Hacker News Reader

> If the United States introduced a national ID it, how would it avoid the same problems as the de-facto national ID, the social security number

Everyone gets a national ID number. This number is considered public and is used for signing up for public and private services.

Everyone gets a ID card, issued by the government. This ID card holds a private key, used to enter legally-binding agreements, and the card is printed with the photo of the holder. Attempts to use the card to authorize purchases online redirect to a government-managed identity provider (think SAML 2.0), where the user must provide either a password (preferable) or, if there is no password, some other knowledge proof that is not discernible from the physical ID card, either of which were set up when the card was issued. When people become incapacitated for publicly-known reasons (incarceration, hospitalization, etc.), their public certificates are temporarily added to a revocation list. When issued, the card comes with three one-time-use secret codes, each of which triggers a 24-hour temporary revocation, which must be kept secret-enough to prevent abuse. Obtaining more temporary revocation codes, or permanent revocation (in case of loss or theft), or password/knowledge proof reset without the previous password/knowledge proof, is handled in physically secure government facilities, by providing DNA and other biometrics, that were registered when the card was issued and are not used for any other purpose. Corruption is combated at the DNA-collection stage by requiring the secure facilities to actually collect fresh physical samples each time - this constitutes a biological sort of paper trail for auditing revocation requests.

No, it's not impossible to game the system. People can be bribed to overlook the photo; DNA can be stolen and used to continually permanently-revoke victims. Paper trails are not magic cure-alls. There are serious ethical concerns with entrusting the government with a populace's DNA (particularly, the potential to re-index it for the purposes of ethnic cleansing). And yet, when compared to modern-day systems, I'm hard-pressed to complain. If you ask, quite simply, which is better, the system proposed above or the contemporary system, one or the other, I have a hard time imagining people defending the contemporary system.

What you have described is (mostly) how Swedish society already works. Even the SAML part — we'll be forced to support eIDAS as of next month!

Everyone resident in Sweden must be registered in the Swedish Population Register, and receives a personal identity number. Due to the Swedish constitution, information held by the government must be publicly available, so people's names, dates of birth, addresses and indeed identity numbers are not secret (though the last of these isn't on Google). This means that in order to prove your identity, people use ID cards and corresponding digital ID issued by the government and banks. Said digital ID is a passcode-protected certificate, either on a phone, a computer, or a physical ID card.

The government doesn't have your DNA here though, although citizens' passports and ID cards contain fingerprint data.

Also, there are cases of people with multiple DNA signatures in one body (chimeras). Really rare, but it goes to show that there will always be a corner case ;)

> how would they keep it secure without resorting to one of the flawed systems I just mentioned?

It's small, hard to exploit flaws vs. large easy to exploit flaws.

> If everyone had a cryptographic private key, they would have to store it somewhere -- how would they keep it secure without resorting to one of the flawed systems I just mentioned?

Physical smartcard/smart SIM/phone. You have to steal something physical + get the PIN. Definitely possible, but really hard and if that gets lost you have to go to the Police, get yourself re-identified and get a new card. Compared what bullshit of an identifier a phone number is Estonian system is miles ahead.

You start by not giving everyone an "ID" but a hardware token with a chip in it. The person who has that chip and the corresponding private.

The only real attack against that is supply-chain attacks, which is why the government buying such tokens should audit the whole supply chain, and they should either pay for a replacement if the tokens are ever compromised or make the manufacturer pay if it's their fault.

I think if you combine the existing formulas and add a few new ones with similar issues it can add up to something.

Personally, while I understand no one can take it seriously, I think our private components would be a better fit than faces. It would make for an interesting future to say the least.

All methods eventually have a flaw. The goal is to reduce the attack surface and increase the complexity of the attack, no to elemininate all vectors.