Hacker News Reader

Comment by sonnyblarney | Hacker News Reader

Identity, Single Sign On, and 'information gleaned for marketing' etc. are all different overlapping issues.

Truly there are almost zero situations in which an entity needs to know your real identity. You bank, surely, but you go into the bank to do that.

Single Sign on via Google and FB is now normative because they're ubiquitous and convenient, and of course, FB id's come with a greater possibility of legitimacy, and nice FB pixel marketing data.

I suggest that thre is something that could work, it just needs to be put forward by a credibly entity that for whatever reason feels it's in their interest, whereupon those interests are not entirely conflicted with the individuals right to privacy.

View on HN

>Truly there are almost zero situations in which an entity needs to know your real identity.

1000 percent this!

What entities really need to know to do their function is shockingly small compared to what they ask for. Here are some examples:

- Bank: proof you are authorized to make decisions for a given bank account. (Possibly jurisdiction info if the government forces banks to screen on citizenship.)

- Voting: proof that you didn't vote twice. (Possibly jurisdiction info if you are only allowed to vote in a specific area.)

- Job: a nickname, contact info, where to send compensation, a way to grant (and revoke when terminated) your access to non-public information. (Possibly jurisdiction info if the government forces companies to screen on citizenship or calculate taxes in a specific way.)

- Social media network: way for others to connect with you (eg email).

- Bars: (possibly proof of age, if the government forces establishments to limit sales on that basis.)

- Online or in-person payments: proof that the funds transferred to the business's account.

Any online government/medical/banking/leasing/crediting service needs my real identity. In real world there are even more services.

99% of online services doesn't need my real identity but the ones that need it definitely aren't almost zero.

They ask for it. They may currently require it. They don't necessarily need it.

E.g. Some medical services may need to know your medical history. Others need just some token that lets the bureaucracy figure out who to ultimately bill for it. Leasing/crediting services - well, they'd love to know everything about you, but that doesn't mean they should get it.

No, all these services need my identity in order to offer me services that i want/need (my blood analysis results, bank account including cards/loans/leases, IRS, DMV, etc. Basically everything that is tied to my real identity and should be seen/accessed only by myself). I am not from US so just using IRS/DMV as comparable examples. Third party ID providers or Government ID provider returns only my name and personal UID to all these services.

Most of the examples you listed require only an email address, PO Box, or a telephone number.

Maybe in the USA but i am not from there. All these services require to log in with your real identity at least once and depending on the service you can use it with your set up email address in read only mode, for example the DMV equivalent service allows you to see your vehicles, tickets (and pay them) and other info but in order to change vehicle owner you will have to log in with real identity provider.

I think we're still talking past each other.

My point is: these services may require identity, but they don't truly need it, could work without it, and it's only a bad design that they do ask for it.

I do agree that i could use anything (email, phone etc.) to login in those services but this "something" would be still mapped/tied to my real identity (in a previously validated way). So if it is the first time i am using DMV online service, i can login using my real identity because that is much easier than going to real world location and getting my account credentials.

> >Truly there are almost zero situations in which an entity needs to know your real identity.

> 1000 percent this!

> What entities really need to know to do their function is shockingly small compared to what they ask for. Here are some examples:

> - Bank: proof you are authorized to make decisions for a given bank account. (Possibly jurisdiction info if the government forces banks to screen on citizenship.)

> - Voting: proof that you didn't vote twice. (Possibly jurisdiction info if you are only allowed to vote in a specific area.)

> - Job: a nickname, contact info, where to send compensation, a way to grant (and revoke when terminated) your access to non-public information. (Possibly jurisdiction info if the government forces companies to screen on citizenship or calculate taxes in a specific way.)

> - Social media network: way for others to connect with you (eg email).

> - Bars: (possibly proof of age, if the government forces establishments to limit sales on that basis.)

> - Online or in-person payments: proof that the funds transferred to the business's account.

But for all of these use cases, who would be the provider of these attributes to the third parties? Haven't we already seen issues with centralization of identifying information? (Like the case with the OPM breach?)

>1000 percent this!

What if you apply for a state benefits (e.g. benefits for your children, or student state grants)? These kind of services being accessible online are common in the Nordics and when authenticating the service provider would need to know a lot of personal information such as name, age, adress or email, previous given benefits records from other service providers, current loan debt status, university registration status, bank account nr, family members etc...

Zero knowledge proof in identity is a thing, but then the assurance of identity falls on a third party that has to verify your identity. There is also Self-Sovereign Identity and user-centric identity management which many consider the future of identity. But even in that case, most often a third party needs to at least maintain the infrastructure of where your identity is stored.

> What if you apply for a state benefits (e.g. benefits for your children, or student state grants)?

The best solution in this case is to stop means testing them, and also convert every plausible benefit from stuff to cash-to-buy-stuff-with (i.e. UBI). Because at that point it's the same as voting, all you have to prove is citizenship and that you haven't already received the benefit, there is no separate eligibility information required.

People have the intuition that not means testing things would be expensive, but when the benefit is in cash that comes out in the wash. If you receive $5000 more in cash than the value of the benefits you were previously eligible for, but then have to pay $5000 more in tax, it just cancels out and you're back to the original situation. Only now nobody has to prove eligibility status outside of basic citizenship, which also greatly reduces administrative costs and fraud.

Perhaps you are right, but we have to create systems for the needs of today's society as well, and in today's society you need to be eligible for a certain benefit in order to get it. Therefore, we need a person's identity (with all the personal information that are required for such eligibility to be checked) when that person is authenticating online and applying for that benefit.

> The best solution in this case is to stop means testing them, and also convert every plausible benefit from stuff to cash-to-buy-stuff-with (i.e. UBI). Because at that point it's the same as voting, all you have to prove is citizenship and that you haven't already received the benefit, there is no separate eligibility information required.

How do you prove you did not receive something?

How do you prove that you did not already receive a government ID, and go back and get five more with different names and numbers on them? Same question, same answer.

This is good stuff but in one case at least - jobs - add to your list the need to perform background checks during the application process, which does require an actual identity verification.

Background checks? Maybe if you're joining the secret service. In most cases the employer just needs to check that the qualifications you claim to have are genuine.

Probably you should be allowed to keep quiet about qualifications that you don't want to claim. I read about a case in which a factory worker was sacked with the justification that they had failed to declare their university degrees when applying for the job. They had a degree in politics and the employer believed (probably correctly) that they had got the job specifically in order to be a trade union activist. However, whether that ought to be a valid reason for dismissing an employee is another question.

Amusing story! But in some countries (not sure about the US) it is common to perform a criminal record check, credit check etc. on new employees. In high compliance environments (e.g banks) the checks may span any countries you have resided/worked in for the previous few years.

> jurisdiction info

How would someone do that? How do I prove that I am right now here, to someone else that's not physically present?

On a related note, how do I, right now, while doing this activity, prove that I belong to this jurisdiction, and not others.

Important when buying weed online, for example.

Given the verifier has physical control over the location in which the verifiee must verify themself, it's trivial to ask for info only accessible from that location at that time.

As for determining your jurisdiction, that usually means residency, which off the top of my head could be minimally verified by govt proof via (redacted) taxes filed in that state.

Your delivery address proves your jurisdiction in case of weed.

> Your delivery address proves your jurisdiction in case of weed.

What if that address is a mail forwarder? How do you prove that I reside at the delivery address?

I am just speculating but if they don't provide door to door delivery then you probably have to upload whatever documents they need defined by law. This clears them and it doesn't matter that they are sending stuff to a mail forwarder as now you are committing a crime.

That would work but would suck when you wanted to know who did what. Makes me think about: if all in a team has responsibility then no one has.

> Jobs

And when it turns out that you've employed a convict for 2 years? Who also happens to pass your "jurisdiction info" check.

Convicts being able to be employed is likely a net good for society at large. There are also countries where asking whether someone was ever convicted of a crime is not the default and they are fine.

All of those (except bars and social networks) also need a postal address where legal and court documents can be served.

Or invert the push requirement to a pull one: instead of citizens being required to give a valid method of immediate contact, require that they check for new messages at regular intervals. Failure to do so would be the same as ignoring push notifications.

Identity is a somewhat philosophical and thus nebulous concept.

What is my 'real identity', honestly? How does a bank prevent me from opening an account in the name of my hypothetical identical twin if I borrow the appropriate documents? How would a government agency?

The reality is that identity winds up being evaluated as a relationship. My bank identity is as a particular customer, and me attempting to opening an account in someone else's name doesn't change that - rather, it is a sign I as a customer am planning to commit fraud. In some fashion, a process attempting to tie an interaction to an identity is actually attempting to tie behavior to consequences.

This made the article a bit difficult to understand - was the point that the sharing of identity, and thus trying to die back to one 'true/real identity', is flawed?

Or perhaps that this concept of local identity isn't always needed to perform a transaction - I don't care who a customer is as long as I know the information that I'm acting on is true?

Single Sign-on itself is an often abused topic - it generally means that authentication (providing proof that you correspond to a particular identity I hold) is reused.

However, Federation is the process of sharing that information across domains, and is usually done via protocols like OpenID Connect or SAML.

Google Sign-In, Facebook Connect, and other IDPs usually combine both - and the value comes not from signing in with google credentials, but that you often already are signed in with google/etc credentials.

The value you get back contains a subject attribute, which is a unique (possibly globally, or perhaps only within your service) identifier for the user account upstream. This value is what turns these social logins to an authentication for your own site or app.

At the minimal level, the information leakage is mostly to the IDP - they see where and when you are authenticating. However, the IDP is free to offer whatever additional attributes and authorizations they decide to - verified email addresses, API access to user data, and so on.

Possibly, the IDP even shares some piece of information your service might rely upon because you consider it the user's 'real' identity.

I'd argue that in pretty much every transaction where trust is involved (all e-commerce, and not only that) I'd want to know the other party to be not anonymous so that it's possible to combat breach of trust:

1) to make it easy to verify if they're trustworthy based on past experience;

2) to make it easy to identify and prosecute them if trust is breached;

3) make it difficult for them to 'start from scratch' if they deservedly gain a bad reputation;

Currently the vast majority of e-commerce happens through credit card networks on principles that essentially can work only because it's very hard for CC merchants to be anonymous.

Also, if I'm entrusting my data to some service, I do want the operators of that service to be not anonymous - if it is easy for them to escape liability for misusing that data, then that significantly raises the risk that they might actually misuse that data.

A lot of useful things in our society require or assume trust. Anonymity weakens trust; accountability through clear, unescapable identity strengthens trust.

I think there's a lot of room for a faceted identity model in which the user is in control of what attributes get shared.

Think about shopping at Amazon where they get a payment authorization from your bank and a shipment authorization from your shipper and never know your name, your bank account number or even your home address. It's technically very doable...the problem is that there isn't much incentive for Amazon to let go of all of that metadata.

> the problem is that there isn't much incentive for Amazon to let go of all of that metadata

I think there's some ideas going around that might work here.

Make companies responsible for securing that data, and make it _expensive_ if/when they get breached. Make storage of personal data "toxic", so companies will _only_ keep it for the minimum amount of time required for whatever use it was gathered (where only companies like FB & Google, and to a lesser extent Amazon would admit to themselves that it was collected for the express purpose of creating a historical record of individually identified PII).

Here (in .au) we have "mandatory breach disclosure laws", which while having fewer teeth that I'd personally prefer, and a reasonably useful "first start", they're quite useful in the context of discussions around "So why are we asking for cusomer's date of birth? Is that something you'd want to explain in a mandatory breach report if our database gets hacked?" and "So what's our retention policy on this data we're collecting? Forever? Really? What's our plan around reporting data breaches, and do you want to ever have to explain why we've got 5 years worth of records breached when we only needed to store that data for 90 days after which most of the details were never needed again?"

I'm _hoping_ sometime soon the GDPR is going to quite publicly go through it's due process, giving some company every chance to become compliant, be continually ignored, and then eventually hit them with an eye-wateringly big existentially threatening fine that the offending company has absolutely no grounds to claim it didn't know about, didn't have several appropriately escalated warnings, and were just blatantly abusing their users personal data without any regard for personal privacy or European Law - and have zero public support for their complaints about the fine.

(Personally and perhaps somewhat pettily, I hope this happens to Uber or Facebook, but pragmatically I'd settle for anything matching that description, to "pour encourager les autres" and for use in meetings and documents when clients or cow orkers suggest doing shady things with other people's personal data...)

> Make companies responsible for securing that data, and make it _expensive_ if/when they get breached. Make storage of personal data "toxic", so companies will _only_ keep it for the minimum amount of time required for whatever use it was gathered (where only companies like FB & Google, and to a lesser extent Amazon would admit to themselves that it was collected for the express purpose of creating a historical record of individually identified PII).

You're assuming they won't just mitigate the risk by spending more on securing the data and then still keep it all and hope their security is enough to avoid getting pwned.

Moreover, many smaller entities won't even bother with trying to secure it and then just hope it doesn't happen to them and declare bankruptcy if it does. Some of which will just have had no idea the liability even existed to begin with because they don't read HN and didn't have the money for lawyers.

The solution to this is better when it comes from the demand side. People should refuse to give this information to these companies; then they won't have it and can't use it for anything nefarious. So the question then is how to convince people of that.

Certainly a good first step would be to eliminate any existing rules that require companies to collect this type of information on people.

> Certainly a good first step would be to eliminate any existing rules that require companies to collect this type of information on people.

Yeah. That's one place we here in .au are fucking ourselves over. As well our mandatory breach reporting laws, we _also_ have mandatory meta-data retention laws. It you're an ISP (which thankfully I'm not), you are _required_ to retail all you user's metadata...

Thoughts on Apple SSO?

It's too early to tell, but because they have such a wide reach and own 1/2 of mobile, if they push it hard and it's a clean enough solution it may just work as a relatively 'privacy first' orientation.

But then websites don't get their FB pixel data, can't retarget and build ad audiences. FB also does some heavy lifting in terms of managing forum comments, which can be useful in some specific situations.

As long as people are willing to click in the FB/G sign in buttons, I think they'll be there to use.

I suggest the biggest opportunity for change may come in the form of regulation and legislation.

> and own 1/2 of mobile

That's in the US only. The Rest of the World value is much lower.

Well none of these social media SSO supports a high Level of Assurance anyway.

Zero knowledge proof

Reply on news.ycombinator.com