We really don't.
The most important thing about authentication over the internet is that it enable people to create multiple separate accounts that aren't tied to each other in any way. You can get more than one email address or even phone number. You only get one social security number. If you're required to use that on the internet, it becomes a universal tracking ID. That must never be allowed to happen.
Meanwhile the US government lacks the competence to do this. All of their existing identification methods are either fully insecure (e.g. social security cards) or no better than anything corporations use (e.g. ID cards that can be lost or stolen or hacked). They don't have some special magic that allows you to prove who you are in a unique way. And trying to centralize everything into a single ID only makes it that much worse if you lose access to it or someone else gains access to it.
The actual solution to identification is redundancy and decentralization. You have e.g. a password, an app and an email for any given service. If you lose one you sign in with another and update the one you lost. If all of that fails, you lose access only to the service where it failed, instead of losing your whole life at once.
Never centralize identity.
I empathize with these concerns but think they're outdated by a decade or two. We already have universal tracking IDs, we just don't see them because they're opaque and proprietary. We already use government identification online, we just do it in the dumbest way possible: "please upload a photo of your driver's license." We've got the worst parts of centralized identity and none of the benefits.
> They don't have some special magic that allows you to prove who you are in a unique way.
Yes they do, the magic is called "losing money." FaceGoogAzonRosoft have done everything related to auth that's profitable, but the one thing they will never do is build an office in your hometown and staff it with a person who can do deal with you as an individual and physically hold your two recent utility bills when corner cases or fraud or whatever require it. The government has already built that office and hired that person, and you've already paid for it, so you might as well get some value out of it.
This is simply not true. I can go to a public library, sign up for a free email account, sign up for Google or Twitter without it being tied to my name or face or work email etc.
If signing up for any of that required giving them something tied to your social security number, that wouldn't be possible, and that must not happen.
> We already use government identification online, we just do it in the dumbest way possible: "please upload a photo of your driver's license."
The vast majority of websites don't require this, specifically because it's a pain in the butt. It needs to continue to be a pain in the butt so they continue to not require it. Ideally we should create new ways to make it even more difficult.
> FaceGoogAzonRosoft have done everything related to auth that's profitable, but the one thing they will never do is build an office in your hometown and staff it with a person who can do deal with you as an individual and physically hold your two recent utility bills when corner cases or fraud or whatever require it.
That has just no security value whatsoever. A utility bill is a piece of paper. Anybody with a printer can forge one in five minutes.
On top of that, who still gets a utility bill in the mail?
Second, your position rests on the assumption that this hypothetical federal ID will be mandatory. How will it be "required"? By whom? If the government makes a federal oauth, and it works well, sure, some webapps might require it, but they can also just require your identity today. I think you haven't wrapped your mind around the idea that any big tech company that doesn't already have your identity doesn't want it. Google doesn't care about your SSN, they care about your browsing and shopping history, but the day they decide they want it, they'll demand it, and you'll comply or go without Google services (and they'll probably get it from data sharing partner anyway). None of that would change due to what I'm proposing.
A separate device is <$50. Local VMs are ~free. VPNs hide "geographical location" and anyway they were never unambiguous because there can be arbitrarily many people in the same place.
> Second, your position rests on the assumption that this hypothetical federal ID will be mandatory. How will it be "required"?
If you make it easy to use and use of it allows you to be tracked more effectively then websites that want to track you more effectively will require its use.
> but they can also just require your identity today.
That is more difficult to do now and so they do it less. Making it easier would allow them to do it more, which is bad.
I mean there are two options. One is nobody would use it, and then it shouldn't exist. The other is that people would use it, which is bad, and so it shouldn't exist.
You need a decentralized philosophical and technical concept of identity. Nobody owns who you are except you. Self-sovereign ra ra yay.
But we also need to be able to integrate this self-sovereign identity with organized systems of shared sovereignty (gov’t). It’s silly that in 2023 I can’t oauth against id.gov using webauthn and obtain a signed assertion containing my SSN, or that I don't get a digital certificate alongside my physical drivers license, for instance.
Or we legislate and make companies provide a minimum amount of service. You can't offload your operating expenses to the government.
However, if you are fraudster and get to the point where Apple and Facebook and Google all cancel their accounts with you for non-payment or use of stolen credit cards of whatever other reason that a company would decline to do business with an individual...
Well, now you don't exist since the big IDPs won't auth you.
Or, are we suggesting that we legislate so that companies are required to do business with individuals who are making fraudulent use of their services?
The only reasonable organization to do this is the one that has an inherent obligation to do it and for better or worse, that's the government.
No, the Government has a long track record of successfully ignoring people who have hard to solve problems.[1]
> ...we legislate so that companies are required to do business with individuals who are making fraudulent use of their services
I suppose instead of just canceling your account and you losing your email, you could get arrested and charged. Or more likely end up having to use facial recognition[2] administered by a third party which is incapable of verifying people. If you think going to the Social Security Administration to have a paper card printed for you is bad, wait until you have to go to have your password reset...
Or we can legislate Google, Apple and co that if someone holds an account with them and is banned they are entitled to a human led review process, possibly by a third party or other group. We can legislate that if you're a customer in good standing, they have to have human support available. Does this mean they might be more stingy with "free" services? Probably - that isn't a bad thing. Most people take offense to Walmart moving in to areas, taking a loss for a year or two to steal customers and close local stores and then jacking up prices. I don't understand why we're ok with big tech getting a pass to do the same thing digitally.
[1]: https://www.grandforksherald.com/newsmd/va-audit-finds-thous...
[2]: https://www.foxbusiness.com/economy/irs-facial-recognition-s...
What you're saying boils down to: we cannot allow service providers to enforce any quotas, limits, or payment requirements, on the services they provide.
Start using that identity mechanism for everything and that vulnerability spreads to everything. Someone compromises your ID and then starts trying it against every service on the internet. They get your bank and retirement savings and drain your accounts, ransomware all your files and your employer's files, read through your messages on every platform to find something to blackmail you with so you don't go to the police, sign into your router and use your IP address for criminal activity etc.
I'd much rather be told to go fuck myself by one service than have my life wrecked because a low level bureaucrat issued someone else a universal ID in my name.
How do you get back a compromised Google or Facebook or Twitter account?
If your former spouse changes your password on google and is able to answer every security question you've set up just as well as you can... what can you do about it?
On the other hand, when the change of address form at the post office goes in you can walk into the post office and say "this is my government issued ID and I still live at this location. Change my address back to my proper residence and put a hold on future address changes for that address without verification."
If you had 16 followers, create a new one. If you had 16M, you get on the front page of HN etc. and they fix it.
> If your former spouse changes your password on google and is able to answer every security question you've set up just as well as you can... what can you do about it?
Have them prosecuted for fraud so they have to change it back. You don't need centralized identity for that.
> On the other hand, when the change of address form at the post office goes in you can walk into the post office and say "this is my government issued ID and I still live at this location. Change my address back to my proper residence and put a hold on future address changes for that address without verification."
So instead your ex files the ID renewal form with an "updated" picture of their friend instead of you, has the new ID sent to your old address (i.e. their address), and then prevents you from filing a change of address form or getting a new ID.