Hacker News Reader

Comment by hakfoo | Hacker News Reader

I'm mostly offended that they're using a third-party private service.

We need a reliable link-to-meatspace authentication provider for the consumption of government services. That's obvious.

But why are we outsourcing it to an external company, which may not be subject to the same purview as the government itself, particularly in terms of legally-mandated transparency, accountability, and universal service?

I suspect half of this is anchored in the "mark of the beast" crowd who is terrified at the thought of any sort of coherent national identity document system. After all, if we had a central "Department of Identity" already, adding some sort of account system linked to the pre-authenticated passports and driver's licenses you already have would be trivial and within their wheelhouse.

View on HN

> terrified at the thought of any sort of coherent national identity document system

If the outcome that they want to avoid is actually a global ID system, you'd think that a private corporation (that could offer its services to multiple countries, interoperably) would be more worrying to them.

It's not like, by opposing a government-run ID system, they've prevented the existence of an ID system that the government accepts (and could mandate nationally).

This is a big blind spot in the US generally. Few people consider that corporations could be a bigger risk than the government, so they limit government power and leave corporations less regulated.

Yeah while that may be a reason, and I say that with respect, that's not the reason we let corporations do what they do.

That's just temporary embarrassed millionaire syndrome and financial greed.

A corporation can't arrest me, shoot me, confiscate my property, or otherwise tell me what to do outside any voluntary contract with them. It's really not the same at all.

But when the government mandates usage of a private company, what’s the difference?

> Few people consider that corporations could be a bigger risk than the government, so they limit government power and leave corporations less regulated.

> A corporation can't arrest me, shoot me, confiscate my property, or otherwise tell me what to do outside any voluntary contract with them.

I think that while corporations may be more likely to have risk, the risk may not be as big as if it were done by a government. So, high chance of risk but maybe lower damage vs low chance and higher damage may end up being a wash and may explain why some people fear the government more than corporations.

Typical libertarian blind spot. If the government contracts out to a corporation, you get the worst of both worlds: they can tell you what to do (follow id.me rules or else) and you can't vote them out of office. If you vote the people who hired them out of office they still have a contract so we are stuck with them.

And a corporation hired to, say, run a prison can shoot you.

> A corporation can't arrest me, shoot me, confiscate my property, or otherwise tell me what to do outside any voluntary contract with them. It's really not the same at all.

Corporations have done all things, even within the boundaries of the USA.

You are welcome to argue that this should not have been possible, should not be possible etc., and very few people, including me, are going to disagree with you.

But if we're going to talk about what actually happens in the real world rather than what should happen, everything you've said there is factually untrue.

Can you please post links to well-documented examples of each?

States use violence routinely, corporations may order a hit on someone maybe once in a blue moon. Usually any violence they do is by co-opting government mechanisms already in place.

And btw I am a left-libertarian who criticizes both states and corporations

Look up the case of Stephen Donziger. Chevron basically did just that.

The goal is to be able to point the finger at someone else when there is a problem.

There should be a protocol, in which voluntary individual participation is possible alongside identity brokers. This is one of those things that should have zero trust baked in at every level. It should require reversible data transactions, and real world mechanisms to allow legal authorities to reset or return ownership of ID information. It should work concurrently with a properly defined notion of valid, entirely offline identities to accommodate people who don't want their identity digitized.

Multi signature cryptography and webs of trust are pretty mature concepts at this point. Using public notary systems could provide the real world authentication to publish keys, so the protocols could be developed around the idea that additional bureacracy and government shouldn't be needed - use the systems already in place wherever possible.

Wrong. It’s due to capitalism as a political economic system. The US government is nothing but an association of global corporate stakeholders. It’s not in service of its citizens. It’s the neoliberal world order.

I tried to file for unemployment insurance benefits for the first time back in July, and I'm still in limbo thanks to Id.me. My state won't let me into their online portal without verifying with Id.me, but their website fails to recognize the photo on my driver's license. Their customer support rep apparently couldn't help in any way other than to escalate my ticket. Got an email update in November to please be continue being patient...

Bonus points to the state of Florida DEO for removing any human staff from their phone answering system. It's just an automated menu that always leads to forced disconnection and useless advice to check their useless website.

Why even have a government if it's adversarial to its own citizens?

> Why even have a government if it's adversarial to its own citizens?

The point is to be adversarial to the correct citizens, e.g., poor people and minorities. That's just basic conservatism these days.

There is almost nothing conservative about it. The US government and both US parties are plainly neoliberal. Capitalism as a political economic system is contradictory to sustaining a state that serves its working citizens over its ruling class and global corporate stakeholders.

It couldn't recognize my documents either, but I got directed to a video chat with a real person. Took several hours because the "queue" randomly stops refreshing, but I got verified with in a day.

It was ass, but at least it worked. You never got the video chat option?

It's insurance so you paid for it. If you know an attorney, maybe look at where the State agency thinks it got authority to demand this and maybe sue for injunction.

In Denmark they actually issue their citizens little RSA tokens for use authenticating into government websites. Of course, there are issues sometimes with desynced tokens but I wish our government took things that seriously.

As an aside, if you're using ssh-rsa the latest openssh server removed the RSA encryption module for pubkey verification, by default.

You can add it back into the sshd_config in /etc.

It should be added that this is because ssh-rsa uses SHA1, which is broken, and not because there's a problem with RSA itself.

My main key was a ed25519 one for a while (looks like 2016-2018) but after running into so many edge cases I just went back to a rsa 4096. Is it in a better place now?

ssh's support for RSA has nothing to do with RSA tokens, which is the common name for RSA's SecurID hardware 2FA generators.

> I wish our government took things that seriously

See the recent Zero Trust memo, https://news.ycombinator.com/item?id=30101411

That makes me incredibly optimistic. Thanks for sharing that. :-)

Wondering why centralized department of identity is needed. Could it be decentralized?

Decentralization doesn't add value because it's not really a consensus/disagreement problem.

If you look at it a certain way, we're not considering the general problem of identity, just "association with government accounts". We already have an established set of roots-of-trust and dispute resolution protocols for figuring out which accounts you're attached to. All we need is a tech-friendly set of credentials to supplement the paper passport/driver's license/social security card.

If anything, decentralization would be difficult for the legal system to work with. How do you force everyone else to accept an update from the courts, especially if they're politically opposed to, or disincentived to, accept the update? You could try to tie legal acceptability to staying up to date, but then you'd create a huge liability for software bugs.

This is worth some discussion. Notaries are decentralized and regulated. Alternatively decentralized at employer, UI logon credentials could be set up when onboarding each new hire.

Then you start running into differing motivations. How often would you see employers "forget to" synch new hires with the unemployment system, figuring that will reduce their claim rate later? Or check in new hires as "verified citizen, eligible to work" when their proof consisted of a McLovin driver's license and a birth certificate still warm from the Kinko's across the street?

It feels like it would turn into every other abused aspect of employment law: widely exploited both because of technical incompetence and the knowledge most will get away with it.

There is a digital identity act making it's way through Congress. Check it out and if you support it write your local representative.

https://www.congress.gov/bill/117th-congress/house-bill/4258...

I recommend the curious to check out DigiD. It's a relatively well-designed SSO for many (if not all?) national and local government services in the Netherlands: personal taxes, business taxes, municipal taxes, trash and water bills, health insurance (trusted private), social benefits, police services, and more.

I suspect login.gov is going to be expanded.

Reply on news.ycombinator.com