3 ms·
But to be effective you need to prove that the person presenting the ID is the person the ID belongs to. In person that falls to a human being, and it's an eas
by nly 3mo ago
But to be effective you need to prove that the person presenting the ID is the person the ID belongs to.
In person that falls to a human being, and it's an easy and intuitive task that takes seconds.
On the internet this involves some kind of video recording being sent to some agency somewhere being paid a fee, who may later be asked to prove the efficacy of their service. This agency needs a digital copy of the photo from your ID for matching purposes. They'll be tempted to store this for auditing purposes... they'll also be tempted to store correlation IDs etc if the architecture allows.
The issue is trust. You just can't trust these first and third parties not to collaborate for commercial gain or at government demand or request.
And ultimately you're still exchanging verification at registration for a shareable credentials: I could use my ID to sign up to pornhub premium and then sell the username and password to a 16 year old if I wished, just like those buying alcohol can go and give it to the underage. A black market for digital credentials is even easier to establish than material goods
- stymaar 3mo ago> On the internet this involves some kind of video recording being sent to some agency somewhere being paid a fee, who may later be asked to prove the efficacy of their service. This agency needs a digital copy of the photo from your ID for matching purposes. That's why I'm talking about an “Id card” using Zero-knowledge proofs in a cryptographic chip, not using a paper ID with your picture on top…
- nly 3mo agoDoesn't matter! You still need to send a digital image from the id, signed by an authority, saying "this person is 18" You then still need a trusted ID service or algorithm to capture an image of the user _at the time of use_ to compare that to. Just having access to your digital ID credentials proves nothing The zero knowledge proof only helps prevent tracking between the ID service and the website you're logging into. This is valuable but requires standardisation and client side support, which doesn't exist. All the time the client side is implemented by JavaScript served from the server side you're just trusting these parties to behave and not snoop
- stymaar 3mo agohttps://en.wikipedia.org/wiki/Zero-knowledge_proof https://en.wikipedia.org/wiki/Zero-knowledge_proof
- nly 3mo agoYeah...I'm fully aware what a ZKP is..you're just missing the point.
- stymaar 3mo agoWhy did you write that then: > You then still need a trusted ID service or algorithm to capture an image of the user _at the time of use_ to compare that to. > Just having access to your digital ID credentials proves nothing
- nly 3mo agoBecause it's accurate? If I have access to your digital ID I shouldn't be able to impersonate you anymore than I should be able to fly using your passport. Your passport is useful not just because it's difficult to forge, but because border control is a thing.
- stymaar 3mo ago> If I have access to your digital ID I shouldn't be able to impersonate you anymore than I should be able to fly using your passport. If you steal my passport and I' don't signal it to the authority, you'll be able to sell it on the black market to someone looking approximately like me who will subsequently be able to use it to impersonate me (it actually happened to a cousin of mine). Why do you require digital ids to have a higher security standard than an actual passport? (Some countries like the US mandate biometry in passports, but you could add that to your credit card as well, there's no technical limitation here even though it's probably too expensive for too little benefits) Some people may be able to fraud by stealing and reselling digital ids, but it's not a fatal issue if it's not a fatal issue for a passport. Again, the optimal amount of fraud is non-zero.