3 ms·

Hmm, I'm not using verifiable signatures though. Surely there will continue to be a way for a third party to verify that a passport's NFC is authentic and can b

by dom96 2y ago

Hmm, I'm not using verifiable signatures though. Surely there will continue to be a way for a third party to verify that a passport's NFC is authentic and can be trusted. That and the ability to pull some data off it is all I need. > Why should I trust that service with something as sensitive as the mapping of my real identity to any number of pseudonyms? What's the economic incentive to not eventually offer a de-anonymization service to the highest bidder? Do you trust banks? Hotels? They all take a copy of your passport and likely store it insecurely. The information that I store for the passports is irreversible. It's hashed. So even if I wanted to sell it I couldn't. I mean, sure, in the future if this becomes big and there is a company around it, it could become evil at any moment and then start selling this data but then you could easily sue the company for this.

lxgr 2y ago
> Hmm, I'm not using verifiable signatures though. That's even worse then for older passports (and inevitable for newer ones): Everybody will have to trust the service to be honest about not issuing sockpuppet identities. How would you prove that you aren't? > Do you trust banks? Hotels? They all take a copy of your passport and likely store it insecurely. That's not a concern I have at all. Every company providing service upon "identity verification" through a scan/copy of somebody's passport deserves everything bad fraudsters can throw at them. It's a non-verification method. And by the same token, the hotel could try to leak the fact that I've stayed there, and everybody taking passport copies seriously as evidence might believe them. I'm fine with that risk too. Conversely, a private proof-of-humanity service will, by its nature, attract users that want to prove their humanity, well, privately. > The information that I store for the passports is irreversible. It's hashed. But that hash is ultimately calculated over somebody's passport data, isn't it? This means that anybody stealing your database will be able to deanonymize any user they have passport data for (which is not exactly secret information, as you've illustrated yourself with the hotel example).
- dom96 2y ago
  > Everybody will have to trust the service to be honest about not issuing sockpuppet identities. How would you prove that you aren't? Because that is the whole point of my service? It really feels like you're just trying to come up with ways that this won't work in very special and rare circumstances, where those really don't matter in practice for a social network (which let's face it, isn't a life or death service). It's all about upping the barrier to entry for casual users that would create hundreds of alt accounts to troll/spam people with.

by dom96 2y ago

lxgr 2y ago

> Hmm, I'm not using verifiable signatures though. That's even worse then for older passports (and inevitable for newer ones): Everybody will have to trust the service to be honest about not issuing sockpuppet identities. How would you prove that you aren't? > Do you trust banks? Hotels? They all take a copy of your passport and likely store it insecurely. That's not a concern I have at all. Every company providing service upon "identity verification" through a scan/copy of somebody's passport deserves everything bad fraudsters can throw at them. It's a non-verification method. And by the same token, the hotel could try to leak the fact that I've stayed there, and everybody taking passport copies seriously as evidence might believe them. I'm fine with that risk too. Conversely, a private proof-of-humanity service will, by its nature, attract users that want to prove their humanity, well, privately. > The information that I store for the passports is irreversible. It's hashed. But that hash is ultimately calculated over somebody's passport data, isn't it? This means that anybody stealing your database will be able to deanonymize any user they have passport data for (which is not exactly secret information, as you've illustrated yourself with the hotel example).

dom96 2y ago
> Everybody will have to trust the service to be honest about not issuing sockpuppet identities. How would you prove that you aren't? Because that is the whole point of my service? It really feels like you're just trying to come up with ways that this won't work in very special and rare circumstances, where those really don't matter in practice for a social network (which let's face it, isn't a life or death service). It's all about upping the barrier to entry for casual users that would create hundreds of alt accounts to troll/spam people with.