Hacker News Reader

Comment by pjc50 | Hacker News Reader

cough national id scheme, anyone? Thinking of E-Estonia here.

I lived in the Netherlands and admired how they offer a SSO service called DigiD for most—if not all—national and municipal services: personal tax, business tax, healthcare, pension, water, garbage, police and many other service portals. Yes, there is a nice online police portal where you can digitally file a police report, get a declaration for insurance, and ask questions.

You also get a digital inbox—Berichtenbox—to organize and centralize all communications from those agencies.

It is difficult to overstate how much life is made better when the government is well-organized and that organization is exposed to you through good UX. I'm now back in the US, it's been 2+ weeks since my renewed passport was supposed to have been mailed to me, and no one at the State Department knows anything.

Not having to depend on phone numbers would be so good, especially for citizen mobility.

It's long, long overdue. That said a national ID scheme has long been opposed by a vocal part of the Christian population in the states. It's association with the new testament's prophesy of the mark of the beast prevents many lawmakers from pushing forward a proposal, especially since 65% of Americans in 2019 identified as having a belief in some variety of Christianity[0].

The obvious reality here is that in the wake of no proper national identification system, social security numbers have been used instead. It's not a question of whether or not we have a national ID, it's really just a question of whether we have a functional one or an inadequate one. Nonetheless politicians would likely be committing suicide with their constituents in some districts if they were to support a push towards a better system.

[0] https://en.wikipedia.org/wiki/Religion_in_the_United_States#....

>social security numbers have been used instead

Historically that was sort of the case. I'd argue today that we mostly rely on state-issued IDs (especially but not necessarily driver's licenses) which are now overlaid with RealID requirements.

As a practical matter it's probably indistinguishable from what a federally-issued ID would be and I'm mostly content with not adding any more layers of identity verification than are really necessary. I'd probably oppose a push for a broadly required federal ID--although I have a passport (and a global entry card).

Some states allow use of SSNs for drivers license numbers.

It’s generally decreased over time though.

>RealID requirements

This doesn't invalidate your point, but man it irritates me how many states have chosen to retain a noncompliant ID tier in order to avoid eating costs or raising fees. At least my state offers a full EDL so there's some added value, but it's absurd that the 'default' local ID isn't adequate for domestic air travel.

There are non-trivial documentation requirements for RealID though. I had to go back in a second time. If someone has no need to fly it’s probably reasonable to offer them a lower bar.

There's a surprising number of people who do not possess a birth certificate document. Their parents lost it, it got thrown out during an eviction, etc, etc. I've witnessed people at DMV stations who brought in their original birth certificates, but the embossed notary stamp had flattened over the years. It takes time and money to get a replacement. If the non-enhanced IDs didn't exist, these people couldn't get a state id card.

I have a passport so it's sort of academic, but I'm not sure if I could lay my hands on my birth certificate. I'd certainly have to look through some file cabinets to see if I could find it and who knows if it's an original or not.

For people without a passport, it's extremely easy to have lost a birth certificate at some point over the years. And I honestly have no idea how easy or hard getting a new one issued is from some potentially far away city or town.

>it irritates me how many states have chosen to retain a noncompliant ID tier in order to avoid eating costs or raising fees

That's not why. States like California have dragged their feet for a decade with RealID compliance because they want to keep IDs for people in the US illegally indistinguishable from those for citizens, permanent residents, and others here legally.

That's interesting, I can imagine why certain groups would want that but not really why the state itself would want it; and if they would, why can't they just explicitly pass a law granting those people whatever rights they want to grant.

Can you elaborate on this for us non-USA people?

I don't understand why people think religion is the main reason to oppose this.

The main reason to oppose this is that if you had a low friction government ID system, surveillance capitalism would then require you to present your ID to do anything whatsoever and all privacy would disappear forever.

But we already have that? If you pay with a credit card, have an address on file, or use a state-issued ID (drivers license), I don't see how that would be worse.

Credit cards are already a privacy catastrophe for anything where you have to pay money, but people will push back if you demand one for anything where you're not supposed to be paying anything because people are rightly wary of being charged when they ought not to be. Anyone who gives their credit card number for a "free trial" learns that the hard way and then becomes appropriately cynical.

A state-issued ID generally doesn't work over the internet, which is good. Some of them can be read electronically in person, which is already being abused to a limited extent and should be gotten rid of.

Which is the general response to your concern: "This is already a problem" means we need to go the other way and address that so that doesn't happen anymore, not intensify the problem and set it in concrete so it can never be fixed.

Centralized identity is a design flaw. Your bank needs to know if you're authorized to withdraw from your account, which is why you have a bank card. Your email provider needs to know if you're allowed to access your email account, which is why you have an email password. Your apartment building needs to know if you're authorized to enter, which is why you have an access card. What we don't need, and should not have, is a single primary key binding all of these things together so it can be correlated in a single database.

As someone who campaigned against UK ID cards 20 years ago, we failed to realise that the ID requirements could be imposed without providing the ID scheme.

Since then the UK has imposed ID (technically "proof of right of residence", but that kind of has to be ID) on having a bank account, having a job, and both buying and renting houses. All without having a coherent ID scheme other than passport or driving license.

We already have phone numbers for a low friction ID system used for surveillance.

People can reasonably get multiple phone numbers. A good countermeasure against this would make this easier and less expensive for people to do, e.g. you buy one phone plan and the phone company gives you two phone numbers, either of which you can change at your leisure. Then you give one to your friends and the other to your enemies, and change the second one every time you encounter a new enemy.

IMHO the difference is that the status quo (a high friction non-universal government ID system + almost universal private "ID"/tracking systems) has all the same disadvantages anyway, but simply fails to realize the possible benefits.

What possible benefits actually are there, compared to non-centralized identity systems we already have? The only thing you get from a centralized identity system is the bad thing -- it allows surveillance bureaucracies to correlate separate authentication tokens with each other.

This means that each and every institution has to verify identities "from scratch" which they are not really capable of. Bootstrapping trustworthy verification of identity that is useful for commerce (e.g. where you can practically collect debts/credit and prevent creating fake identities so that you know who you're dealing with, can reach them for contract enforcement if needed, and can ban people you don't want to deal with) is really hard, so everyone is essentially delegating it to someone else - webstores to credit card issuers, all kinds of institutions to social security numbers, some to phone numbers, and everyone is doing that poorly and failing at making it secure since there is no solid foundation for any of it, resulting in the extremely costly identity theft problem (in USA it's like $50bn per year?) and in cases like this, where companies have to rely on "phone numbers" and ridiculous "security" questions like mother's maiden name - because they don't have anything better to use.

Privacy and anonymity are not the same; there are many domains where anonymity is reasonable and default, but also many domains where it is not; in those someone can respect privacy and at the same time refuse to deal with anonymous partners, and it's an entirely reasonable choice that they should be able to make not only in theory but in practice - having an effective, secure mechanism for a person to verify their identity to someone else.

Proper identities are a key basis for trust - without them you can do one-off immediate barters (perhaps many times), but prolonged relationships, various forms of credit and "credit-like-effects", accumulation of reputation are highly beneficial for society; and from the perspective of incentives it's worth noting that the harder it is to "get away with" betraying trust and start from zero, the less incentive there is to defect and more incentive to cooperate; there's a good reason why the game theory iterated Prisoner's dilemma (which relies on preserving identities) gets so much better average results for everyone than non-iterated or fully anonymized Prisoner's dilemma.

This is the US we are talking about. Must be against the constitution and government is bad. Better to live in perpetual fraud.

People will always live in perpetual fraud, it's only a matter of degree.

My National ID is valid for 10 years, but certificates expire 3 years after issue. Can only renew face to face, but I’m approx 30hours of flight time away from home, lol.

But I agree - NFC passports are already kinda doing that, but there isn’t enough services that support it.

Reply on news.ycombinator.com