4 ms·
The problem isn't technical but relates to the tendency and reflex of essentially every big company to not want to work with their competitors. Federated identi
by jillesvangurp 1y ago
The problem isn't technical but relates to the tendency and reflex of essentially every big company to not want to work with their competitors. Federated identity protocols have existed for quite long and as long as they've existed, companies have declined using them properly. I remember playing with OpenID as early as 2007.
It's successor, OpenID Connect is actually widely used. But with one important caveat:
None of the big identity providers actually accept each other's identities. Like literally none at all. You can't log in with your Google account to a Microsoft service and vice versa. Or Apple. Or Meta. Or X. Or whomever. That's because they all want to "own" your account and control where you are going. Which is why you need many accounts instead of just one.
If you had just one account, you could do sane things like add multiple layers of security and some sane fall backs. Including maybe some delegating to some legal representative if you are ill or incapacitated. Ideally, you should be able to use your government issued passport to prove who you are and recover your identity. A passport is a government issued paper assertion that you are who you claim you are. Anything important in life, you kind of need such a strong assertion for e.g. getting bank accounts, international travel, buying real estate, etc. And while they can be forged, it's getting pretty hard these days. That's a lot harder than getting your hands on some passwords.
Why do we settle for less protecting our online accounts?
- freeopinion 1y agoSometimes not even my government will accept my government-issued photo id.
- johnisgood 1y agoThe weird thing is that where I live, someone knowing your social security number can buy your medications in the pharmacy. My parents do this for me and all they need is the number, not even the card, the number is enough. I never had to provide any form consent either. It is scary. What do I do if I do not want them (or anyone else) to be able to do this?! I have no idea where to begin. Call up all the pharmacies in a radius? That is not going to work. Cops? Doubtful, or too late.
- nemomarx 1y agoIn the US you can pick up meds by giving someone's name and birthday. I'm shocked there doesn't seem to be abuse of it since it's so flimsy of a system
- johnisgood 1y agoDamn... that is even worse. I thought they were more careful in the US. Apparently not.
- Arubis 1y agoIt's fail-safe instead of fail-secure. While I'm _surprised_ that the system works the way that it does (we're typically pretty willing to let people drop dead), if someone on a life-critical medication isn't capable of going to pick up their own rx, they can send just about anyone in their stead.
- johnisgood 1y agoYes, my parents pick up my medications because I have mobility issues. But on the other hand, my grandma MUST talk on the phone (even if my mother is there) if we want to talk to the ISP's customer service. Then my grandma has to tell customer service that she is giving permission to my mother. Sure. What if something happens to my grandma? Pharmacies are too lax, ISPs are too strict. Certainly there should be a middle path, similarly to how post offices do it.
- Arubis 1y agoThat all makes sense given industry history. ISPs are accustomed to their threat model being more about fraud than patient death. And pharmacies have been around a lot longer. Not disagreeing with your conclusion that both could improve—just that the paths to arrive at the current local maxima are rational.
- 1y ago