Hacker News new | ask | show | jobs
by Barrin92 2169 days ago
>All the use cases for digital identity are about enforcement and liability, and there are almost none that anyone would volunteer for.

Everything from a LinkedIn or Facebook account to your personal artist homepage with your CV on it establishes identity. People obviously disclose identity voluntarily, because identity is the primary means by which strangers establish trust.

If your identity is not transparent to me, I won't enter a relationship with you that requries me to know who you are, which in practice is almost every one. I don't see how non-fragmented identity is oppression. It can be for sure, but the primary reason why identity is important in our interactions is because it establishes trust and reputation. I've always considered "non-imposed" identity a sort of oxymoron for that reason, because if full control of identity is left to the individual, identity essentially loses its primary purpose.

3 comments

It's not that simple. My meatspace identity is entirely transparent. But online, I'm mostly Mirimir and other pseudonyms. Even so, I've been Mirimir for long enough, and have written enough about freedom, privacy and anonymity that I have a substantial reputation.

That is, one can have a range of identities, from entirely transparent to stably pseudonymous to fleetingly anonymous.

This is the key point -- identity is plural, not singular. It means different things in different context, so requirements change as do the types of identity, data and disclosures used.

The important nuance though is that the 'range of identities' can be tied together on the user's side if done properly. I can have all my auth methods, accounts, personas, data, etc. tied together with a properly designed decentralized identity system, and choose which to use when depending on the context. This is the real promise of decentralized identity -- a connective tissue around the users rather than platforms.

> If your identity is not transparent to me, I won't enter a relationship with you that requries me to know who you are, which in practice is almost every one.

There are two things about this that don't require centralized identity.

The first is that it's very commonly not true at all. If you want to sign up for an account for an online service (e.g. email, YouTube, gaming), they don't need the name on your driver's license for anything. They don't need to know anything about you. You create an account, set up authentication to prove you're the account holder in the future, and that's it. The identity you use can be created along with the account; it doesn't have to exist beforehand or be associated with anything else.

Second, even where reputation is important, you still don't need a single identity, it's just that an identity without any history would be untrusted.

Suppose you go to the bank to take out a loan. If you tell them your name is Barrin92 and you have no financial history, they're not going to give you one unless you get some more trusted party to cosign it or you post enough collateral that they can be assured to recover their principal if you default.

But then you start off with a small loan with a large amount of collateral, or a cosigner, and build a credit history as "Barrin92" with financial institutions. Now you can get a bigger loan, or one without a cosigner or as much collateral. Until you default. Then "Barrin92" would no longer be creditworthy and you'd be back to square one.

This works fine even if you have a thousand separate identities, because identities with no credit or bad credit aren't trusted and good credit is valuable so that you lose something significant (the creditworthiness of that identity) if you default.

People having multiple identities is effectively just equivalent to the ability to declare bankruptcy. It doesn't really break any good important thing and it does break some important mechanisms of oppression that we should want to break.

But again, in practice banks will loan more money more easily to those with a verified identity that has recourse beyond simple "loss of creditworthiness", so those loans will always be more appealing to those who can get them, and so nonrecourse loans never become a thing for normal citizens who can avoid them.

And those who can't get shunted down into the "Payday Loan" tier of finance and they have to dig themselves back out with the equivalent of deposit-backed credit cards.

But few people will choose a deposit-backed card when they have the option of trading identity for better pricing / convenience. If the online ad industry has taught us anything it is that mainstream consumers will trade their data for even the smallest of considerations.

Even if decentralized financial identity would be an improvement (and it is not clear that it would be), a vision with no practical incentive to get there from here is just the basis for another startup destined for whatever is the spiritual successor to f*ckedcompany.com.

> But again, in practice banks will loan more money more easily to those with a verified identity that has recourse beyond simple "loss of creditworthiness"

The normal recourse is foreclosure of the asset (e.g. house) that the loan was made to purchase, which they don't need your name to do at all, only a way to identify the property they're taking as collateral.

> And those who can't get shunted down into the "Payday Loan" tier of finance and they have to dig themselves back out with the equivalent of deposit-backed credit cards.

That's where everybody starts anyway. You make a hundred bucks mowing lawns in high school or whatever and get a credit card like that. By the time you have the down payment for a house you have a credit history to go with it. Or you start out getting cosigned with your parents' credit history.

> But few people will choose a deposit-backed card when they have the option of trading identity for better pricing / convenience.

You're ignoring the benefit -- it's the equivalent of corporate limited liability. If you get a car loan and then some idiot totals your new car, that's the bank's problem now and they're the ones who have to deal with the insurance company instead of you. If you lose your job and your life gets messed up temporarily then you don't have to wait 7 years to start over.

And that's not even counting the privacy benefit.

Also, the best version is for centralized identity to cease to exist whatsoever (e.g. stop issuing people social security numbers or prohibit their use for anything but social security) and then people can't give up their centralized identity in exchange for magic beans because they haven't got one.

I wish getting bank credit was that easy (made bad choices in my twenties, paid well into my thirties for that)...

I could easily just buy up some account that has good credit since it's all anonymous, no way to know if the original 'good credit' actor is the same person now applying for the loan.

Having "good credit" would imply doing something like having paid off six figures in student loans or the mortgage on a house, which requires paying many thousands of dollars in interest, so that credit history would have a high market value and defaulting on a loan taken against it would destroy that value. So that system would work fine -- it might cost the bank money to go through the inconvenience of foreclosing on a house, but it would cost you just as much for the good credit you destroyed in doing it, so it's symmetric and people would have an adequate disincentive to do that.
Linkedin/Facebook/Email login establish that it is the same "person" coming back. They don't guarantee the identity of the person as in official name or address or date of birth.
is this a distinction without a difference? Networks like LinkedIn exist for the purpose of building real social capital and that's how they're used by 99% of their users. I don't see the incentive for someone to use a fake persona (other than scamming).

All those private firms are in many ways identity providers just as real and official as governmental ones.

> Networks like LinkedIn exist for the purpose of building real social capital

???

No they don't. They exist for the purpose of selling advertising. Any other purpose is either marketing copy to get you to use it or an emergent property based on people believing the marketing. Consider that LinkedIn would continue to exist if it provided no social capital whatsoever as long as it could still get ads in front of eyeballs.

Another observation: whether any specific social network "builds social capital" depends on the demographics of the audience and general "trendiness". People in high school don't care about LinkedIn, professionals in their 30s don't care about TikTok. Does this mean that TikTok should be an "identity provider" to people under 20?

It's weird to mount a mild defense of LinkedIn, which I don't really like much, but I think you're making a slight category error by tacitly lumping it in with other social networks. LinkedIn's value proposition has always been "getting jobs is mostly about professional contacts and we're going to help you build professional contacts," and it makes the bulk of its revenue by selling its recruiting tools and, to a lesser degree, its premium services for job hunters. The most recent figures I've found suggest it makes less than 20% of its revenue from ads. I actually susect LinkedIn would not continue to exist if it provided no "social capital" whatsoever, because their business model really isn't "get ads in front of eyeballs." It's "get job prospects in front of eyeballs."

Having said all that, I wouldn't want to use it as an identity provider. :)

It's a massive difference. Consider linkedin vs national UK login.

The later one guarantees the identity: full name, date of birth, address, verified phone number, last taxable income, etc...

It allows to request government benefits or open a bank account online, because the identity is guaranteed. There is a real verified person behind the account. (corollary: you will be in troubles if somebody gets credit cards under your UK identity).

On the other hand, it's not great if that identity is required to apply to a job. The company can see your passport after they hire you. There is no need for every job board and recruiter and company to systematically get all your personal information in advance.