3 ms·
For banks an other cases that (1) need to know you true identity, and (2) provide no expectation of privacy regarding sharing the existence of accounts with the
by pavon 1y ago
For banks an other cases that (1) need to know you true identity, and (2) provide no expectation of privacy regarding sharing the existence of accounts with the government, a government run authentication would be fine from a privacy point of view.
The issue is that every site has moved to using 2FA, and most of them have no legitimate need to know your true identity. So using a government ID based solution would unnecessarily conflate authentication and identification and would be a real privacy concern.
- nine_k 1y agoCan you offer an example of a situation when the second factor authentifies without identification? Assume a service S wants a confirmation that user U is indeed legitimate. The centralized auth service A could receive from S a bunch of data S knows about U, like name, address, phone, SSN, whatever S needs to know about U. Then A should respond whether the fields match the data which A knows about U, without revealing to S any additional data that A may know about U. The problem if a centralized service is that it's a SPOF, and the juiciest target for compromising. I still think that TOTP and personal crypto tokens like yubikey are the most resilient, and technically the easiest, solution to that.
- deleted 1y ago[deleted]
- pavon 1y agoAny TOTP where the user enrolls it on account creation, without going through a third-party service. Or SMS on a burner phone. Both are pseudonymous, since using the same authentication at multiple sites could be linked, but neither have to be tied to a real-world identity.