6 ms·

Government provided digital IDs would solve a lot of this. Yes, they may have their own problems, but outsourcing the action of identifying individuals to the

Government provided digital IDs would solve a lot of this. Yes, they may have their own problems, but outsourcing the action of identifying individuals to the government seems valuable and less prone to "lock outs" like Google and friends.

throwaway237289 2y ago
[flagged]
jpalomaki 2y ago
Yes. I would very much like to tie certain accounts to my government issued digital identity and allow that as the only recovery method.
JumpCrisscross 2y ago
> Government provided digital IDs would solve a lot of this A lot of what? It seems like the worst of all worlds, given that ID would not only unlock some highly sensitive things, but also be difficult to change and tremendously revealing.
- deleted 2y ago
  [deleted]
- iknowstuff 2y ago
  Nah the government could just give a website a unique id per real user per website, without revealing who the user is. Merely verifying that they are the same person as last time.
quectophoton 2y ago
It certainly is an alternative we can at least think about. On one hand, the certs you'd use to login to websites wouldn't even need to include any personal info at all, just a valid signature from a CA that the website knows how to verify. And the certificate wouldn't need to be the same for every website, it could be one you generate for a specific website. On the other hand, a lot of thought would need to be put into how expiration/renewal and revocation would play into this. Of course there should be an evaluation of the ways this could go wrong if someone from the gov misuses this CA, and how that compares to someone from your current email provider misusing their permissions. But if nothing else, something I really want is to just be able to have an email address like `random_id@my_country.my_country_tld`, to at least have an email address where I don't have to worry about being locked out, so that I can give freely to ISP, bank, grocery delivery websites, other local companies, etc. Most of this stuff I wouldn't even mind receiving as postal mail anyway. And if shit hits the fan, I can recover access to this email account by walking to an office and identifying myself.
- layer8 2y ago
  Having only a single such address also means you can be blacklisted forever, in addition to being tracked across services.
  - quectophoton 2y ago
    What I had in mind was more like randomly generated addresses as needed, all of them linked to your (one) mailbox. Like Apple's "Hide My Email", but without needing a "main"/"canonical" email address because it would be unnecessary anyway (because you would be logging in to your mailbox with your own certificate). But even if that single-address limitation were the case, the kind of places I would give it to already require knowing my national ID number anyway, so the two particular things you mention are already the status quo. In other words, stuff that is already tied to having a verifiable citizenship.
ristos 2y ago
It exists for US citizens at least: login.gov (https://developers.login.gov/oidc/getting-started/ https://developers.login.gov/oidc/getting-started/) It has it's pros and cons, maybe more pros if you factor in that the biggest issue isn't authentication really, it's the fact that all of these private companies accrue everyone's sensitive info, which can be abused by any actor, private or public. If data were kept on the client side, and synced to other machines through P2P like WebRTC, then maybe this wouldn't be such a big deal.
- joncfoo 2y ago
  Unfortunately login.gov is only available for use by companies doing business with the US government.
  - capitainenemo 2y ago
    Also login.gov isn't a government issued digital ID. It's just a centralised authentication platform for government use, much like using google or apple for authentication. It supports the usual options for multifactor (TOTP, text, yubikey/other hardware auth/PIV cards) but for most users it probably ends up being SMS. At best TOTP.
DANmode 2y ago
Humans understanding the basic concept of public/private keys, wanting a Yubikey or similar, and/or being able to use basic tools to make a key, would also help. But I'll take the government-led method as a Plan B, if it works.
aucisson_masque 2y ago
> Government provided digital IDs Oh man, that sounds like a terrible idea privacy wise. Every website would make use of it to track it's user.
- pennomi 2y ago
  I think it makes sense as the master recovery account. Then you use a secondary account for everything else.
- eaglemfo 2y ago
  The german gov ids actually have a way to issue pseudonymous tokens where websites can only see that you are the same person as last time. You can't make 2 accounts on the same site if sich things are unwanted. You can't link accounts across providers. How it works under the hood? No specific idea. I wonder if its sound.
  - rangestransform 2y ago
    The problem is the government can then definitively associate all your accounts with your real identity
    - noAnswer 2y ago
      How does the government know which token a ID card generated? The ID card itself generates (for each service a different one) and encrypts it. Not even the card reader can read it. It is a encrypted channel between the card and the ID-server for the site/service. The pseudonym function does not identify a person but a card.
      - jack_pp 2y ago
        If it identifies the card and the govt can identify you by your card then isn't it by definition identifying the person?
        2y ago
j45 2y ago
I'm not so sure how many ppl would leave a key to their house, or a pin to their bank account with the government. Or a bank. Identity is relatively solved, there are just lots of sacrifices made in security in the name of convenience. Fingerprints as consent to login, Facial recognition as consent to login... seems more like a username, than a password, or a username+password.
terribleperson 2y ago
I think I've said it before, but I want USPS-provided email. To set one up you'd go to a post office, verify your identity in some way, and set up an email. If you forget your password and want to recover it, you'd have to go back into a post office and verify your identity again.
- weikju 2y ago
  Now you lock out the rest of the world until they can implement this and federate identities between countries.
  - scubbo 2y ago
    That's not a problem. Many systems and services have launched geolocked to certain countries before later expanding (Google Voice, for one).
- hnbad 2y ago
  Germany has PostIdent: you are issued a code, take it to the closest post office, hand them the code (originally this involved printouts) and your ID card and they scan your ID card and enter it into their system where the issuer of the code can then request that info to verify your identity. This has largely been replaced by videochat for ID card verification where some underpaid person walks you through holding your ID card in front of your smartphone cameras to verify that it's real, not CG, not tampered with and matches your claimed identity. The critical aspect here is that you don't have to hand your ID card (or a picture of it) to the company that wants to know your identity. The post office or the videochat provider serves as a trusted source of truth.
  - elros 2y ago
    Initially when I moved to Germany I thought it was a bit of a hassle to have to go to the post office for PostIdent; now I actually miss the elegance and privacy of that system in other countries.
  - noAnswer 2y ago
ozr 2y ago
I haven't heard a compelling argument that anything needs to be fixed with email-based auth patterns. It is imperfect but not bad, and every proposed alternative seems to be worse. The article seems to lean into security and usability concerns. On the security front: the weak-point is still the human. If you hand over your credentials to someone nefarious, well.. you handed over your credentials to someone nefarious. Usability isn't convincing me either. One of the great things about email is that it really is the lowest-common denominator, as another commenter mentioned above. (Almost) everyone, from kids to the most tech-inept luddite have some sort of email.
- JonChesterfield 2y ago
  One flaw is I'm pretty sure a lot gmail account is lost forever. Contacting Google to retrieve access would not go well. Related is that if you try to self host email your messages are unlikely to reach anyone.
  - jerf 2y ago
    Self-hosting outbound email is hard. Self-hosting inbound email is trivial. Anybody will send email to any random domain, they're just not willing to accept it from random sources. And the latter is what is relevant for password recovery. I self-host inbound but use established servers for outbound through my ISP and have had no trouble with that setup for a while. Forwarding to people through my domain has gotten a bit more challenging lately but I've got it working well enough to satisfy gmail so far. (The advantage with forwarding is you only have to convince one server to accept it, not everyone in the world, and there's some crypto stuff involved now that involves trusting some keys, not just a domain or IP, which also helps a lot.)
    - JonChesterfield 2y ago
      That seems a great compromise. I hadn't registered the distinction in direction. Even without organising the forwarding part there are plenty of organisations that email me password resets that I don't need to send email out to.
eaglemfo 2y ago
Wasn't there a recent sidechannel attack on Infineon cryptography chips? The EU passports likely use the Infineon chips.
dilyevsky 2y ago
ID.me kinda already does this. They integrate with IRS, SSA and bunch of local government stuff
- easton 2y ago
  Login.gov is the US Government’s homegrown solution, which also does it. It’s not one account <-> one citizen though, which you’d probably want in a real government id system.
9cb14c1ec0 2y ago
How about a bank-provided digital id that you get when opening an account by walking into a physical bank location and providing your photo ID? It would tick the "less prone to lock out" problem without placing even more power in government hands.
- scrollaway 2y ago
  We have this in Belgium and it’s really not that good. It created a pattern of companies relying on people having an account at certain banks; which when you’re either immigrant or unbanked is unlikely and shuts you out of certain businesses. It’s been phased out for the government provided login system which is much better but not exactly simple for laypeople to set up. On top of this, integrating with it requires an extensive certification process, it’s not just an open API.
  - jks 2y ago
    Banking credentials are used a lot in Finland to sign into other services. This means you get phishing emails saying "your medical test results are available" or "you're getting a tax return" where the actual goal is to get into your bank account.
- deleted 2y ago
  [deleted]
- dalke 2y ago
  Bank provided causes problems with people who don't have bank accounts. Here in Sweden most people use bank-provided electronic ID called "BankID". Quoting "Foreign citizens in Sweden blocked from BankID after several banks roll out new rules" https://www.thelocal.se/20220117/foreign-citizens-in-sweden-blocked-from-bankid-after-banks-roll-out-new-rules https://www.thelocal.se/20220117/foreign-citizens-in-sweden-... > “We have been working systematically for six months to get residence permit cards, then a personal number, then a Skatteverket national ID card, and finally bank accounts. To our shock, we were just told by ICA Banken that the Skatteverket National ID – the only one available to non-citizens – is not a valid source of identification for BankID.” BankID causes problems because it isn't designed for the interests of the whole population. For example, it requires proprietary software which only runs on Microsoft Windows, macOS, iOS, or Android, with hardware verification and Google services. This makes it unacceptable to free software advocates, and to privacy advocates, and to national data sovereignty advocates .. the total population of which is so small as to not affect the banks' commercial interests. One thing I learned recently is how the US can, with its control over the SWIFT banking network, tell banks in other countries to shut down the account for a local citizen who the US has designated a terrorist. At least that's what I gather from the news I read after two leaders of the biggest neo-nazi group here in Sweden were designated as terrorists by the US. If the goal is to keep power out of government hands, don't look to highly-regulated banks which are subject to the whims of multiple governments.
SAI_Peregrinus 2y ago
My wife works in a city clerk's office. They provide (among other things) vital records services for the city. Like getting birth certificates. To get a birth certificate, you must provide government photo ID with a name matching that of one of the names on the certificate you're trying to get. So you can get your own, or your child's, but not some random other person's. Lots of people were born before RealID driver's licenses. Some of them went by names other than the names on their birth certificates, and thus are unable to get new copies of their birth certificates using the government-issued photo ID they currently have. E.g. I've got a grandfather who went by Sam his entire life but was apparently named Harold. His driver's license had Sam as his first name. If he had lost his birth certificate, he would not have been able to obtain a new copy legally using that driver's license! This still happens to people. Also sometimes house fires or similar disasters happen, and people lack the ID needed to get new government-issued ID.
- tsimionescu 2y ago
  These things can be solved too, but in a more complicated process. Typically some lawyers and a judge need to get involved, get some people to testify that you are this same person, and you will be issued new ID.
- WhyNotHugo 2y ago
  How did he get a driver's licence with the name "Sam"? Don't you need some form of judicial process to change your name on this kind of thing?
  - SAI_Peregrinus 2y ago
    Used his Army ID. World War 2 recruitment wasn't big on background checks.
- deleted 2y ago
  [deleted]
cyberax 2y ago
Clear in the US can do that: https://www.clearme.com/for-your-business https://www.clearme.com/for-your-business It's not exactly a government service, but Clear is trusted by the government enough to allow their customers to bypass the airport screenings.
- lotsofpulp 2y ago
  Screw Clear and screw the US government for allowing more privatization of public infrastructure.
JadeNB 2y ago
> Government provided digital IDs would solve a lot of this. Yes, they may have their own problems, but outsourcing the action of identifying individuals to the government seems valuable and less prone to "lock outs" like Google and friends. Sadly, the US government goes the other way and contracts out verification (to government websites!) to an invasive private company.
jks 2y ago
Estonia has this: <https://e-estonia.com/solutions/estonian-e-identity/id-card/ https://e-estonia.com/solutions/estonian-e-identity/id-card/> Finland tried to copy it, but the Finnish card (while based on the same technology) is used very little. Finnish banks already had their own OTP solutions, which they started offering for authentication on other web sites, so no-one wanted an extra authenticator on top of that. This of course means that you get phishing emails pretending to be from all sorts of government services, where the goal is to get your banking credentials and take your money. Since then, mobile phone operators added their own authentication system based on credentials residing on your SIM card <https://mobiilivarmenne.fi/en/ https://mobiilivarmenne.fi/en/>. You prove your identity when getting a mobile phone contract and can then use that to log into many sites.
rocqua 2y ago
identification is different from authentication. But authentication at least as a backstop, can generally be decently outsourced to government. Not so much in the US though. They have no national registry of what citizens actually exist.
alkonaut 2y ago
It does solve a lot of this. Some have gov’t issued IDs, others have a hybrid public/private system where banks issue the ids. But yes, a de facto standard electronic ID is almost unthinkable to not have. How else do you interact with authorities or healthcare? I used e-ID since long before smartphones, I can barely picture what it would be like to log in to handle taxes, benefits medicine recipes or doctors appointments if it worked any other way.
KronisLV 2y ago
> Government provided digital IDs would solve a lot of this. Over here in EU, we have something like it - you get an ID card that has two PIN codes that you can use with a card reader and some software to digitally sign documents and such: https://www.eparaksts.lv/en/ https://www.eparaksts.lv/en/ (of course, there's also a mobile version) In addition, there now are services where you can log in to your bank account, confirm payments, or just log in to your government portal account with a two factor app, the account on which is based on your identity: https://www.smart-id.com/ https://www.smart-id.com/ So if I make a payment online with my card, I'll have to authenticate through either a code calculator (physical piece of hardware) or the phone app with codes that I've chosen, to confirm it. Same for logging into various sites, for example, for paying my utilities. Works pretty well and if I lose my ID card, then I can get a new one, issue new certificates for the apps and continue where I left off (with the old ones being revoked). I might need a backup phone too, though, since not being able to confirm my payments if my phone breaks is pretty stupid (though I guess Revolut/PayPal/whatever still work as expected, unless I only have my OTP codes for those on said phone).

throwaway237289 2y ago

[flagged]

jpalomaki 2y ago

Yes. I would very much like to tie certain accounts to my government issued digital identity and allow that as the only recovery method.

JumpCrisscross 2y ago

> Government provided digital IDs would solve a lot of this A lot of what? It seems like the worst of all worlds, given that ID would not only unlock some highly sensitive things, but also be difficult to change and tremendously revealing.

deleted 2y ago
[deleted]
iknowstuff 2y ago
Nah the government could just give a website a unique id per real user per website, without revealing who the user is. Merely verifying that they are the same person as last time.

quectophoton 2y ago

It certainly is an alternative we can at least think about. On one hand, the certs you'd use to login to websites wouldn't even need to include any personal info at all, just a valid signature from a CA that the website knows how to verify. And the certificate wouldn't need to be the same for every website, it could be one you generate for a specific website. On the other hand, a lot of thought would need to be put into how expiration/renewal and revocation would play into this. Of course there should be an evaluation of the ways this could go wrong if someone from the gov misuses this CA, and how that compares to someone from your current email provider misusing their permissions. But if nothing else, something I really want is to just be able to have an email address like `random_id@my_country.my_country_tld`, to at least have an email address where I don't have to worry about being locked out, so that I can give freely to ISP, bank, grocery delivery websites, other local companies, etc. Most of this stuff I wouldn't even mind receiving as postal mail anyway. And if shit hits the fan, I can recover access to this email account by walking to an office and identifying myself.

layer8 2y ago
Having only a single such address also means you can be blacklisted forever, in addition to being tracked across services.
- quectophoton 2y ago
  What I had in mind was more like randomly generated addresses as needed, all of them linked to your (one) mailbox. Like Apple's "Hide My Email", but without needing a "main"/"canonical" email address because it would be unnecessary anyway (because you would be logging in to your mailbox with your own certificate). But even if that single-address limitation were the case, the kind of places I would give it to already require knowing my national ID number anyway, so the two particular things you mention are already the status quo. In other words, stuff that is already tied to having a verifiable citizenship.

ristos 2y ago

It exists for US citizens at least: login.gov (https://developers.login.gov/oidc/getting-started/ https://developers.login.gov/oidc/getting-started/) It has it's pros and cons, maybe more pros if you factor in that the biggest issue isn't authentication really, it's the fact that all of these private companies accrue everyone's sensitive info, which can be abused by any actor, private or public. If data were kept on the client side, and synced to other machines through P2P like WebRTC, then maybe this wouldn't be such a big deal.

joncfoo 2y ago
Unfortunately login.gov is only available for use by companies doing business with the US government.
- capitainenemo 2y ago
  Also login.gov isn't a government issued digital ID. It's just a centralised authentication platform for government use, much like using google or apple for authentication. It supports the usual options for multifactor (TOTP, text, yubikey/other hardware auth/PIV cards) but for most users it probably ends up being SMS. At best TOTP.

DANmode 2y ago

Humans understanding the basic concept of public/private keys, wanting a Yubikey or similar, and/or being able to use basic tools to make a key, would also help. But I'll take the government-led method as a Plan B, if it works.

aucisson_masque 2y ago

> Government provided digital IDs Oh man, that sounds like a terrible idea privacy wise. Every website would make use of it to track it's user.

pennomi 2y ago
I think it makes sense as the master recovery account. Then you use a secondary account for everything else.
eaglemfo 2y ago
The german gov ids actually have a way to issue pseudonymous tokens where websites can only see that you are the same person as last time. You can't make 2 accounts on the same site if sich things are unwanted. You can't link accounts across providers. How it works under the hood? No specific idea. I wonder if its sound.
- rangestransform 2y ago
  The problem is the government can then definitively associate all your accounts with your real identity
  - noAnswer 2y ago
    How does the government know which token a ID card generated? The ID card itself generates (for each service a different one) and encrypts it. Not even the card reader can read it. It is a encrypted channel between the card and the ID-server for the site/service. The pseudonym function does not identify a person but a card.
    - jack_pp 2y ago
      If it identifies the card and the govt can identify you by your card then isn't it by definition identifying the person?
      - 2y ago

j45 2y ago

I'm not so sure how many ppl would leave a key to their house, or a pin to their bank account with the government. Or a bank. Identity is relatively solved, there are just lots of sacrifices made in security in the name of convenience. Fingerprints as consent to login, Facial recognition as consent to login... seems more like a username, than a password, or a username+password.

terribleperson 2y ago

I think I've said it before, but I want USPS-provided email. To set one up you'd go to a post office, verify your identity in some way, and set up an email. If you forget your password and want to recover it, you'd have to go back into a post office and verify your identity again.

weikju 2y ago
Now you lock out the rest of the world until they can implement this and federate identities between countries.
- scubbo 2y ago
  That's not a problem. Many systems and services have launched geolocked to certain countries before later expanding (Google Voice, for one).
hnbad 2y ago
Germany has PostIdent: you are issued a code, take it to the closest post office, hand them the code (originally this involved printouts) and your ID card and they scan your ID card and enter it into their system where the issuer of the code can then request that info to verify your identity. This has largely been replaced by videochat for ID card verification where some underpaid person walks you through holding your ID card in front of your smartphone cameras to verify that it's real, not CG, not tampered with and matches your claimed identity. The critical aspect here is that you don't have to hand your ID card (or a picture of it) to the company that wants to know your identity. The post office or the videochat provider serves as a trusted source of truth.
- elros 2y ago
  Initially when I moved to Germany I thought it was a bit of a hassle to have to go to the post office for PostIdent; now I actually miss the elegance and privacy of that system in other countries.
- noAnswer 2y ago

ozr 2y ago

I haven't heard a compelling argument that anything needs to be fixed with email-based auth patterns. It is imperfect but not bad, and every proposed alternative seems to be worse. The article seems to lean into security and usability concerns. On the security front: the weak-point is still the human. If you hand over your credentials to someone nefarious, well.. you handed over your credentials to someone nefarious. Usability isn't convincing me either. One of the great things about email is that it really is the lowest-common denominator, as another commenter mentioned above. (Almost) everyone, from kids to the most tech-inept luddite have some sort of email.

JonChesterfield 2y ago
One flaw is I'm pretty sure a lot gmail account is lost forever. Contacting Google to retrieve access would not go well. Related is that if you try to self host email your messages are unlikely to reach anyone.
- jerf 2y ago
  Self-hosting outbound email is hard. Self-hosting inbound email is trivial. Anybody will send email to any random domain, they're just not willing to accept it from random sources. And the latter is what is relevant for password recovery. I self-host inbound but use established servers for outbound through my ISP and have had no trouble with that setup for a while. Forwarding to people through my domain has gotten a bit more challenging lately but I've got it working well enough to satisfy gmail so far. (The advantage with forwarding is you only have to convince one server to accept it, not everyone in the world, and there's some crypto stuff involved now that involves trusting some keys, not just a domain or IP, which also helps a lot.)
  - JonChesterfield 2y ago
    That seems a great compromise. I hadn't registered the distinction in direction. Even without organising the forwarding part there are plenty of organisations that email me password resets that I don't need to send email out to.

eaglemfo 2y ago

Wasn't there a recent sidechannel attack on Infineon cryptography chips? The EU passports likely use the Infineon chips.

dilyevsky 2y ago

ID.me kinda already does this. They integrate with IRS, SSA and bunch of local government stuff

easton 2y ago
Login.gov is the US Government’s homegrown solution, which also does it. It’s not one account <-> one citizen though, which you’d probably want in a real government id system.

9cb14c1ec0 2y ago

How about a bank-provided digital id that you get when opening an account by walking into a physical bank location and providing your photo ID? It would tick the "less prone to lock out" problem without placing even more power in government hands.

scrollaway 2y ago
We have this in Belgium and it’s really not that good. It created a pattern of companies relying on people having an account at certain banks; which when you’re either immigrant or unbanked is unlikely and shuts you out of certain businesses. It’s been phased out for the government provided login system which is much better but not exactly simple for laypeople to set up. On top of this, integrating with it requires an extensive certification process, it’s not just an open API.
- jks 2y ago
  Banking credentials are used a lot in Finland to sign into other services. This means you get phishing emails saying "your medical test results are available" or "you're getting a tax return" where the actual goal is to get into your bank account.
deleted 2y ago
[deleted]
dalke 2y ago
Bank provided causes problems with people who don't have bank accounts. Here in Sweden most people use bank-provided electronic ID called "BankID". Quoting "Foreign citizens in Sweden blocked from BankID after several banks roll out new rules" https://www.thelocal.se/20220117/foreign-citizens-in-sweden-blocked-from-bankid-after-banks-roll-out-new-rules https://www.thelocal.se/20220117/foreign-citizens-in-sweden-... > “We have been working systematically for six months to get residence permit cards, then a personal number, then a Skatteverket national ID card, and finally bank accounts. To our shock, we were just told by ICA Banken that the Skatteverket National ID – the only one available to non-citizens – is not a valid source of identification for BankID.” BankID causes problems because it isn't designed for the interests of the whole population. For example, it requires proprietary software which only runs on Microsoft Windows, macOS, iOS, or Android, with hardware verification and Google services. This makes it unacceptable to free software advocates, and to privacy advocates, and to national data sovereignty advocates .. the total population of which is so small as to not affect the banks' commercial interests. One thing I learned recently is how the US can, with its control over the SWIFT banking network, tell banks in other countries to shut down the account for a local citizen who the US has designated a terrorist. At least that's what I gather from the news I read after two leaders of the biggest neo-nazi group here in Sweden were designated as terrorists by the US. If the goal is to keep power out of government hands, don't look to highly-regulated banks which are subject to the whims of multiple governments.

SAI_Peregrinus 2y ago

My wife works in a city clerk's office. They provide (among other things) vital records services for the city. Like getting birth certificates. To get a birth certificate, you must provide government photo ID with a name matching that of one of the names on the certificate you're trying to get. So you can get your own, or your child's, but not some random other person's. Lots of people were born before RealID driver's licenses. Some of them went by names other than the names on their birth certificates, and thus are unable to get new copies of their birth certificates using the government-issued photo ID they currently have. E.g. I've got a grandfather who went by Sam his entire life but was apparently named Harold. His driver's license had Sam as his first name. If he had lost his birth certificate, he would not have been able to obtain a new copy legally using that driver's license! This still happens to people. Also sometimes house fires or similar disasters happen, and people lack the ID needed to get new government-issued ID.

tsimionescu 2y ago
These things can be solved too, but in a more complicated process. Typically some lawyers and a judge need to get involved, get some people to testify that you are this same person, and you will be issued new ID.
WhyNotHugo 2y ago
How did he get a driver's licence with the name "Sam"? Don't you need some form of judicial process to change your name on this kind of thing?
- SAI_Peregrinus 2y ago
  Used his Army ID. World War 2 recruitment wasn't big on background checks.
deleted 2y ago
[deleted]

cyberax 2y ago

Clear in the US can do that: https://www.clearme.com/for-your-business https://www.clearme.com/for-your-business It's not exactly a government service, but Clear is trusted by the government enough to allow their customers to bypass the airport screenings.

lotsofpulp 2y ago
Screw Clear and screw the US government for allowing more privatization of public infrastructure.

JadeNB 2y ago

> Government provided digital IDs would solve a lot of this. Yes, they may have their own problems, but outsourcing the action of identifying individuals to the government seems valuable and less prone to "lock outs" like Google and friends. Sadly, the US government goes the other way and contracts out verification (to government websites!) to an invasive private company.

jks 2y ago

Estonia has this: <https://e-estonia.com/solutions/estonian-e-identity/id-card/ https://e-estonia.com/solutions/estonian-e-identity/id-card/> Finland tried to copy it, but the Finnish card (while based on the same technology) is used very little. Finnish banks already had their own OTP solutions, which they started offering for authentication on other web sites, so no-one wanted an extra authenticator on top of that. This of course means that you get phishing emails pretending to be from all sorts of government services, where the goal is to get your banking credentials and take your money. Since then, mobile phone operators added their own authentication system based on credentials residing on your SIM card <https://mobiilivarmenne.fi/en/ https://mobiilivarmenne.fi/en/>. You prove your identity when getting a mobile phone contract and can then use that to log into many sites.

rocqua 2y ago

identification is different from authentication. But authentication at least as a backstop, can generally be decently outsourced to government. Not so much in the US though. They have no national registry of what citizens actually exist.

alkonaut 2y ago

It does solve a lot of this. Some have gov’t issued IDs, others have a hybrid public/private system where banks issue the ids. But yes, a de facto standard electronic ID is almost unthinkable to not have. How else do you interact with authorities or healthcare? I used e-ID since long before smartphones, I can barely picture what it would be like to log in to handle taxes, benefits medicine recipes or doctors appointments if it worked any other way.

KronisLV 2y ago

> Government provided digital IDs would solve a lot of this. Over here in EU, we have something like it - you get an ID card that has two PIN codes that you can use with a card reader and some software to digitally sign documents and such: https://www.eparaksts.lv/en/ https://www.eparaksts.lv/en/ (of course, there's also a mobile version) In addition, there now are services where you can log in to your bank account, confirm payments, or just log in to your government portal account with a two factor app, the account on which is based on your identity: https://www.smart-id.com/ https://www.smart-id.com/ So if I make a payment online with my card, I'll have to authenticate through either a code calculator (physical piece of hardware) or the phone app with codes that I've chosen, to confirm it. Same for logging into various sites, for example, for paying my utilities. Works pretty well and if I lose my ID card, then I can get a new one, issue new certificates for the apps and continue where I left off (with the old ones being revoked). I might need a backup phone too, though, since not being able to confirm my payments if my phone breaks is pretty stupid (though I guess Revolut/PayPal/whatever still work as expected, unless I only have my OTP codes for those on said phone).