (no data counted to your plan when using whataspp, instagram, messenger, facebook etc).

akasakahakada 2y ago

FYI Japan is going to (in progrees) do the same shit.