Hacker News Reader

Comment by cm2187 | Hacker News Reader

But it is used that way for the lack of a better alternative. In my opinion the solution is a free federal ID card, where all the information on the card (including the picture) is digitally signed, to make forgery nearly impossible.

The only non trivial element is how to sign the photo. I guess there must be a way to sign a degraded version of the picture so that even an average scan of the ID card would be verifiable. Or the card could contain a small, cheap, water resistant memory chip which contains the picture in digital format. Then you can have a high degree of confidence in this physical document.

And there could be other usage of that card. Like if you make it a chip & pin so the card could become an unforgeable digital signature (physical signatures are absurdly unsecure too).

View on HN

Many other countries have these exact cards. They are not new technology.

In fact, your US passport has that. Look for the biometric symbol on the front. It means there's a chip inside (not sure how to read off it) that includes your digitally signed identity details, including photo.

If you're willing to go the centralized route, then a minimalist ID card would just be a QR code that anyone can open and compare the official photo to you.

A QR code (of I presume a URL) would be even simpler to use but creates a big point of failure, as you need to secure a central server that contains the picture of every american and needs to be accessed publicly. We know how these things tend to end.

Whereas digital signing can be done in an offline, airtight system, as long as the public key is widely available.

> If you're willing to go the centralized route, then a minimalist ID card would just be a QR code that anyone can open and compare the official photo to you.

"Just a qrcode" would be a weird and inconvenient format.

Other countries (Estonia, Spain, Belgium) have smartcard IDs. You can add a qrcode to that, but the primary data store can be secured (and accessed and updated) in much the same way a regular smartcard is, you can access it from your home with a regular card reader and the relevant access application. And of course the size is completely standard. And you can add contactless support to it if desirable.

Plus the US already has experience with these types of IDs: DoD has issued 17 million Common Access Cards.

There's an Android app which will read your passport's information - including photo.

https://play.google.com/store/apps/details?id=dexlab.eCL0WN&...

> In my opinion the solution is a free federal ID card, where all the information on the card (including the picture) is digitally signed, to make forgery nearly impossible.

But what advantage is there in having the federal government do this, instead of just having a bank issue one when you open your account? You could even use the same card with multiple creditors, which gives them access to shared credit history. Then filing for bankruptcy is the same as throwing away your bank card.

A big advantage is that it would push identity control risks to the federal government, which is in a position to want to protect its citizens (it has to remain accountable to voters).

A current problem in the US is that we have three for-profit companies doing that today, whom are only really accountable to each other (sort of) and their shareholders. Their customers are each other and banks; you whose data is actually at risk are not a customer of strong value to them directly.

Probably the majority of US citizens do not want a federal ID card. A number of states refuse to comply with the RealID requirements on their drivers licenses and others are dragging their feet. As a result the drivers licenses of some states won't be suitable for federal identification soon.

At one level it's a bit silly as many have passports and drivers licenses are (almost) a form of universal ID. On the other hand, I sympathize with the push against mandatory federal ID.

> And there could be other usage of that card. Like if you make it a chip & pin so the card could become an unforgeable digital signature (physical signatures are absurdly unsecure too).

Digital signatures are this just as much as any other cryptography:

https://xkcd.com/538/

You can put a gun to someone's head and force them to sign something, or observe their PIN and borrow their card while they're not looking, and the signature will match. Which means it is no solution to the problem where you claim there is a valid signature and they claim it isn't legitimate and the signature can't tell you who is telling the truth.

There are people willing to riot in the streets and burn down major cities because you dare suggest they have an ID card to vote. Can you imagine the uproar and unrest suggesting people carry a national ID card to do anything would be?

Voting is a constitutionally protected right. Accessing a credit line is not. Requiring a national ID to vote potentially discriminates against those too old/poor/immobile to go out and buy the ID card. It's a de facto poll tax, which is illegal.

But, your point is still true. Americans have an irrational fear of a national ID .

In Europe, ID Cards are free.

You still have to...

- drive to the government office (cost of transit)

- typically during business hours (non-free for hourly employees)

- provide some backing ID (otherwise, what's to stop somebody claiming to be me/you). That might not be free.

Basically, anything that might disenfranchise a protected class of citizen is going to have a tough time getting bipartisan support. Look no further than state-wide voter ID programs - almost all originate in conservative, GOP-led states - and almost all are thinly veiled attempts to prevent poor and minorities from voting (those two groups are more likely to support Democrats).

Same with voting...

In some cases, yes. But, not always. The states are a bit of a hodgepodge...

- Washington and Oregon votes by mail for most/all elections (>95% mail ballot). No clue how they validate the sender, but you don't have to leave the house on election day.

- NC voters have to show an ID. But, just about any official-looking bill, bank statement, pay stub, or government document with voters name and address on it will do.

- Arizona similar to NC, but if no photo ID, must show 2 non-photo documents.

> Americans have an irrational fear of a national ID .>

Americans have a rational fear of a national ID.

How so? Many other western democracies have a national ID program. What does a national ID program give the government that they don't already have?

If the feds are signing the card, then they have the private key. Let the individual be the only one who knows their private key, and let the feds sign an attestation that the individual's public key corresponds to a particular person.

I can't ask my grand mother to know a private key. A physical document, if unforgeable, will do just fine. At the end of the day, all an ID card does is to outsource authentication to the government, which will do that regularly (every 5 to 10y) and issue an authentication token (the ID card) for third parties.

Reply on news.ycombinator.com