Hacker News Reader

“Bad implementation of GDPRs information rights” would be the more correct but less clickbaity headline IMHO.

The funny twist being that these bad implementations are a GDPR violation too and can be punishable under GDPR.

Even if done correctly, they are just verifying that you bothered to get a photoshopped passport with the targets name in it.

Basically every country needs to run their own PKI for its citizens to even have any hope to legally prove they are who they are. I've so far seen a single well-working solution to the authentication and authorization problem and that is the Estonian ID-card PKI, others are trying to implement it (Finland, Latvia, actually even the EU) but they're basically nearly two decades behind.

The funny twist is that it seems pretty hard/even impossible to handle GDPR laws and could be punishable under GDPR to have enough verification.

All you know about a user is its name. How can you verify someone identity while still not being "overly burdensome" (which is required by GDPR)?

Reply on news.ycombinator.com