Comment by toomuchtodo | Hacker News Reader

Comment by toomuchtodo | Hacker News Reader

Parent Full thread

This is not a call for fatalism. This is a call for trust infrastructure, trust anchors, and proven underlying identity and trust mechanisms.

What happens when you try to fake being an Estonian who holds a national ID card that utilizes cryptographic primitives? Along those same lines, this infrastructure is the very same needed for business to transact (think document/agreement execution, bank accounts, brokerage accounts, payment processing, real estate ownership record systems, etc).

If I can't prove who I am, that's a gap to be solved for by government (and many have already solved for this, it is a well worn path [1]). If you require me to attest to my identity, that's a regulatory, governance, and oversight issue. As glib as is sounds, fight misinformation/disinformation with trust (infra). Make trust the default, not the exception.

EDIT: Login.gov [2] provides authentication services for DHS' Global Entry. Why can we not use that to attest identity facts elsewhere? Why can't any citizen get a CAC [3] to use with this system? (I frequently see Login.gov is hiring for SREs, but no internal advocates/champions; why?) Why can I pay with Apple Pay but can't prove my identity without a paper birth certificate and social security card (or a passport if you're among the well heeled)?

</soapbox>

[1] https://en.wikipedia.org/wiki/List_of_national_identity_card... [2] https://login.gov [3] https://www.cac.mil/common-access-card/

> Make trust the default, not the exception.

So the death of anonymity. I already hear the defenders of such a proposal: "If you don't want to give Facebook your federally issued ID then you still have the darkweb!" Followed by an endless stream of hit pieces equating everyone fleeing to non-privacy invasive platforms as nazis/pedos, and mobs of idiots demanding that infrastructure providers null-route wrong-thinkers.

Are you sure that really want a CAC? The OPM gave my biometrics and SSB to China, as well as every other military/gov employee. Except the CIA - the only one who managed to fight off the administrative record merge. If only they didn't draw so heavily from the veteran pool...

I'm not here to advocate either way for anonymity (two cents: providing privacy requires strong legislation and rigorous enforcement, Germany does well in this regard I think), simply improved trust infrastructure the country badly needs (which would be an efficient medium by which to improve trust online). No problems with my CAC, despite OPM's failure. Elect better legislators and improve working conditions for technologists in government if you want better security posture (which we should). There is a reason USDS has to hack the GS pay scale to get good people into positions of leverage.

Facebook already requires you to use a government issued ID to identify yourself if they question your profile [1]. Not a legal requirement, Facebook's requirement. Twitter also requires government ID to get a blue verified checkbox [2], or to report fraud.

TLDR: I will take a somewhat ineffective government, warts and all, with the understanding work is necessary to improve it over fatalism and apathy that brings about total dysfunction.

[1] https://www.facebook.com/help/159096464162185

[2] https://help.twitter.com/en/managing-your-account/twitter-ve...

> > Make trust the default, not the exception.

> I'm not here to advocate either way for anonymity

Is trust and anonymity somehow disconnected in your mind? Before you answer that, I'll point out that I didn't say pseudo-anonymity.

> No problems with my CAC, despite OPM's failure.

So you're either a post breach boot or you haven't yet noticed a personal impact. While I've never had the desire, due to the contents of my OPM file, I could never do any business in China under my own name without drawing a disruptive amount of attention. That may or may not be a problem in the future, nobody can say. But it can be said it should have never happened in the first place, as there was ample well reasoned warning and precedent. Anybody else remember the clipper chip? What about that "golden key" stupidity?

Whatever policy Facebook has at the moment is completely beside the point. What you are talking about would require the force of law. This proposal has been floated numerous times, tying online activity to a federally issued identifier.

> Elect better legislators...

lol

I hold contractor status, and I would never step foot in China (for obvious reasons). I think we see things fundamentally differently, and I wish you well.

I don't wish you ill, but I wish you and your ideas had no effect on me. Which is more to the point - you are focusing on the wrong part of the problem. Trust and disinformation isn't the problem, the problem is the second order effects. It would be easier to reduce the potential damage that useful idiots and victims of propaganda can do to everyone else, than it would be to pull off the impossible trust+anonymity+benevolentFed scheme.

Why should I trust the US government to assert who you are? Surely they make false passports for their spies all the time.

Why should I trust your Keybase proof? Because "they [Zoom now] say so"?

Those seeking to verify identities and personas are free to ignore whatever roots or trust chains they choose. Edge cases aside, the US government (in the case of your example) still holds and projects trust value (not sure how many US passports per day are used to validate citizenship, employment eligibility, and entry requirements at nation state borders, I assume it's quite a bit).

Trust is hard (there are entire industries around it), but the notion that it's impossible should not be entertained. It's a core component of modern civilization.

Reply on news.ycombinator.com