2 ms·
This is trivializing the amount of backend system migration that's required to change core identifiers. If they could push a button and use new identifiers, th
by ethbr1 2y ago
This is trivializing the amount of backend system migration that's required to change core identifiers.
If they could push a button and use new identifiers, they'd do that today.
However, in reality that means cracking open 50 years of code and systems.
- kbolino 2y agoYou don't need to change the core identifiers. You just need to stop treating (at an institutional and broader system level) mere knowledge of those identifiers alone as sufficient proof of a user's authenticity. For the most part, the 50-year-old hard-to-change code is already surrounded by other systems which can be adapted more easily anyway.
- ethbr1 2y agoPoint, in internal vs external sense. What else would you use though? (in the US) I can't think of any broadly-existing alternatives. You could perhaps have people opt-in to a newly-created, cryptographically-secure ID replacement.
- kbolino 2y agoThis is the real and hard problem to solve. As far as I know, there are identity-verification services using other, semi-publicly-available data, which can still be spoofed for a lot of people, and some that use just-in-time photography (of your face, driver's license, passport, etc.), but that relies on more on-device security (and thus less end-user ownership of their devices). It ultimately falls to the government to provide a more robust solution.
- gedy 2y agoWell, then these institutions can take more responsibility when their weak auth is exploited to defraud innocent people, vs "sucks to have your 'identity' stolen!"