Comment by bogwog | Hacker News Reader

Comment by bogwog | Hacker News Reader

Parent Full thread

> I kinda wish there was an imaginary "real person with an honest identity" type system that did exist where we could interact without the land of bots and dishonest users and so forth. But that obviously brings its own issues.

That sounds like it could be done in a way that isnt terrible. As a user, you sign up with an identity provider by submitting personal documents and/or an interview to prove that you’re a real person.

Then, when you sign up to an app/service, you login with the ID provider and come up with a username for that service.

The ID provider does not give the website provider any of your personal information; they just verify that you exist (and you login their their secure portal)

The identity providers could further protect privacy by automatically deleting all of your personal documents from their databases as soon as the verification process is complete. They could also have a policy to not store any logs, such as the list of services you’ve signed up for.

This could still be gamed (ex: a phone scammer tricking someone into getting verified with a provider to get a valid ID), but itd make things much harder and costlier.

Am I missing anything obvious that would make this a terrible idea?

Your idea becomes useless for deterrence from the "automatically deleting" point. The only benefits for having users who are "real person with an honest identity" accrue when people either can't make many accounts (so banning an user actually bans them instead of simply makes them get a new account) or when you can identify them in case of fraud or child sexual abuse material or some such.

So at the very least the "identity provider" absolutely needs to keep a list of all real identities offered to a particular service; otherwise the bad actors will just re-verify some identity as many times as needed.

But if you give up the "hard privacy" requirement, then technically it's possible. It would also mean that the identity provider would sometimes get subpoenas to reveal these identities.

Yeah but making it difficult to create multiple accounts increases the power of a ban. It may not catch a CSAM distributor if the ID provider doesnt keep logs, but it will make it easier to prevent CSAM (and other illegal stuff and spam) on a website/app since its much harder for those people to create multiple accounts.

> So at the very least the "identity provider" absolutely needs to keep a list of all real identities offered to a particular service; otherwise the bad actors will just re-verify some identity as many times as needed.

The website operator is the one independently banning the ID, not the ID provider. Sure, someone could create multiple IDs on multiple ID providers to dodge those bans, but that’s harder to do, and there could also be a fee charged for each verification request.

I could see this also providing ID services for certain niches, like if you want to create a forum for registered nurses only, you could allow registrations only from ID providers that check those credentials. (Or give verified users a special badge, etc). The damn thing could be gamified.

I just worry that, in the real world, this idea will devolve into the dsytopian nightmare that is China’s social credit system no matter how hard anyone tries to prevent it. All it would take is one well placed “think of the children!” argument to justify invasive tracking and data collection/retention.

…but man, if this world didnt suck so bad, a system like that could really help clean up the internet.

Well this sound very similar to PKI and domain registar so the issues with them are pretty same.

But like PKI, if we can have id providers delegated by high authorities, the roots could be governments which could delete to smaller entites and so on. Not to much diff from pasports or liscence

Governor Dao has a better working system for this already. Authenticated anonymous identities. They are currently targeting the NFT space, but this tech could also be applied to online communities. https://authentication.governordao.org/

Without any background info, that looks like a joke (or scam) site. It asks you to record yourself repeating “The best things in life will always be free”, like some demon is going to kill you in 7 days if you dont share this email lmao.

Idk what Governor Dao is, but using blockchain tech for identification sounds interesting. However, the tech is seemingly always associated with scammers and criminals, so idk how successful it would be as the backend for a system based on trust and sharing sensitive data.

The thing I was thinking of when it comes to the ID provider is the potential power an ID provider has... if say you wanted to be validated, but still have some anonymity in some cases ... or just if they decide to invalidate you for any given reason.

Granted all very hypothetical stuff, I'd give it a spin for sure.

Reply on news.ycombinator.com