3 ms·

I actually think national ID systems need a dual mechanism where you can hand out IDs that are unique for any given relationship you establish. That way busines

I actually think national ID systems need a dual mechanism where you can hand out IDs that are unique for any given relationship you establish. That way business relationships can be formed with the government providing assurance of identity, but even if the business leaks all those ID numbers nothing can actually happen to you unless the business’ private key is stolen. Similarly, the government can only establish your identity but cannot determine your relationships with businesses or other individuals. You can also choose to revoke ID permissions for any relationship and entities are not allowed to store identifying info about you (i.e. they have to query the government database whenever they need it) similar to how they’re not allowed to store CC info.

JumpCrisscross 2y ago
> You can also choose to revoke ID permissions for any relationship and entities are not allowed to store identifying info about you (i.e. they have to query the government database whenever they need it) similar to how they’re not allowed to store CC info How do you propose doing this without a centralised (or public) place that tracks your relationships? If the answer is local, you'd expect to be inundated with cases within a few years of people who couldn't revoke a permission because they lost their phone or whatnot.
- weddpros 2y ago
  You can look into "Sovereign Identity", which could offer a solution to this very problem, in theory. It's a decentralised digital identity framework using cryptography. The idea is to take identity upside down: you issue your own identity (think key pair), and an authority certifies it (aka. signature). That's why it's called sovereign. Adding zero knowledge proofs adds support for more privacy preserving tech: prove your address is in a specific country, without giving your address, or prove your age without giving your birthdate. Although it could all be implemented today, governments don't... because they love centralisation for the power it gives them. European institutions are working on Sovereign Identity projects, but it's mostly 100% centralised bullshit from what I know. As with all things cryptographic, if you don't own the keys, you own nothing.
  - arcticbull 2y ago
    > As with all things cryptographic, if you don't own the keys, you own nothing. Ownership is a social construct and socially enforced, pretending otherwise isn't particularly effective. The last few years must have at least taught us that much.
  - yownie 2y ago
    Is that what [this project](https://rns.id/app/palauidinfo https://rns.id/app/palauidinfo) is trying to do in Palua?
    - weddpros 2y ago
      looks like it... DIDs are a part of the tech
  - Arainach 2y ago
    >As with all things cryptographic, if you don't own the keys, you own nothing And so when someone on the street steals your wallet or your house burns down, you no longer own anything. Brilliant!
    - weddpros 2y ago
      Exactly like with your paper wallet, you'll have to go to the authorities and they'll have to certify your new ID / keys... except it's possible to rekey you identity, to have escrows hold rescue keys, etc... many things you can't do without a Digital ID. Brilliant indeed
arcticbull 2y ago
Genuinely this appears to introduce unnecessary friction. After all, if you can trust the government, you don't need this feature. If you cannot trust the government, then it is safe to assume that they aren't just sitting on their hands pouting that there's no national ID they can use to tie together an identity with. I think it's dangerously naive to assume a nation with as capable a surveillance state as the US to be physically unable to tie together everything about you just because there's no national ID.
- sambazi 2y ago
  > Genuinely this appears to introduce unnecessary friction. After all, if you can trust the government but if you can't trust the government, the friction is necessary. > unable to tie together everything about you just because there's no national ID. SSN anyone?
  - arcticbull 2y ago
    If you can’t trust the government, the friction is irrelevant. They just generate a different primary key and don’t give it to you. Evil adversaries don’t play by rules. You’re just harming yourself in the good times and not helping yourself in the bad times. It's not like a government who wants to do real harm to individuals is just going to go whelp, no national ID, I guess we'll just go home and not hurt anyone. If I were a hypothetical evil US government and there wasn't an SSN, I'd just create a database with an INTEGER PRIMARY KEY, compel Visa, MasterCard and American Express to send me 6 months of transaction history under a national security letter, correlate and quantize them all and presto, a few hours later, indexing complete. It doesn't even have to be 95% accurate, although with some otherwise-anonymous looking demographics data you can get several nines of uniqueness. [1] [1] https://dataprivacylab.org/projects/identifiability/paper1.pdf https://dataprivacylab.org/projects/identifiability/paper1.p...
    - BurningFrog 2y ago
      This makes sense if you think `government_trustworthiness` is a `Boolean.` If you think it's a `Float in range [0..100]` it makes a lot less sense.
janosdebugs 2y ago
Last I checked you are allowed to store CC info apart from the security code if you follow the PCI-DSS rules.
- vlovich123 2y ago
  Yeah you have to pay a bunch of money and follow a bunch of rules and even then I think you can’t store CVV?
guyomes 2y ago
Another approach is the one implemented in Estonia. A citizen there has the ability to query who has accessed their records [1]. Combined with proper laws, this feature lead to "some very public cases of government officials being caught accessing private data of Citizens - without any legitimate and authorized reason for such access." Note that through this mechanism, the society is still a control society [2], even though citizen themselves have more to say in that control. [1]: https://doi.org/10.1007/s12553-017-0195-1 https://doi.org/10.1007/s12553-017-0195-1 [2]: https://en.wikipedia.org/wiki/Gilles_Deleuze#Values https://en.wikipedia.org/wiki/Gilles_Deleuze#Values
- Teever 2y ago
  I'm a dual Estonian-Canadian citizen and after getting my Estonian national ID card last year I just bought a card reader to log into the digital services. I'm absolutely blown away by how clear and functional these services are and how seamless and user friendly the whole thing is. I just signed up for blood transfusions should I ever need them in Estonia and that process involved using my smart card to sign the consent agreement and can see which department and when accessed this information. Meanwhile the province I'm from is still handing out paper healthcare cards in 2024.
- BurningFrog 2y ago
  Estonias government started fresh from nothing in the 1990's, and got a lot of things right.

JumpCrisscross 2y ago

> You can also choose to revoke ID permissions for any relationship and entities are not allowed to store identifying info about you (i.e. they have to query the government database whenever they need it) similar to how they’re not allowed to store CC info How do you propose doing this without a centralised (or public) place that tracks your relationships? If the answer is local, you'd expect to be inundated with cases within a few years of people who couldn't revoke a permission because they lost their phone or whatnot.

weddpros 2y ago
You can look into "Sovereign Identity", which could offer a solution to this very problem, in theory. It's a decentralised digital identity framework using cryptography. The idea is to take identity upside down: you issue your own identity (think key pair), and an authority certifies it (aka. signature). That's why it's called sovereign. Adding zero knowledge proofs adds support for more privacy preserving tech: prove your address is in a specific country, without giving your address, or prove your age without giving your birthdate. Although it could all be implemented today, governments don't... because they love centralisation for the power it gives them. European institutions are working on Sovereign Identity projects, but it's mostly 100% centralised bullshit from what I know. As with all things cryptographic, if you don't own the keys, you own nothing.
- arcticbull 2y ago
  > As with all things cryptographic, if you don't own the keys, you own nothing. Ownership is a social construct and socially enforced, pretending otherwise isn't particularly effective. The last few years must have at least taught us that much.
- yownie 2y ago
  Is that what [this project](https://rns.id/app/palauidinfo https://rns.id/app/palauidinfo) is trying to do in Palua?
  - weddpros 2y ago
    looks like it... DIDs are a part of the tech
- Arainach 2y ago
  >As with all things cryptographic, if you don't own the keys, you own nothing And so when someone on the street steals your wallet or your house burns down, you no longer own anything. Brilliant!
  - weddpros 2y ago
    Exactly like with your paper wallet, you'll have to go to the authorities and they'll have to certify your new ID / keys... except it's possible to rekey you identity, to have escrows hold rescue keys, etc... many things you can't do without a Digital ID. Brilliant indeed

arcticbull 2y ago

Genuinely this appears to introduce unnecessary friction. After all, if you can trust the government, you don't need this feature. If you cannot trust the government, then it is safe to assume that they aren't just sitting on their hands pouting that there's no national ID they can use to tie together an identity with. I think it's dangerously naive to assume a nation with as capable a surveillance state as the US to be physically unable to tie together everything about you just because there's no national ID.

sambazi 2y ago
> Genuinely this appears to introduce unnecessary friction. After all, if you can trust the government but if you can't trust the government, the friction is necessary. > unable to tie together everything about you just because there's no national ID. SSN anyone?
- arcticbull 2y ago
  If you can’t trust the government, the friction is irrelevant. They just generate a different primary key and don’t give it to you. Evil adversaries don’t play by rules. You’re just harming yourself in the good times and not helping yourself in the bad times. It's not like a government who wants to do real harm to individuals is just going to go whelp, no national ID, I guess we'll just go home and not hurt anyone. If I were a hypothetical evil US government and there wasn't an SSN, I'd just create a database with an INTEGER PRIMARY KEY, compel Visa, MasterCard and American Express to send me 6 months of transaction history under a national security letter, correlate and quantize them all and presto, a few hours later, indexing complete. It doesn't even have to be 95% accurate, although with some otherwise-anonymous looking demographics data you can get several nines of uniqueness. [1] [1] https://dataprivacylab.org/projects/identifiability/paper1.pdf https://dataprivacylab.org/projects/identifiability/paper1.p...
  - BurningFrog 2y ago
    This makes sense if you think `government_trustworthiness` is a `Boolean.` If you think it's a `Float in range [0..100]` it makes a lot less sense.

janosdebugs 2y ago

Last I checked you are allowed to store CC info apart from the security code if you follow the PCI-DSS rules.

vlovich123 2y ago
Yeah you have to pay a bunch of money and follow a bunch of rules and even then I think you can’t store CVV?

guyomes 2y ago

Another approach is the one implemented in Estonia. A citizen there has the ability to query who has accessed their records [1]. Combined with proper laws, this feature lead to "some very public cases of government officials being caught accessing private data of Citizens - without any legitimate and authorized reason for such access." Note that through this mechanism, the society is still a control society [2], even though citizen themselves have more to say in that control. [1]: https://doi.org/10.1007/s12553-017-0195-1 https://doi.org/10.1007/s12553-017-0195-1 [2]: https://en.wikipedia.org/wiki/Gilles_Deleuze#Values https://en.wikipedia.org/wiki/Gilles_Deleuze#Values

Teever 2y ago
I'm a dual Estonian-Canadian citizen and after getting my Estonian national ID card last year I just bought a card reader to log into the digital services. I'm absolutely blown away by how clear and functional these services are and how seamless and user friendly the whole thing is. I just signed up for blood transfusions should I ever need them in Estonia and that process involved using my smart card to sign the consent agreement and can see which department and when accessed this information. Meanwhile the province I'm from is still handing out paper healthcare cards in 2024.
BurningFrog 2y ago
Estonias government started fresh from nothing in the 1990's, and got a lot of things right.