3 ms·

I don't trust the UK government either. But I'm both British and Australian and I see the need for a centralised identity service. Because the alternative is t

I don't trust the UK government either. But I'm both British and Australian and I see the need for a centralised identity service. Because the alternative is that we provide our passport to every online service that 'needs' to verify our identity. Then – lo, would you believe it! – they get hacked, and now all of our data is in the wild again. I'd much rather the government, who already know everything about me because may I remind you they issued the documents, had some way of that company querying my 'verified identity'. They might do it by me providing, say, an ID number string which is looked up. That's all they get: my ID number. In return, they get confirmation that I am who I say I am. Oh by the way I already have at least 2 of these ID numbers as an Australian citizen. My aforementioned passport, and my driver licence. Both of which I know I should keep 'private', lol, but if I want to interact with the world in any meaningful way the reality is that I spray these digits – along with my date of birth and address and whatever else they ask for – all over the goddamned place. But sure, centralised identity is bad.

0xy 1y ago
Your mistake is assuming good faith on behalf of the government who arrests thousands of people for social media posts. Beyond faith, they are incredibly incompetent and this data will be stolen.
- zbentley 1y ago
  You miss GP’s point. They’re not assuming good faith, they’re pointing out that the government already knows identity credentials and can, encrypted or not, quite easily correlate digital activity with those credentials. The question isn’t whether the government can/will identify and track you. They do, in good faith or bad. This is unfortunate and attempts to allow them to decrypt or acquire additional data about citizens’ activities (like chat control) should be opposed, but identity/activity tracking is omnipresent and irreversible. The question is whether identity credentials should be available which reduce the risk of additonal credential theft or bad-faith action (e.g. by other entities stealing non-secure-for-digital-use credentials like passports).
- bpye 1y ago
  Just because it’s social media doesn’t excuse inciting violence or hate speech. I’m not going to claim that every arrest in the UK due to social media posts was just, but I also disagree that social media should permit unrestricted speech.
- basisword 1y ago
  They didn’t arrest anyone for “making social media posts”. The police (not the government) arrested people due to the content in the posts breaking an existing law. Big difference.
wkat4242 1y ago
> Because the alternative is that we provide our passport to every online service that 'needs' to verify our identity. I really really really don't want to 'verify my identity' everywhere. Why the F is that normalised these days?? If I buy something online my payment and delivery address is all they should need. And all they've had to have for the last 30 years > I'd much rather the government, who already know everything about me because may I remind you they issued the documents, had some way of that company querying my 'verified identity'. Um yeah but right now they don't know what you do with your life all the time. Anna have absolutely no business to.
- ACCount37 1y ago
  Given the ongoing "age verification" fiasco, I'd be quite wary of giving UK government any more digital powers. They don't seem to be any good at using what they have.
  - wkat4242 1y ago
    Yeah age verification is another such idiocy. The EU is starting this BS as well. Great way for conservative politicians to make a name for themselves with their backers, but other than that it's not effective at all, considering the torrents are full of this stuff with no gating whatsoever. Besides, parenting is the parents' job.
- alex77456 1y ago
  Airlines and airline middle-men organisations are the worst offenders and centralised identification is not going to help there. Having flied with a few airlines, your details are out there. In the UK, national and travel passport are the same.
  - wkat4242 1y ago
    That's true. I remember Karsten Nohl's presentation about this at 33c3 and not much seems to have improved. https://securityaffairs.com/54969/hacking/flight-bookings.html https://securityaffairs.com/54969/hacking/flight-bookings.ht...
throwaway808081 1y ago
Why do services need to verify identity? What service needs a solution to verify identity that doesn't already exist? Banks do KYC now. Employers already need a National Insurance number to employ someone. Benefits get paid to a named payee. Emergency healthcare needs no insurance and waiting lists come via a GP who indeed knows me. What service needs a further centralised deposit of power over identity?
- seer 1y ago
  Yes, all of these services. Plus a ton more - hotels, car hire, various government digital services. For example I get married abroad and I need to change my name, if a system was present I could just go to a website, enter my request, identify and then wait for my new docs to arrive, all while staying abroad. But it’s even better - banks / employers don’t need all of my information all the time, thy just need to verify that I am who I say I am at that moment, so the credentials I am giving them through a digital system can reflect that. Call it requesting a scope from a government openid system. And I have the power to revoke that. And all of the various little government agencies don’t need to request all the documents to bootstrap trust every single time, they can just be given a convenient (timed) access token by me. Implemented right, it gives much less data to people in a much more convenient and secure way. I guess the “implemented right” is the problem. But maybe that’s an orthogonal thing that needs to be solved by itself? How we have an independent central banks that doesn’t (shouldn’t) succumb to the whims of governments - they have a clear narrow mission and they are supposed to follow it regardless of what an administration would want. If we had an “auth provider” government thing that’s mission might be more closely aligned with the population, giving a government _just enough_ data to make it efficient but so it cannot abuse it. Built in adversity and distrust is how we finally got a government to “work” with the separation of powers and all of that, maybe we need to think about improving the political system with some know how from web tech, cause I think working efficiency, effectively and reliably in an environment of mistrust is what web tech is known for.
- jen729w 1y ago
  In Australia (and many other countries), we need to KYC when we get a new mobile plan. This makes sense: you can do a lot of criming with a 'dark' phone number. Predictably enough, then... https://en.wikipedia.org/wiki/2022_Optus_data_breach https://en.wikipedia.org/wiki/2022_Optus_data_breach > In September 2022, Australian telecommunications company Optus suffered a data breach that affected up to 10 million current and former customers comprising a third of Australia's population. Information was illegally obtained, including names, dates of birth, home addresses, telephone numbers, email contacts, and numbers of passports and driving licences.

0xy 1y ago

Your mistake is assuming good faith on behalf of the government who arrests thousands of people for social media posts. Beyond faith, they are incredibly incompetent and this data will be stolen.

zbentley 1y ago
You miss GP’s point. They’re not assuming good faith, they’re pointing out that the government already knows identity credentials and can, encrypted or not, quite easily correlate digital activity with those credentials. The question isn’t whether the government can/will identify and track you. They do, in good faith or bad. This is unfortunate and attempts to allow them to decrypt or acquire additional data about citizens’ activities (like chat control) should be opposed, but identity/activity tracking is omnipresent and irreversible. The question is whether identity credentials should be available which reduce the risk of additonal credential theft or bad-faith action (e.g. by other entities stealing non-secure-for-digital-use credentials like passports).
bpye 1y ago
Just because it’s social media doesn’t excuse inciting violence or hate speech. I’m not going to claim that every arrest in the UK due to social media posts was just, but I also disagree that social media should permit unrestricted speech.
basisword 1y ago
They didn’t arrest anyone for “making social media posts”. The police (not the government) arrested people due to the content in the posts breaking an existing law. Big difference.

wkat4242 1y ago

> Because the alternative is that we provide our passport to every online service that 'needs' to verify our identity. I really really really don't want to 'verify my identity' everywhere. Why the F is that normalised these days?? If I buy something online my payment and delivery address is all they should need. And all they've had to have for the last 30 years > I'd much rather the government, who already know everything about me because may I remind you they issued the documents, had some way of that company querying my 'verified identity'. Um yeah but right now they don't know what you do with your life all the time. Anna have absolutely no business to.

ACCount37 1y ago
Given the ongoing "age verification" fiasco, I'd be quite wary of giving UK government any more digital powers. They don't seem to be any good at using what they have.
- wkat4242 1y ago
  Yeah age verification is another such idiocy. The EU is starting this BS as well. Great way for conservative politicians to make a name for themselves with their backers, but other than that it's not effective at all, considering the torrents are full of this stuff with no gating whatsoever. Besides, parenting is the parents' job.
alex77456 1y ago
Airlines and airline middle-men organisations are the worst offenders and centralised identification is not going to help there. Having flied with a few airlines, your details are out there. In the UK, national and travel passport are the same.
- wkat4242 1y ago
  That's true. I remember Karsten Nohl's presentation about this at 33c3 and not much seems to have improved. https://securityaffairs.com/54969/hacking/flight-bookings.html https://securityaffairs.com/54969/hacking/flight-bookings.ht...

throwaway808081 1y ago

Why do services need to verify identity? What service needs a solution to verify identity that doesn't already exist? Banks do KYC now. Employers already need a National Insurance number to employ someone. Benefits get paid to a named payee. Emergency healthcare needs no insurance and waiting lists come via a GP who indeed knows me. What service needs a further centralised deposit of power over identity?

seer 1y ago
Yes, all of these services. Plus a ton more - hotels, car hire, various government digital services. For example I get married abroad and I need to change my name, if a system was present I could just go to a website, enter my request, identify and then wait for my new docs to arrive, all while staying abroad. But it’s even better - banks / employers don’t need all of my information all the time, thy just need to verify that I am who I say I am at that moment, so the credentials I am giving them through a digital system can reflect that. Call it requesting a scope from a government openid system. And I have the power to revoke that. And all of the various little government agencies don’t need to request all the documents to bootstrap trust every single time, they can just be given a convenient (timed) access token by me. Implemented right, it gives much less data to people in a much more convenient and secure way. I guess the “implemented right” is the problem. But maybe that’s an orthogonal thing that needs to be solved by itself? How we have an independent central banks that doesn’t (shouldn’t) succumb to the whims of governments - they have a clear narrow mission and they are supposed to follow it regardless of what an administration would want. If we had an “auth provider” government thing that’s mission might be more closely aligned with the population, giving a government _just enough_ data to make it efficient but so it cannot abuse it. Built in adversity and distrust is how we finally got a government to “work” with the separation of powers and all of that, maybe we need to think about improving the political system with some know how from web tech, cause I think working efficiency, effectively and reliably in an environment of mistrust is what web tech is known for.
jen729w 1y ago
In Australia (and many other countries), we need to KYC when we get a new mobile plan. This makes sense: you can do a lot of criming with a 'dark' phone number. Predictably enough, then... https://en.wikipedia.org/wiki/2022_Optus_data_breach https://en.wikipedia.org/wiki/2022_Optus_data_breach > In September 2022, Australian telecommunications company Optus suffered a data breach that affected up to 10 million current and former customers comprising a third of Australia's population. Information was illegally obtained, including names, dates of birth, home addresses, telephone numbers, email contacts, and numbers of passports and driving licences.