Hacker News Reader

Comment by Jaruzel | Hacker News Reader

The thing about a single online Identity is that there should be no way for it to be revoked against the will of the person it identifies. In real life I am who I am, and unless I choose to change that, no-one can legally take my identity from me.

There's been too many horror stories of people being locked out of their Google or Facebook accounts by Google and Facebook, even for the most minor of infractions, and that person immediately also losing access to to all the other services they used 'Sign in with...'

Until this problem is solved, I will never switch to a single online Identity for access, and I certainly will never use my Google or Facebook account to register with third party services.

View on HN

Very well said. I’ll add that it creates a single point of failure for being hacked as well. Plus it drives me crazy that 1Password doesn’t support it.

Anyone know if Bitwarden does?

Yes. It would be nice to have a government-issued e-mail address that couldn't be taken away from me by anything short of a court order.

[US centric] It feels like we're almost there between usps.gov and login.gov, someone at USDS just needs to make the equity and digital access case to get the funding to build out the app. The current administration has already expressed its position on federal service delivery improvements [1], and frankly, USDS/18F has a track record of crushing it. This would go hand in hand with the USPS slowly making its way to being a meatspace trust anchor/identity proofing|credentialing provider [2]; problem with your email account? Get help in person at your local USPS.

[1] https://www.whitehouse.gov/briefing-room/presidential-action...

[2] https://www.cfr.org/report/solving-identity-protection-post-...

What about starting with a public library?

120 year email + static hosting tied to library card.

Start with one branch or small system, scale from there.

Could reasonably be managed per branch with central support orgs. I guess most of them have a server room or colo or similar with a couple U free.

I see where you're coming from, but it would also be an extreme liability. For example, imagine companies demanding that you sign in with only your uniquely-identifiable government email address so they can better track you. The necessary technical qualities to resist such attacks (eg allowing any user to generate a bunch of additional nyms) will never be considered in make-everything-legible government thinking. Social security numbers and drivers license numbers are already abused by surveillance companies, and so the last thing we need is another government-issued identifier without something like a US GDPR to prevent its abuse.

Also, the kind of long term stable online identity you're desiring can already be had by registering your own domain name.

Registering your own domain name still puts you at the mercy of public opinion in the form of registrars. Sure, becoming persona-non-grata to registrars doesn't happen every day but it does happen and it certainly isn't becoming less common.

I think government email services would be very risky, both in a legal sense and in a cybersecurity sense.

You can have government authentication without too many issues, though. The EU has a digital login system that's federated (EIDAS) and your government should never have to retract your ID unless you die. Some implementations use physical smart cards to sign in, others use usernames/passwords+apps/2fa. The system is currently intended only for official government business, but under the hood most systems use something close to OAuth2 so it should be possible to modify the system to allow generic logins.

The downside of such a system is that the using the same authentication for government grants and your social media makes it very easy to phish people. This increases the security requirements of the system significantly, which in turn make the system very annoying to use. The authentication mechanism also allows the government to track exactly what services you use and when.

Personally, I'd much rather see OpenID return. The ability to pick an identity provider and log in would allow for multiple accounts and the ability to control your own data.

Alternatively, wide-spread use of something like https://irma.app/ would be even better. This allows for decentralised identity that you can take with you, just like a regular ID. It also allows for exposing only scoped data (ie "is this person of drinking age" rather than "what's this person's birthdate").

Which government? US federal? State? County? City?

Part of the fun of the internet is that it is really international so I'd expect it to interoperate with Canada, France, Ukraine, etc. What if people from Barcelona want a Catalan e-mail address?

Ideally I'd like a global government to do it, although I don't like the current structure of the UN. I think what I see in the web3 space is possibly a yearning for a global registry, whether for identity of humans or businesses (DAOs), or even a global currency.

So for me, I'd like a global entity that more closely resembles the global nature of the internet, combined with a more globally representative structure.

I think whoever issues passports might be able to take it on. So, basically the post office? I'm not entirely sure to be honest.

Social security numbers get wrongly revoked and you often end up having to sue the US government to get any redress.

Why in the world do you want them to host your email?

Perhaps a little better, but anything the government does is always subpar

Whatever email server/system the government created would be so bad no one one would use it.

Maybe it just needs to be a forwarding service to your current REAL email address?

This is why we need a federated protocol. Most people can just trust a major player. More technically inclined people can host their own.

How would that be different than what happens with email? Getting email through to major providers is a challenge.

It would be more like receiving mail from a service than sending mail to a service which isn't a problem. There isn't really a spam component.

I show up to bigsaas.com. Big SaaS asks me to identify myself. I submit that I am rob@robmccoll.com optionally with a proof of that claim.

If I have provided a proof (think attestation along the lines of "The holder of this certificate is rob@robmccoll.com requesting to use bigsaas.com at time T using signing key Kpub") it will be signed under a key chain whose root can be obtained from a specifically formatted DNS TXT record under robmccoll.com (similar to DNSSEC or DKIM - maybe it gets a custom record type). bigsaas.com can fetch said key and verify the signature.

If I haven't provided a proof, bigsaas.com looks up a DNS record under robmccoll.com that points to which server provides this authentication service for the domain and does something like an OAUTH or SAML type of exchange but without the need for point-to-point pre-configuration. It beings this exchange with a signed request "This is bigsaas.com attempting to authenticate rob@robmccoll.com at time T" which is signed under the key in its own DNS records (or at least a chain that can be verified under that key).

Either way, the service doesn't have to have some pre-seeded trust beyond trusting DNS (and this should probably insist on DNSSEC and TLS-only for whatever interactive authentication gets layered on top)

Edit: I guess this is kind of OpenID, but to be honest, OpenID looks way more complex than necessary.

It seems like their proposed solution is decentralized blockchain identities which in theory should be impossible to revoke. I don't know what that would look like in practice, but if every web service needs to support it then I doubt it will ever happen.

Reply on news.ycombinator.com