6 ms·

> credit bureau industries are obviously impossible to run safely and should be destroyed I am not sure I agree with that premise. I would say there are liter

> credit bureau industries are obviously impossible to run safely and should be destroyed I am not sure I agree with that premise. I would say there are literally no incentives to secure that data and no penalty for leaking it. Hence for profit businesses will never operate this securely. I think it’s the same conclusion but a worthy distinction

scarmig 2y ago
There's no way for someone to make an identifier that's also a secret secure. You could have huge penalties, give the corporate death penalty, and you'd simply see old insecure companies replaced with new insecure companies. Add a real death penalty for the CEO, and you'd just find all the new companies are run by people who have nothing left to lose (or death row inmates suddenly find they have a bunch of new opportunities).
- Jensson 2y ago
  Secure identification is a solved problem, you have a public part and a hidden secret part. Everyone knows your public part, but the companies never knows your secret part so they can't impersonate you. This is what other countries are doing, this is a solved problem so identify theft shouldn't happen any more in any competently run country.
  - nonrandomstring 2y ago
    You may be taking a narrow view of "the problem". Stella Rimington, head of British (internal) intelligence (MI5) courageously spoke some clear truth a couple of decades ago. She said there isn't and cannot be a reliable connection between information and an active body in the world with agency. In other words, she thought "identity" is a weak idea and forcefully opposed the idea of "ID cards". Individuals may occasionally be of interest in intelligence, but less than you think. Identity really comes from banking, law and medicine so that we don't give the wrong person money, drugs or put the wrong person in jail. It's low-level, procedural, civic stuff. Beyond that there's a lot more dark, unwanted applications of identity and we forget how much it is a cultural artefact of the individualistic society we presently inhabit. We do have plenty of nearly-good ways of _re_cognising_ a living person, if we have previously "cognised" them. Images, voices, faces, and various biological scans are all limited and likely to be defeated with coming technology. So separating "trust" (as expected behaviour) from identity is a major challenge, and a most fascinating one. They are not the same thing.
    - monkeyfun 2y ago
      Could you share a quote or source for others to check out what she said? It sounds very interesting, I'd love to read or listen to what she had to say there.
      - nonrandomstring 2y ago
        These [0,1,2] are press opinions on her opposition to ID back then. The woman behind all that is far more interesting, but I can't find you more direct sources. She's a writer (fiction) too and may have expressed more in her autobiography or stories after coming out. [0] https://www.theguardian.com/uk/2005/nov/16/idcards.uksecurity https://www.theguardian.com/uk/2005/nov/16/idcards.uksecurit... [1] https://www.mirror.co.uk/news/uk-news/a-really-bad-idea-565683 https://www.mirror.co.uk/news/uk-news/a-really-bad-idea-5656... [2] https://www.theguardian.com/uk/2005/nov/17/idcards.immigrationpolicy https://www.theguardian.com/uk/2005/nov/17/idcards.immigrati...
        Jensson 2y ago
        > Her own opinion was that ID cards would be of use "but only if they can be made unforgeable". Internet identifiers with private keys are unforgeable unless the certificate authority is compromised, so seems like she would be in favor of this. There is no disadvantage with this compared to just having a public identifier with no private part (current SSN scheme in USA).
        nonrandomstring 2y ago
        > so seems like she would be in favor of this No I don't think she would approve of any zealous solutionism. Not that I personally drink tea with her, but from what I've read SR occupies that class of intellect that deals in philosophical fundamentals of human affairs high above the 'technician' who says "Oh we've solved this with new fangled thing X now". And I'd bet my comfiest boots on some "certificate authority" being compromised before the ink is dry on this comment. I mean... look at what the title of this thread is about. :)
  - TeMPOraL 2y ago
    That doesn't solve the whole problem. Identity is fundamentally about what you are. What you have, or what you know, are merely proxies, and they need to be connected to you in a trusted way, which is hard to do in a robust and efficient way. Or, in other words, when you misplace your private key, you don't want to irrecoverably lose everything you have. Fortunately, the world isn't some nightmarish cryptocurrency dystopia - there are ways to prove you owned the lost credentials and keep the ownership of what you had. The flip side of it is that someone else can prove they own your stuff too, with enough effort.
    - Jensson 2y ago
      It solves the problem of having to give the company enough information for them to steal your identity in order to do business with them. That isn't a power companies should have over you, and those who do should be extremely heavily regulated to ensure their data protection is top level quality. This way it isn't a big deal if small businesses leak data, since they don't have the important parts, so they don't need to be regulated that hard.
- thayne 2y ago
  > There's no way for someone to make an identifier that's also a secret secure. There is, but it requires assymetric cryptography, so entities can verify you have access to the private key without having access themselves. And that would be more technically sophisticated, and difficult to deploy, so I don't see it happening any time soon.
- briffle 2y ago
  Right, its not like you have a public identitifier (your email address) with a secret (your password or even MFA)... Could you imagine if we just treated knowing your email as being proof it was you in financial deals?
- akdev1l 2y ago
  > There's no way for someone to make an identifier that's also a secret secure. umm what? Private-Public key authentication exists.
  - scarmig 2y ago
    The public key is, by definition, not a secret.
bee_rider 2y ago
I agree. I think it is not theoretically impossible, but it is we live in a world where these services are offered by race-to-the-bottom-of-the barrel providers (to merge a couple expressions).

scarmig 2y ago

There's no way for someone to make an identifier that's also a secret secure. You could have huge penalties, give the corporate death penalty, and you'd simply see old insecure companies replaced with new insecure companies. Add a real death penalty for the CEO, and you'd just find all the new companies are run by people who have nothing left to lose (or death row inmates suddenly find they have a bunch of new opportunities).

Jensson 2y ago
Secure identification is a solved problem, you have a public part and a hidden secret part. Everyone knows your public part, but the companies never knows your secret part so they can't impersonate you. This is what other countries are doing, this is a solved problem so identify theft shouldn't happen any more in any competently run country.
- nonrandomstring 2y ago
  You may be taking a narrow view of "the problem". Stella Rimington, head of British (internal) intelligence (MI5) courageously spoke some clear truth a couple of decades ago. She said there isn't and cannot be a reliable connection between information and an active body in the world with agency. In other words, she thought "identity" is a weak idea and forcefully opposed the idea of "ID cards". Individuals may occasionally be of interest in intelligence, but less than you think. Identity really comes from banking, law and medicine so that we don't give the wrong person money, drugs or put the wrong person in jail. It's low-level, procedural, civic stuff. Beyond that there's a lot more dark, unwanted applications of identity and we forget how much it is a cultural artefact of the individualistic society we presently inhabit. We do have plenty of nearly-good ways of _re_cognising_ a living person, if we have previously "cognised" them. Images, voices, faces, and various biological scans are all limited and likely to be defeated with coming technology. So separating "trust" (as expected behaviour) from identity is a major challenge, and a most fascinating one. They are not the same thing.
  - monkeyfun 2y ago
    Could you share a quote or source for others to check out what she said? It sounds very interesting, I'd love to read or listen to what she had to say there.
    - nonrandomstring 2y ago
      These [0,1,2] are press opinions on her opposition to ID back then. The woman behind all that is far more interesting, but I can't find you more direct sources. She's a writer (fiction) too and may have expressed more in her autobiography or stories after coming out. [0] https://www.theguardian.com/uk/2005/nov/16/idcards.uksecurity https://www.theguardian.com/uk/2005/nov/16/idcards.uksecurit... [1] https://www.mirror.co.uk/news/uk-news/a-really-bad-idea-565683 https://www.mirror.co.uk/news/uk-news/a-really-bad-idea-5656... [2] https://www.theguardian.com/uk/2005/nov/17/idcards.immigrationpolicy https://www.theguardian.com/uk/2005/nov/17/idcards.immigrati...
      - Jensson 2y ago
        > Her own opinion was that ID cards would be of use "but only if they can be made unforgeable". Internet identifiers with private keys are unforgeable unless the certificate authority is compromised, so seems like she would be in favor of this. There is no disadvantage with this compared to just having a public identifier with no private part (current SSN scheme in USA).
        nonrandomstring 2y ago
        > so seems like she would be in favor of this No I don't think she would approve of any zealous solutionism. Not that I personally drink tea with her, but from what I've read SR occupies that class of intellect that deals in philosophical fundamentals of human affairs high above the 'technician' who says "Oh we've solved this with new fangled thing X now". And I'd bet my comfiest boots on some "certificate authority" being compromised before the ink is dry on this comment. I mean... look at what the title of this thread is about. :)
- TeMPOraL 2y ago
  That doesn't solve the whole problem. Identity is fundamentally about what you are. What you have, or what you know, are merely proxies, and they need to be connected to you in a trusted way, which is hard to do in a robust and efficient way. Or, in other words, when you misplace your private key, you don't want to irrecoverably lose everything you have. Fortunately, the world isn't some nightmarish cryptocurrency dystopia - there are ways to prove you owned the lost credentials and keep the ownership of what you had. The flip side of it is that someone else can prove they own your stuff too, with enough effort.
  - Jensson 2y ago
    It solves the problem of having to give the company enough information for them to steal your identity in order to do business with them. That isn't a power companies should have over you, and those who do should be extremely heavily regulated to ensure their data protection is top level quality. This way it isn't a big deal if small businesses leak data, since they don't have the important parts, so they don't need to be regulated that hard.
thayne 2y ago
> There's no way for someone to make an identifier that's also a secret secure. There is, but it requires assymetric cryptography, so entities can verify you have access to the private key without having access themselves. And that would be more technically sophisticated, and difficult to deploy, so I don't see it happening any time soon.
briffle 2y ago
Right, its not like you have a public identitifier (your email address) with a secret (your password or even MFA)... Could you imagine if we just treated knowing your email as being proof it was you in financial deals?
akdev1l 2y ago
> There's no way for someone to make an identifier that's also a secret secure. umm what? Private-Public key authentication exists.
- scarmig 2y ago
  The public key is, by definition, not a secret.

bee_rider 2y ago

I agree. I think it is not theoretically impossible, but it is we live in a world where these services are offered by race-to-the-bottom-of-the barrel providers (to merge a couple expressions).