Comment by dcow | Hacker News Reader

Comment by dcow | Hacker News Reader

Parent Full thread

I think a lot of people try to do identity things without understanding the fundamental nature of the problem they're attacking.

For instance: I'm really really worried that governments are going to default into an understanding of digital identity that involves ownership of an email address and mobile phone rather than ability to sign a document.

Or: I'm really annoyed that software services and web apps have clauses like "you can't use scripts or automation software to access our API" when a browser is just that. And they should really be enforcing rate limits and punishing abusive behavior whether the user clicked a button in a browser or a script did.

These type of things are not rooted in a fundamental understanding of identity, they're sloppy stop-gaps. Despite all its faults, this is one of the reasons I'm super excited about WebAuthN. At least is make common the idea that an identity is a cryptographic secret and not a "possession of an email and phone". We really really need to dig out of this "email address identifies you" hole.

Anyway it's exciting to see people discuss the topic more formally. It gives me hope that we can ultimately get to a better understanding of digital identity and not be trying to solve impossible problems by chasing an impossibly perfect solution that verifies all 3 tenets that actually doesn't exist and making a big mess of things because nobody stopped to ask or understand the scope of what we should be trying to do.

Ultimately identity should be empowering not oppressive. And right now it feels more like services oppress people into all sorts of weird requirements like having an email, getting a phone verification code, running software on a device that has an integrity attestation framework, etc. rather than trust them and punish bad behavior.

I want my government (and web services, but especially my government) to trust me and punish bad behavior, not treat me like an untrusted bot that needs to be managed and continuously verified.

> At least is make common the idea that an identity is a cryptographic secret and not a "possession of an email and phone". We really really need to dig out of this "email address identifies you" hole.

A cryptographic secret is not an identity; at best, it is a way to authenticate access to an identity. A "secret" can be lost or stolen; it is at least something I am not stuck with for life--unlike a biometric--but only if I have a way to change it, which implies that the identity is NOT the cryptographic secret.

I'd actually argue that an email address is much more similar to the concept of an identity--as long as we accept an expensive definition that doesn't requiring an identity to be "a human" or anything silly like that, such that a faceless "role" can also serve as an identity--than a cryptographic secret.

To be clear: I agree that it sucks that so many people want to make authentication happen via credentials you can't truly possess (such as an email address, as at the end of the day you can't even truly possess a domain name) or control (a problematic category which to me includes biometrics); but trying to fix that is unrelated to the concept of "identity".

>Ultimately identity should be empowering not oppressive.

I agree completely. Are there any examples of that though, where it is empowering?

Talking about government (or any bureaucracy) there is no chance of empowerment, at least from the administrative arm. Software is written by lowest bidders for the convenience of administrators, to help them treat people like cattle. This can only change when we complain to real politicians who could potentially advocate for empowerment. As long as bureaucrats are in charge, it only gets worse.

Without identity posession is impossible - i.e. tying your name to contracts is impossible, thus owning objects or property becomes difficult. This is between individuals, but enforced by governement.

It becomes oppressive when you do not consent to giving your identity but it is taken and possibly used against you i.e. logging what you do online, having cctv video taken of you without consent - all things that can be used against you without explicit consent

The acceptance of a higher power that enforces contracts is not empowering. It is rational but still oppressive even if one argues that it is chosen rather than merely accepted.

It IS empowering.

The default state of being is that nothing is enforced besides what you can personally enforce. As a regular person this means you have no power, no property, no rights, nothing in the face of someone with a bigger stick.

The rule of law empowers all but the absolute strongest to also own property and gather resources while protecting them from arbitrary violence.

We merely replaced bigger sticks with bigger balances because physical strength is not the end all for our society. There is nothing empowering in the arrangement. Supposedly the purpose is to limit power to ensure a more level playing field, but it does not work that way in the end anyway.

It is two sides of the same coin.

Take science for example. Identity is empowering because you can say, "look, I synthetized unobtainium, my name is on the paper", which shows your value as a scientist and so you will be respected and trusted with important experiments. It is also oppressive because if you don't have your name on a paper, you will be considered a worthless scientist.

If you have something attached to your name that gives you some power, we can also say that not having that something takes that power away from you. Or its counterpart: if something attached to your name causes you to be oppressed, not having that something empowers you.

> Are there any examples of that though, where it is empowering?

In most airports of the world, a US passport is quite an empowering identity.

I wrote something a couple of years back about online identity that I think still stands true today: https://medium.com/@canadaduane/the-vastness-of-online-ident...

- identity is who you are (relationships, memories, secrets)

- identity is recognition and discernment (others need to confidently assess that you are you, and not a counterfeit)

- identity is correlation management (whether managed by others or ourselves, we have a right to privacy and selective disclosure)

To these people, anonymity is the problem. being easily doxxed and public is considered a good thing to them.

The simple solution is democratization. If average Joe can’t have privacy, then President Joe shouldn’t either. And average Joe should have as much access to President Joe’s data as President Joe does to average Joe’s.

A good read on the topic is David Brin, The Transparent Society. https://en.wikipedia.org/wiki/The_Transparent_Society

Counterpoint: https://www.schneier.com/essays/archives/2008/03/the_myth_of...

> an understanding of digital identity that involves ownership of an email address and mobile phone rather than ability to sign a document.

Buying a SIM card in a great many countries today already requires showing state-approved ID and then signing a form that the shop clerk prints out. So, ownership of a mobile phone number does mean being able to sign a document. Are you concerned about SIM-jacking? I admit, I find the thrust of your post difficult to follow.

It absolutely does not, since a sim is just an object which can be acquired any number of ways than the intended one. They can also be faked and not even possessed at all, since all the server sees is some data. The server (the phone companies hardware) is not a notary public watching you sign something after verifying that your ID matches your person.

This is exactly the grossly naive assumption they are talking about people treating as though it had any substance at all when it has practically none.

Reply on news.ycombinator.com