Hacker News Reader

Comment by gjsman-1000 | Hacker News Reader

Fantastic. Let's centralize all records from everybody in one central location that totally won't get hacked, by the same government that screwed up Healthcare.gov, your DMV, and just recently a war against militants wearing sandals.

View on HN

The EU has a federated public key cryptography based identity system. The member states recognize identities issued by other member states, but there is no central system.

In any case, the private key is stored on a plastic ID, only released with a PIN, and the databases only store the corresponding public key.

A leak of a public key without the private key is harmless.

https://en.m.wikipedia.org/wiki/EIDAS

Yep. Public private key is absolutely great for this.

SSH been using it all these years and still going strong.

That makes more sense than the OP's suggestion.

This is just an unhelpful argument. You might take issue with how government functions, and necessary improvements, but these government functions are still required in a developed nation.

Clarification: OC doesn’t seem to be arguing that these govt functions shouldn’t exist; they’re arguing that it’s wrong to trust govt with digital security more than we trust private companies.

Exactly. I don't dispute government services existing, I'm disputing that the government will do a better job than T-Mobile just because they're the government.

Companies like T-Mobile don't do a better job because their is no incentive to do better. Either the government needs to force company's hands through legislation with real teeth or take over the job themselves. The status quo is a failure.

Why would the government do a better job at digital security than TMobile?

Well, the government in the US functions just fine without the centralized ID System the OP is wishing for, even though stuff like this occurs.

There is literally no reason why Americans would trust the central government to be more secure than T-Mobile at this point.

It clearly doesn’t, and it’s foolish to say it does based on the evidence.

WannaCry was developed with stolen NSA technology in 2017. Despite that the National Security Agency should be more secure than anyone and these tools weren't available to the public. You really trust a public service, not run by the Security Agency, to be more secure than that?

I disagree here. There are innovative solutions for private decentralized encryption. Other countries have also already implemented similar solutions. Almost anything is better than a 9 digit number. The government also has the resources to hire some of the top academics. Companies have proven time and time again to only care about money. While politics is messed up in a larger sense, there are some divisions that are majorly effective and good at what they do.

Or, just a thought, design an identifier where compromising one system doesn't immediately compromise all the individual data contained within it. SSN breaches only really hurt because its exposure means instant compromise of identity, whereas a system with some sort of partial key, signature, etc, where the user retains a portion means they have to compromise the database and the user, and if a "central" system (i.e. government, private key issuer, etc) is compromised you can re-issue the user identifier portions.

If anything it might encourage companies to smarten up if there was a law on the books that required companies that get compromised to pay for the re-issuing of the user tokens to every impacted individual.

Fantastic. Instead of one location that can be properly outfitted with the best practices let's have 1000 shitty ones.

As an American... don't trust for a second that they will follow "best practices."

After all, how did the NSA's top-secret Vault7 weapons get stolen considering that they were following "best practices"? And then proceed to bring havoc to the world with WannaCry...

Reply on news.ycombinator.com