Hacker News new | ask | show | jobs
by denton-scratch 790 days ago
> Key-pairs are ephemeral device tokens, they are not sources of identity.

If you take "identity" to mean "the same thing", then you can certainly use a key-pair to show that two documents were signed by the same signing key. Of course, the owner could have lost control of their private key, but that could happen to government-issued ID as well.

If you want "identity" to mean "official persona", then there can only be one of those per person, which means government-issued. I think government ID should only be used for interacting with government; online purchases shouldn't rely on government ID.

Banking is awkward. To get a bank account, you usually have to produce government ID. But then the bank issues you with a bank-issued ID, which is effectively just a proxy for your government ID. It's weird because banks are not part of government, but they have quasi-governmental obligations, e.g. KYC. Even government departments do this; to sign up for self-assessment with HMRC, I have to prove I am who I say I am with government ID; but then HMRC issues me with an HMRC ID. That is nuts.

I want to be able to have multiple IDs that are not linked. I shouldn't have to give government ID to make an online purchase. And I shouldn't have to risk exposing my purchase history when I sign a post to an online forum. It's perfectly legal (here, at least) to have multiple real names; for example, I mainly go by my nickname, which doesn't appear on any official document. Online identity should mirror that.

3 comments

> I want to be able to have multiple IDs that are not linked. I shouldn't have to give government ID to make an online purchase

But how will your benevolent rulers be able to socially gamify your behaviour and direct who gets to interact and mate with you? If social credit systems are to work, we need KYC and centralized ID.

> If social credit systems are to work, we need KYC and centralized ID.

I think we need KYC. That doesn't mean centralized ID. As far as social credit systems is concerned, I take it you are being humorous, but I don't think there's much that's amusing about "social credit".

Only the seller and buyer need to know each other. Anything beyond, is shoe-in for tyranny.
For this you have cash or bartering.

Regulation is not synonymous with tyranny. This is a dumb position and the people who hold it are dumb.

I think your Reddit score should count towards it.
> If you take "identity" to mean "the same thing"

I don't.

> If you want "identity" to mean "official persona"

Well, I want identity to mean me as a human being.

> I want to be able to have multiple IDs that are not linked.

Fine, but realize that statistically zero other people want this feature in, well, anything. No system which expects to serve more than a statistically zero percent slice of humanity can define identity in this way.

The second part of your post seems to contradict the first part, if it's not linked to the government ID how can anyone know if it's the bonafide original and unique persona? And not some duplicate?
> the bonafide original

If you take "the bonafide original" to mean the government-issued ID, then obviously only the government-issued ID is boner-fido. But there's no reason why that should be my only ID; I could, for example, generate my own keypair, and hire a notary public to attest that the holder of the keypair is (select any):

[] Good for ten-grand

[] Older than 18/21

[] The person shown in the accompanying (signed) photo

[] The author of xyz.blog

[] The same person as government-ID xxxxx

Only the last needs to be linked to a government ID, but all the others are authentic, bonafide attestations.

And such an ID would not be a duplicate of anything (not sure why you mentioned duplicates; passports, bus-passes and driving licences can all be duplicated).

Let's say someone is 22, how can they credibly attest to being older than 18/21 without referring to some sort of government record?
Distinguishing a 21-year-old from a 22-year-old without resorting to government records is a challenge, I agree.

They could produce their parents, or any witness of their birth.

They could (if they were born wealthy) produce a hallmarked silver spoon engraved with their name. Not proof, but persuasive.

They could produce their 21-year-old younger sister, who has government ID (yeah, I know, that is a resort to government ID).

Best of all: they could produce a birth certificate, signed by a doctor (not itself government ID, just a prerequisite to getting a government ID).

> They could produce their 21-year-old younger sister, who has government ID (yeah, I know, that is a resort to government ID).

1. How would you verify that's actually their relative and not a friend or stranger? 2. How do you verify that they are in fact the older sibling and not just saying they are?

In 20 years, a 40 year old will need ID to buy cigarettes in the UK ("well you say you're 40, but maybe you're a mature 35 year-old").
> then obviously only the government-issued ID is boner-fido

Never heard of it. Is it an extension of FIDO2?

It's a deliberate mis-pronunciation of "bona-fide" that I snagged from the comedian Dawn French.