3 ms·

I feel like we need to change our direction in terms of "identity" all together. We seem to be relying on an "identity" that is our name, ssn, phone number, cr

by dpcan 11y ago

I feel like we need to change our direction in terms of "identity" all together. We seem to be relying on an "identity" that is our name, ssn, phone number, credit card number, or all these different little bits of data clumped together. Too messy, too easy to steal, to fake, to easy to sell. Maybe our identity is more like a bitcoin wallet. It's an encrypted clump of data that we only keep with ourselves, and ourselves alone. It could store money, confirm that we are who we say we are because it can have our picture in it, our names, our "numbers" for various things. Then, when someone needs ANYTHING from us, be it proof of identity, money, or trivial info, we can send them a piece of useless information salted with something that they then return to us with the same salt to get back a confirmation, or money, or access to "use" our other numbers, but they never GET our other numbers. If you want my phone number, you send a request to me asking for it. I get the request, confirm it, send back another piece of data to you. This is NOT my phone number, but something you can use to send to me again in the future when you want to call me, and then my number is dialed, but you never see it. At any time, I can wipe you off my safe list, and you don't have my phone number anymore. Same thing can work when paying for something, or proving I am who I say I am when getting a loan, buying beer, whatever. Maybe this is ridiculous.

bikeshack 11y ago
A great talk by Jake Appelbaum that one should watch: https://www.youtube.com/watch?v=6kilAPZ-vGA https://www.youtube.com/watch?v=6kilAPZ-vGA A very in depth and revealing talk about the current state of the union of 'identity' on the web and the apparent digital doppelgängers we carry around with us. Frankly the notion of a digital doppelgänger is hillarious and identity is not a hard problem when people are effectively schizoid when they surf and flitter between multiple idens all the time.
- dpcan 11y ago
  Interesting, thank you for the video link
  - higherpurpose 11y ago
    Jacob Appelbaum's videos are always a must-watch.
- Sideloader 11y ago
  Just want to add my thanks for sharing this link. Appelbaum is always worth checking out.
skwirl 11y ago
What happens when your "identity wallet" gets stolen?
- vacri 11y ago
  What happens when this method meets the general public, huge numbers of which consistently lose things, or fail to understand basic security measures (sometimes wilfully)? Any system based on "so, you have this physical|virtual thing, right..." is going to run into troubles when it meets the general public.
  - jsmthrowaway 11y ago
    > Any system based on "so, you have this physical|virtual thing, right..." is going to run into troubles when it meets the general public. ...like driver's licenses, national ID cards (some smart), CACs, credit cards, keys, and smartphones?
    - ams6110 11y ago
      People understand ID cards and phones. Once it gets into things like passphrases, keys, salts, etc. 98% are lost. I work with students (some are Ph.D. candidates) in computer science who can't keep public/private SSH key pairs straight.
    - vacri 11y ago
      Did you notice that the GP was suggesting to do away with all of those things and replace it with a single doohickey? People lose each of the things you list every day. They can generally prove who they are to the relevant vendor with the other things they haven't lost yet. How do you do that with a single doohickey? And, as ams6110 mentioned, none of the things in your list require anything like 2FA - perhaps a PIN code on the bank card, but that's it. And those codes are generally four numeric digits. That's the level you need to pitch at for 'general public' consumption.
- natrius 11y ago
  "You pick eight entities; they may be your friends, your employer, some corporation, nonprofit or even in the future a government, and if anything goes wrong a combination of five of them can recover your key. This concept of social multi-signature backup is perhaps one of the most powerful mechanisms to use in any kind of decentralized system design, and provides a very high amount of security very cheaply and without relying on centralized trust." https://blog.ethereum.org/2015/04/13/visions-part-1-the-value-of-blockchain-technology/ https://blog.ethereum.org/2015/04/13/visions-part-1-the-valu... If you're not paying attention to Ethereum, you're missing out on the biggest story in technology ever. They're building systems that combine cryptographic identities and a global tamper-proof execution environment to bring the costs of interacting with any stranger on the planet to nearly zero. Every large organization on the planet (i.e. companies and governments) formed as a reaction to today's levels of transaction costs. Eliminating those transaction costs will reshape our society in ways that increase liberty and wealth. You can build the software that helps make that happen. My email's in my profile for anyone who wants help getting started or learning more.
higherpurpose 11y ago
I fear that seeing how people "love the fingerprint readers on their phones" the governments will think - well then, they will probably love having to use their fingerprint for federal services, too - by giving us the fingerprint to store (which means the government will also be able to use that fingerprint to log into all the devices and services for which you'll be using that fingerprint). Today's data breach at the very least shows that we shouldn't allow them to push for that. The fingerprint should always stay on our devices in a hardware secure module.
- kazinator 11y ago
  They will lure hordes of buffoons by making it look like a valuable thing: "Free version limited to storing only most recent two fingerprints on our servers! For unlimited storage, upgrade to Middle Finger Pro for only $1.99!"
ditojim 11y ago
I posted a similar thought to Linkedin awhile back. It would be great if we flipped the model to something that protects the user, first: https://www.linkedin.com/pulse/20140609151247-16668613-apps-should-share-services-with-our-personal-data-not-the-other-way-around?trk=prof-post https://www.linkedin.com/pulse/20140609151247-16668613-apps-...

by dpcan 11y ago

bikeshack 11y ago

A great talk by Jake Appelbaum that one should watch: https://www.youtube.com/watch?v=6kilAPZ-vGA https://www.youtube.com/watch?v=6kilAPZ-vGA A very in depth and revealing talk about the current state of the union of 'identity' on the web and the apparent digital doppelgängers we carry around with us. Frankly the notion of a digital doppelgänger is hillarious and identity is not a hard problem when people are effectively schizoid when they surf and flitter between multiple idens all the time.

dpcan 11y ago
Interesting, thank you for the video link
- higherpurpose 11y ago
  Jacob Appelbaum's videos are always a must-watch.
Sideloader 11y ago
Just want to add my thanks for sharing this link. Appelbaum is always worth checking out.

skwirl 11y ago

What happens when your "identity wallet" gets stolen?

vacri 11y ago
What happens when this method meets the general public, huge numbers of which consistently lose things, or fail to understand basic security measures (sometimes wilfully)? Any system based on "so, you have this physical|virtual thing, right..." is going to run into troubles when it meets the general public.
- jsmthrowaway 11y ago
  > Any system based on "so, you have this physical|virtual thing, right..." is going to run into troubles when it meets the general public. ...like driver's licenses, national ID cards (some smart), CACs, credit cards, keys, and smartphones?
  - ams6110 11y ago
    People understand ID cards and phones. Once it gets into things like passphrases, keys, salts, etc. 98% are lost. I work with students (some are Ph.D. candidates) in computer science who can't keep public/private SSH key pairs straight.
  - vacri 11y ago
    Did you notice that the GP was suggesting to do away with all of those things and replace it with a single doohickey? People lose each of the things you list every day. They can generally prove who they are to the relevant vendor with the other things they haven't lost yet. How do you do that with a single doohickey? And, as ams6110 mentioned, none of the things in your list require anything like 2FA - perhaps a PIN code on the bank card, but that's it. And those codes are generally four numeric digits. That's the level you need to pitch at for 'general public' consumption.
natrius 11y ago
"You pick eight entities; they may be your friends, your employer, some corporation, nonprofit or even in the future a government, and if anything goes wrong a combination of five of them can recover your key. This concept of social multi-signature backup is perhaps one of the most powerful mechanisms to use in any kind of decentralized system design, and provides a very high amount of security very cheaply and without relying on centralized trust." https://blog.ethereum.org/2015/04/13/visions-part-1-the-value-of-blockchain-technology/ https://blog.ethereum.org/2015/04/13/visions-part-1-the-valu... If you're not paying attention to Ethereum, you're missing out on the biggest story in technology ever. They're building systems that combine cryptographic identities and a global tamper-proof execution environment to bring the costs of interacting with any stranger on the planet to nearly zero. Every large organization on the planet (i.e. companies and governments) formed as a reaction to today's levels of transaction costs. Eliminating those transaction costs will reshape our society in ways that increase liberty and wealth. You can build the software that helps make that happen. My email's in my profile for anyone who wants help getting started or learning more.

higherpurpose 11y ago

I fear that seeing how people "love the fingerprint readers on their phones" the governments will think - well then, they will probably love having to use their fingerprint for federal services, too - by giving us the fingerprint to store (which means the government will also be able to use that fingerprint to log into all the devices and services for which you'll be using that fingerprint). Today's data breach at the very least shows that we shouldn't allow them to push for that. The fingerprint should always stay on our devices in a hardware secure module.

kazinator 11y ago
They will lure hordes of buffoons by making it look like a valuable thing: "Free version limited to storing only most recent two fingerprints on our servers! For unlimited storage, upgrade to Middle Finger Pro for only $1.99!"

ditojim 11y ago

I posted a similar thought to Linkedin awhile back. It would be great if we flipped the model to something that protects the user, first: https://www.linkedin.com/pulse/20140609151247-16668613-apps-should-share-services-with-our-personal-data-not-the-other-way-around?trk=prof-post https://www.linkedin.com/pulse/20140609151247-16668613-apps-...