4 ms·

At that point, Google and Apple should be legally barred from fully banning you if it impedes you identifying yourself unless your account is hacked.

toomuchtodo 1mo ago
Google and Apple should be legally mandated to federate with nation state identity systems. This prevents them from revoking access, as the identity management is within nation state control vs big tech. You potentially have recourse with your government, you have no recourse with Google and Apple (current state). They may consume your identity for your benefit, but they may not control your digital identity. If a Big Tech company chooses to ban you, they should be required to provide you, at their cost, a copy of all of your data stored with them and report that they did so to a regulator. I strongly doubt the US would mandate this, but could see the EU doing so. The technical primitives exist and implementation is straightforward. Without a law, this will not change, there is no incentive for it to change.
- PontifexMinimus 1mo ago
  The way the EU could implement this is to mandate only using identity providers can guarantee they will not revoke people's identities, and the only way to make that guarantee watertight is to mandate only identity providers based within the EU.
  - toomuchtodo 1mo ago
    There are no guarantees unfortunately, just contracts (formal and informal) that can be broken and paths as to what happens when those contracts degrade or fail. Agree with you on mandating EU only idps for those who reside within the EU jurisdiction.
- subscribed 1mo ago
  > Google and Apple should be legally mandated to federate with nation state identity systems. With which states? I'm I'm a citizen of two and live in the third, potentially having eSIM of the fourth?
  - toomuchtodo 1mo ago
    The same states and countries they integrate with today for digital identity verification. If you have a passport, national ID card, or US state ID or driver's license, you have a government provided digital identity that can bound to and authenticated against. I'm probably missing a government credential in scope, but the backend database lookup is trivial. The US Login.gov idp is about to roll out identity attestation using your state issued government credential provisioned in your mobile wallet (mDL), for example. I can perform identity proofing and attestation with my digital driver's license and passport in my iPhone Wallet today (at a TSA or CBP checkpoint, for example). Why can I not login to Google and Apple with that identity? It is federated identity management fundementally. https://zendesk.login.gov/hc/en-us/articles/51945946704148-mDL-mobile-Drivers-License https://zendesk.login.gov/hc/en-us/articles/51945946704148-m... https://learn.wallet.apple/id https://learn.wallet.apple/id https://wallet.google/intl/en_us/digitalid/ https://wallet.google/intl/en_us/digitalid/
    - roosterIllusi0n 1mo ago
      Why does google and apple need a government login? This makes no sense. You do not want private billionaire companies coming anywhere near a government login. If they get to use it, they will lobby to make it less secure to support more datamining.
    - lukeschlather 1mo ago
      Putting IDs in mobile wallets is such a minefield without explicit bans on phone searches by law enforcement. Law Enforcement being able to rifle through all your email/bank/medical records because you had a traffic stop is just not acceptable.
      - toomuchtodo 1mo ago
        The ID can be presented without providing the device to law enforcement. Same UX as a payment, it’s an NFC exchange.
RedShift1 1mo ago
Gov. logins and services should never depend on companies like Google.
- 9cb14c1ec0 1mo ago
  This is the solution. Implementing auth isn't that difficult.
  - inetknght 1mo ago
    Oh yeah, auth itself isn't that difficult. But... auth resilient against malicious actors?
- PunchyHamster 1mo ago
  our govt farms the authorization out to banks (multiple of them), seems to work well. There is also a govt auth on top of that if you don't want that.
  - jedberg 1mo ago
    Banks can't just ban you, nor just take your money. The price they pay for being gatekeepers is a ton of regulation. This is why PayPal for the longest time made it really clear that "we are not a bank". So that they wouldn't be subject to those regulations and could suspend accounts and keep the money.
    - Terr_ 1mo ago
      > Banks can't just ban you They kinda can. https://www.bitsaboutmoney.com/archive/seeing-like-a-bank/ https://www.bitsaboutmoney.com/archive/seeing-like-a-bank/
      - jedberg 1mo ago
        Sure, but they have to give you your money back. They can't just keep the money.

toomuchtodo 1mo ago

Google and Apple should be legally mandated to federate with nation state identity systems. This prevents them from revoking access, as the identity management is within nation state control vs big tech. You potentially have recourse with your government, you have no recourse with Google and Apple (current state). They may consume your identity for your benefit, but they may not control your digital identity. If a Big Tech company chooses to ban you, they should be required to provide you, at their cost, a copy of all of your data stored with them and report that they did so to a regulator. I strongly doubt the US would mandate this, but could see the EU doing so. The technical primitives exist and implementation is straightforward. Without a law, this will not change, there is no incentive for it to change.

PontifexMinimus 1mo ago
The way the EU could implement this is to mandate only using identity providers can guarantee they will not revoke people's identities, and the only way to make that guarantee watertight is to mandate only identity providers based within the EU.
- toomuchtodo 1mo ago
  There are no guarantees unfortunately, just contracts (formal and informal) that can be broken and paths as to what happens when those contracts degrade or fail. Agree with you on mandating EU only idps for those who reside within the EU jurisdiction.
subscribed 1mo ago
> Google and Apple should be legally mandated to federate with nation state identity systems. With which states? I'm I'm a citizen of two and live in the third, potentially having eSIM of the fourth?
- toomuchtodo 1mo ago
  The same states and countries they integrate with today for digital identity verification. If you have a passport, national ID card, or US state ID or driver's license, you have a government provided digital identity that can bound to and authenticated against. I'm probably missing a government credential in scope, but the backend database lookup is trivial. The US Login.gov idp is about to roll out identity attestation using your state issued government credential provisioned in your mobile wallet (mDL), for example. I can perform identity proofing and attestation with my digital driver's license and passport in my iPhone Wallet today (at a TSA or CBP checkpoint, for example). Why can I not login to Google and Apple with that identity? It is federated identity management fundementally. https://zendesk.login.gov/hc/en-us/articles/51945946704148-mDL-mobile-Drivers-License https://zendesk.login.gov/hc/en-us/articles/51945946704148-m... https://learn.wallet.apple/id https://learn.wallet.apple/id https://wallet.google/intl/en_us/digitalid/ https://wallet.google/intl/en_us/digitalid/
  - roosterIllusi0n 1mo ago
    Why does google and apple need a government login? This makes no sense. You do not want private billionaire companies coming anywhere near a government login. If they get to use it, they will lobby to make it less secure to support more datamining.
  - lukeschlather 1mo ago
    Putting IDs in mobile wallets is such a minefield without explicit bans on phone searches by law enforcement. Law Enforcement being able to rifle through all your email/bank/medical records because you had a traffic stop is just not acceptable.
    - toomuchtodo 1mo ago
      The ID can be presented without providing the device to law enforcement. Same UX as a payment, it’s an NFC exchange.

RedShift1 1mo ago

Gov. logins and services should never depend on companies like Google.

9cb14c1ec0 1mo ago
This is the solution. Implementing auth isn't that difficult.
- inetknght 1mo ago
  Oh yeah, auth itself isn't that difficult. But... auth resilient against malicious actors?
PunchyHamster 1mo ago
our govt farms the authorization out to banks (multiple of them), seems to work well. There is also a govt auth on top of that if you don't want that.
- jedberg 1mo ago
  Banks can't just ban you, nor just take your money. The price they pay for being gatekeepers is a ton of regulation. This is why PayPal for the longest time made it really clear that "we are not a bank". So that they wouldn't be subject to those regulations and could suspend accounts and keep the money.
  - Terr_ 1mo ago
    > Banks can't just ban you They kinda can. https://www.bitsaboutmoney.com/archive/seeing-like-a-bank/ https://www.bitsaboutmoney.com/archive/seeing-like-a-bank/
    - jedberg 1mo ago
      Sure, but they have to give you your money back. They can't just keep the money.