2 ms·

> The state revoking the statement "license #12345678 is a valid credential for Bob Smith". "#12345678" as I used it was the "driver's license number". This is

> The state revoking the statement "license #12345678 is a valid credential for Bob Smith". "#12345678" as I used it was the "driver's license number". This isn't a serial number for the issued credential, but rather a numeric name for the given person. Adding a serial number for each issued credential such that there can be an online revocation protocol might make sense, but it's not what we have now. Banks, and especially online banks, are definitely optimizing for account opening convenience rather than caring about fraud. They could most certainly require a notarized form to open an account (which requires verifying an ID in person), they'd just rather not because it would interrupt some new customers signing up. Which is why I say the main regulatory reform we need starts with making them fully cover the damage they've opted for. If they continue to make the same tradeoff that's fine - as long as they stop harming the public with the backscatter. Also as I said in my original comment, we need a privacy law like the GDPR before it makes sense to support any smoother systems of authentication. The existing identification systems are already being abused so routinely and thoroughly by the surveillance industry, so this isn't an abstract concern. As things currently stand there are virtually no regulations on creating surveillance dossiers, so the more friction keeping businesses away from frivolously asking for ID (and then backhauling your activity), the better.

lxgr 2y ago
At least my license has a document ID in addition to the license ID. There's also a barcode on the back that looks high-entropy enough that it could at least contain a URL, and maybe even a digitally signed statement by the issuing authority. Between these two things alone, it should be possible for an issuing authority to publish a document number revocation list that verifiers can query in a privacy-preserving way (i.e. without the issuer learning who's checking somebody's license when) > the more friction keeping businesses away from frivolously asking for ID (and then backhauling your activity), the better. Is it, though? Banks and even random places like Airbnbs still regularly ask me for a photo of my driver's license for all kinds of purposes, so arguably this is the worst of both worlds: Pervasive data collection without actual security against fraud. How would this be any worse if the ID verification was at least more secure, if not hopefully also more private (which is more likely with a digital signature than with a photo of a license in any case; how would you anonymize the photo of something inherently identifying)?

lxgr 2y ago

At least my license has a document ID in addition to the license ID. There's also a barcode on the back that looks high-entropy enough that it could at least contain a URL, and maybe even a digitally signed statement by the issuing authority. Between these two things alone, it should be possible for an issuing authority to publish a document number revocation list that verifiers can query in a privacy-preserving way (i.e. without the issuer learning who's checking somebody's license when) > the more friction keeping businesses away from frivolously asking for ID (and then backhauling your activity), the better. Is it, though? Banks and even random places like Airbnbs still regularly ask me for a photo of my driver's license for all kinds of purposes, so arguably this is the worst of both worlds: Pervasive data collection without actual security against fraud. How would this be any worse if the ID verification was at least more secure, if not hopefully also more private (which is more likely with a digital signature than with a photo of a license in any case; how would you anonymize the photo of something inherently identifying)?