Hacker News Reader

Comment by ineptech | Hacker News Reader

Is it time for a Federal Department of Verifying Whether People Are Who They Say They Are?

Veryifying identity with SSN is broken. The right way is probably more or less how big webapps do it - MFA + a password that the user can reset by providing a bunch of info. The government has the necessary private info to do this in most cases (e.g. DL# plus your income from last year's taxes), and can fall back to "Show up at a police station/DMV/other office and talk to a human" in disputed cases.

I'm sure there are lots of private corporations that would love to be the One True Arbiter of who's who, but none of us would trust them, or want to pay the price. An open source solution (something like Keybase?) seems possible, but not without government backing.

View on HN

USPS is a good contender for identity validation, too.

USPS is no longer really part of the federal government.

Yes it is, 100%.

I love that I got downvotes for this. People are mad about the post office.

They should downvote it, it's entirely inaccurate. https://en.wikipedia.org/wiki/United_States_Postal_Service#G...

The USPS is often mistaken for a government-owned corporation (e.g., Amtrak) because it operates much like a business. It is, however, an "establishment of the executive branch of the Government of the United States", (39 U.S.C. § 201) as it is controlled by Presidential appointees and the Postmaster General. As a government agency, it has many special privileges, including sovereign immunity, eminent domain powers, powers to negotiate postal treaties with foreign nations, and an exclusive legal right to deliver first-class and third-class mail. Indeed, in 2004, the U.S. Supreme Court ruled in a unanimous decision that the USPS was not a government-owned corporation, and therefore could not be sued under the Sherman Antitrust Act.[90]

My mistake, I misread you as stating it's 100% not government anymore. My bad!

Thank you for correcting me.

Well . . . 85.7% (6/7). On Sundays, it's Amazon's: https://www.bloomberg.com/news/articles/2015-07-30/it-s-amaz...

No, it absolutely is not, it's a government entity but an independent one like dozens of other agencies.

“independent” agencies are actually part of the executive branch.

Yes, which is part of the government, as I mentioned. The important point was that it was gov't and not private as several people were claiming.

How so? It is one of the very few constitutionally enumerated functions of the federal government, and I don't remember it being privatized?

This is actually brilliant considering USPS can process passports and does banking light services (money orders).

This is actually how it's done in New Zealand. We have something called realme https://www.realme.govt.nz/, which is made by New Zealand Post (our government post service, with the benefit of offices all over the country to do the initial ID verification for account setup) and the Department of Internal Affairs (they do things like births, deaths, marriages, passports, and citizenship, so they're used to dealing with identity)

It's an awesome system that the US would be lucky to have. I say this as a dual citizen of both countries.

I'm a kiwi citizen too, and for some reason I thought you had to renounce your NZ citizenship to receive a US one; kind of neat to hear the opposite!

The parent poster might have dual citizenship by birth, which would be a different case than starting with only NZ citizenship and acquiring US citizenship later (or vice-versa).

Dual Citizenship in the US isn't explicitly allowed, but it's not disallowed either and in practice isn't an issue. [1].

1- http://immigration.findlaw.com/citizenship/dual-citizenship....

I would not trust USPS with anything. I came by to pick up my mail and they gave me someone else's mail - a stack of 40 some letters / documents - all sorts of sensitive stuff that I could in theory open up and steal that person's identity.

Please, think before you say USPS... this agency is broken as hell. The last thing we want to do is trust our identities to them.

Won't work. Once companies start gathering private data stored in this DB, it can be compromised and government isn't that great at securing data either. MFA would required everyone having a smart phone or RSA key fobs. SMS/Phone based authentication isn't secure.

Only real way to get true identity system is biometrics(Fingerprints,DNA, or Iris) taken at birth. But that will never happen for privacy reasons.

That's also problematic. If I can capture your data, then I can supply that data at a later point. Even if there are "secure" endpoints that collect that data for verification; I'd just need to compromise one of those.

Identity is hard.

Biometric national identification is used in many countries, with India's Aadhaar system being the best example. Those systems are mostly used in developing countries that are leapfrogging their financial technology past the legacy systems that the 1st-world powers developed in the 20th century. 'Privacy reasons' is an American cultural anomaly, especially considering the lack of privacy we suffer from the system used by companies like Equifax.

> 'Privacy reasons' is an American cultural anomaly

You can't say that immediately after citing Aadhaar as the "best example" of biometric national identification. There has been massive pushback against Aadhaar for privacy reasons specifically, which just resulted in the Supreme Court declaring privacy to be a fundamental right - something which, incidentally, goes far beyond the approach to privacy taken in the US and Europe.

The whole point would be to move off of shared secrets, so data breached from one company's DB wouldn't be usable to impersonate the victims elsewhere. The idea is to abandon the idea that any data (which ever leaves the consumers's hands) is private or needs to be protected to prevent ID theft.

We have the technology, i.e. certificates, signatures, smart cards, identity federation like SAML.

Biometric has its own problems. What's a fingerprint but a password you can't change?

Any secret can be stolen, bio or otherwise. The key to robust ongoing identity is not a better shared secret, it's a better way of recovering from theft of shared secrets. One way is to have a big trove of non-secret-but-not-public data, like prevous addresses and employers (which is how the credit bureaus sometimes authenticate people). Who has more such info to draw from than the government? Another is to use shared info that goes stale quickly, e.g. "What magazine did you get in the mail yesterday?" Again, the government, by virtue of being the government, already has candidate info to draw from.

And what if all else fails, if some super-hacker has stolen or has ongoing access to every single piece of digital information that could be used to authenticate you? If you're a startup or a corporation or an open source project, you throw up your hands. If you're the government, you say "Please visit your nearest police department and bring your photo ID and some utility bills."

The more I think about it, the more I'm convinced that this is the only good solution. Like someone else in this thread said, Identity is hard. There's no silver bullet to make it a tractable problem, but you can throw enormous resources at it. And in the government's case, the most costly part (building a brick-and-mortar office in every city, town, village and hamlet in America and staffing it with humans) has already been paid.

What you explained is what global entry, tsa precheck, and nexus programs are.

...except that TSA Precheck doesn't host an OAuth server that my bank can use in lieu of their dumbshit "street you grew up on" nonsense.

But yes, I agree, it's a good point that the government already does this (ditto for lost birth certificates, etc) and this would just be tying the federal identity that they work so hard to verify to a digital one.

> dumbshit "street you grew up on" nonsense.

I call these what they are: Insecurity questions.

I have also taken to writing completely unguessable nonsense as the answers and recording them in my password manager.

> ...except that TSA Precheck doesn't host an OAuth server that my bank can use in lieu of their dumbshit "street you grew up on" nonsense.

Precheck/Global Entry give you a known flyer/traveler number, which combined with your personal information, authenticates your identity between your travel provider and the government.

Some people are born without fingerprints. Would make it a crappy method for them

SSN is an identifier (username), not a verifier (password). Don't deal with anyone using a small number you can't change as an identity verifier.

We got govt + all banks on board with a national digital id. Basically all systems that were considered safe enough such as the major banks online systems (with advanced 2fa) are allowed to issue digital IDs that can be used as logins to all authorities and any other place that needs verified id.

This system probably paid for itself in a hurry.

  Is it time for a Federal Department of Verifying
  Whether People Are Who They Say They Are?

After the colossal theft of employee information from the Office of Personnel Management, I have no faith that the feds would be able to keep the information secure.

Reply on news.ycombinator.com