Internet Identity System Said Readied by Obama Administration | Hacker News Reader

Internet Identity System Said Readied by Obama Administration

businessweek.com

78 pointsatularora71 comments

Wait... this doesn't add up for me:

"[This will] limit fraud and streamline online transactions, leading to a surge in Web commerce" - Is this really that big of a factor in constraining online retail, or is there a greater chance of it imposing stupid rules. Who's behind this?

"Verizon Communications Inc., Google Inc., PayPal Inc., Symantec Corp. and AT&T" - Oh yea, this sounds perfectly benevolent... But who's overseeing this?

"[McConnell,] a senior counselor..." "Dept. Homeland Security..." "big reduction in the size of Internet help desks" - Since when is it the DHS's job to worry about internet help desks? Who else wants this?

"Clippinger..." "Board member... "advises...Equifax...PWC..." Nothing to see here...

I may be tin-foil hat about this, but it seems like where the companies (incl. GOOG) are trying to take net neutrality - into a controllable space with gov't teeth...

http://cyber.law.harvard.edu/people/jclippinger

but it seems like where the companies (incl. GOOG) are trying to take net neutrality - into a controllable space with gov't teeth...

This is why I'm opposed to net neutrality.

Net neutrality has always been about "a controllable space with gov't teeth." Net "neutrality" is a contradiction in terms because it requires the government and corporate cronies to make it work, and the government and corporate cronies are not neutral.

It's unbelievable how the liberal crowd buys it, hook, line, and sinker. I hate to use a corny Star Wars quote but it's appropriate, something like this: "Liberty always dies to the sound of applause."

> Net neutrality has always been about "a controllable space with gov't teeth."

Eh? No. It was formed as a reaction to plans announced by the big telcos to monetize traffic flowing through their networks. Specifically, they were going to hobble the connection speeds of any popular website like YouTube unless they were paid money. So people who weren't even their customers could have their traffic throttled merely because it happened to cross their network.

At the time, everyone from the ACLU to the Christian Coalition was outraged by this naked money grab. Basically, almost everyone hated the idea.

Then a bunch of lobbyists came into play and split us up about what we should do in response. So you have the current false choice of "let the government regulate the internet" and "let free enterprise screw everyone over."

What everyone wants is an internet where a suddenly popular site only has to pay its own ISP for bandwidth, not one where every single network operator comes to them for a handout saying, "That's a nice website you got there. Would be a shame if anything happened to it."

Getting there is the hard part.

everyone from the ACLU to the Christian Coalition was outraged by this naked money grab. Basically, almost everyone hated the idea.

If this isn't an example of selecion bias, I don't know what is. These are two groups everyone loves to hate, some of it justified because one promotes their Jesus-loving to the point where it doesn't make any sense and the other sometimes forgets to emphasize the A and C in their acronym as much as the L.

And when were the "big telco" plans announced? Did I miss that? Doesn't seem very competetive at a time when they were adding bandwidth and not raising rates.

> And when were the "big telco" plans announced? Did I miss that?

That was what? A few years ago? It was before the term "Net Neutrality" even existed (which is what makes it such a pain--I can't for the life of me find the original article).

I think I originally saw the plan on Slashdot, after which there was a letter signed by a ton of interest groups (more than just the CC & ACLU, way more) opposing the plan. That unity didn't last long--they were afraid and ran straight to the lobbyists.

People saw good reason to worry that they wouldn't just give up and came up with the name "Net Neutrality" for the cause, but... then we started getting split up. At first, they were questioning, "Is this really needed" and "What the heck does 'Net Neutrality' mean?" (still are, actually).

Now they've framed it in terms of whether we want to be screwed by politicians or teleco monopolies, hitting a deep political rift and preventing us from effectively working together to oppose them collecting rent from internet users they don't even provide access for.

Yea, it's hard to say. Idealistically, I'm against NN on those grounds, but pragmatically, I tend to think some type of net neutrality may be able to prevent the internet from going the way of cable TV.

To put it in utilitarian terms, I'd say the net benefit of NN > than the losses of possible stifled tech innovation and new law for corporatism - the latter already bought by them anyway.

In the end - I'd love to have something like mandatory bulk-rate sales of the infrastructure rights, with a co-op managing a large % of capacity, for any company with X% of end-user customers (or similar measure).

  > prevent the internet from going the way of cable TV

Not sure what you mean by this? Preventing government-granted local/regional monopolies? That seems to argue against government intervention.

When you phrase it that vaguely, you can make anything sound like anything else. Oh, you're into carbon-based lifeforms? I know an amoeba you'll get along with well.

You'll just be able to use your government issued id to make your book purchases on Amazon. Sounds good!

You'll be able to use your government issued id and your credit card to buy stuff on Amazon that now you have to buy with ... your credit card.

Once this exists, it will just be a matter of time until it becomes mandatory. This is a guaranteed fact.

I want the text of that guarantee. What do I get if it doesn't become mandatory? And by when will it become mandatory?

Like the history of seat belt laws in the US.

Based on what? Saying there is zero chance of it being optional (once it exists) seems pretty extreme.

Zero chance. It will be optional in the way that TSA searches are optional at airports.

Public Safety, of course. Terrorists, child molesters, hate speech.

We'll have to be protected.

Really, this script writes itself.

Relax. Breathe. Take a walk through a park and smell the roses.

Don't let the fear and negative thoughts cloud your head constantly and ask yourself how you can be positive and productive, without polluting the conversation with baseless doom and gloom statements.

The US Postal Service has existed for over 200 years, and at no point has it become mandatory.

We could easily provide half a dozen other major government initiatives which intersect with commercial activity and do not seem remotely on track to mandatory usage.

What makes this particular initiative different? If the postal service were created today, would you also suspect that it would become mandatory in a matter of time?

Yes, but there also used to be competing post offices that were so profitable and efficient that they were able to offer three-cent stamps.

Read about it here: http://www.lysanderspooner.org/STAMP3.htm

Spooner's post office was so good that no one was really using the USPS any more. He was literally running them out of business.

That is, until Congress came in and said that what he was doing was illegal. Since then, there have been no alternative post offices.

Businesses like UPS and FedEx survive because of a loophole in the law that basically allows for parcel, but not post, shipping: http://mises.org/daily/3646

That said, they recently had a big regulatory battle between UPS and FedEx. I forget the specifics, but one business was being classified differently, and thus incurring higher operating costs than the other, simply because it was classified differently... In other words - punitive tax legislation. I forget exactly what happened there, and can't find a link at the moment buuuut:

The point is this: Your example of the post office is fundamentally flawed because it doesn't take into account that the post office is protected from market forces by legislation and thus, force.

The classification difference means That UPS is union and FedEx is not. UPS is not as profitable and is lobbying to get FedEx reclassified.

UPS turned a profit of $3.126 billion last year. FedEx made $1.321 billion. UPS has higher profit margins than FedEx as well.

Well, on the one hand, a legally-protected monopoly is not the same thing as mandatory. Anyway, UPS/Fedex/DHL may be operating under a loophole, but the loophole exists: it's easy to send a sheet of paper through services like those.

The kind of regulatory problems ("classified differently") you describe are unfortunate, but those affect all major industries and are not specifically relevant to whether using the postal service is being protected. In other words, either UPS or FedEx having regulatory advantages doesn't mean that the overall tax/regulation regime is constructed so as to give the Postal Service a market advantage.

edit: see protomyth's comment; the Postal Service is unionized, so if anything FedEx seems to have the market advantage here.

so, why hasn't email been made illegal? It's essentially free post, and the post office could argue that it's killing their revenues.

The postal service isn't as powerful a tool/threat to the political order as the internet.

Edit - And furthermore, it's a govt issued id to track all your online transactions. This is tax revenue waiting to happen.

I wish I could give you more Karma for that.

As soon as "approved id" exist, the liability for allowing comments "without approved id" will skyrocket.

It's comments like this that make me miss downvoting here.

This has been out there for a while. Here is a draft of the plans from June 2010:

http://www.dhs.gov/xlibrary/assets/ns_tic.pdf

Basically an ecosystem of privately run PKI systems, with an independent governance board and standards body.

From the first sentence in the Executive Summary:

Cyberspace – the interdependent network of information technology components that underpins many of our communications – is a crucial component of the Nation’s critical infrastructure. We use cyberspace to exchange information, buy and sell products and services, and enable many online transactions across a wide range of sectors, both nationally and internationally. As a result, a secure cyberspace is critical to the health of our economy and to the security of our Nation.

As I posted on twitter after seeing that: The use of the word "Cyberspace" to refer to the Internet helps us identify the idiots, old white guys and just generally clueless people.

The very disturbing thing is that "cyberspace" by term literally means the space between yours and my connection to the internet, be it phone line, cable, whatever.

Such broad usage of terminology and the idea of regulating it is wholly disturbing to me. This literally means everything from the last-mile connection from my ISP to my website is potentially up for interference from the government.

Why do I have the feeling that this will somehow be related to a massive crackdown on piracy?

Why is the federal government's involvement necessary? We have a (mostly) workable PKI system for SSL certificates. Why does a consumer-focused PKI require government coordination?

I think the lack of a widely deployed PKI for authenticating consumer's identities is an indicator that a novel approach is required, but what can the federal government do that an independent (perhaps multi-national) organization could not?

You've gotten to the real issues here. If the problem is lack of industry consensus (i.e. N standards instead of one), maybe the government can bully the industry into picking one.

I'm really not sure we are at the point where we should be picking. We are still very early and e-commerce seems to be doing fine without it.

We are "very early" in the sense that we're in the same place as 1996: usernames, passwords, credit card numbers, and SSL. (Or maybe we're worse off, since we didn't have much phishing in 1996.) What is it going to take to get some progress here?

It's not the government's job to pick winners and losers. Think about the words you selected: bully and progress. Together those don't sound very democratic to me. It's ends justifying the means thinking that gets well-intentioned people into trouble. Progress is people wising up about security, not forcing them to use certain technologies.

Bruce Schneier wrote an excellent article on PKI risks (http://www.schneier.com/paper-pki-ft.txt). Should be interesting to see how many of those are addressed as this scheme comes to fruition. It has the potential to become a highly useful backdoor intelligence gathering mechanism. This is a honeypot that the three letter agencies won't be able to resist.

Exactly. It will also make Id theft more easy because there will be a single point of failure. This is like one password for the web. I don't like this at google. It is easier but much less safe.

Whether or not this is a good idea is dependent on public knowledge of the algorithms and the availability of an open-source reference implementation. Simplifying and standardizing login/identification is obviously a worthwhile goal, and has been pursued by several projects already. I would much rather have an open, transparent standard than see something like facebook login become a de-facto standard.

It would be terrible (in addition to potential privacy/big-brother issues), however, if the system ended up favoring large providers like Google and Amazon and Apple over potential competitors, because of barriers to entry into the system or onerous implementation costs. We will need a lot more information to make a judgment about the benefits and risks.

Atwood and others have been praising the idea of a centralized identification system for a while, and tying it to a government identification system makes sense, but tying this to the Obama administration could be a marketing disaster. I can already hear Glenn Beck associating it with Nazi Germany and advocating against its use. Similarly, its association with Verizon, AT&T, Paypal, Symantec, and Google is likely to bring its own breed of distrust. This strikes me as a project that doesn't deserve the politicization it's going to get.

This is why we can't have nice things.

I don't think this is just for the Tin-Foil Hat crowd. Beck is on the extreme "gov't isn't natural, do away with it all!", but the other end of the spectrum is just as nutty in thinking that we can really control the US's corporatist system via the same gov't our big business use to gain their own influence. Am I crazy for not trusting the US to keep Corps. out of our internet?

It's not crazy at all, but it seems we've reached a point in the conversation where we can't produce anything meaningful without it getting drowned out by screams of "Fascism" and "Plutocracy".

I think that both Government and Business stand to benefit from it enough that it's possible that there weren't underhanded motivations involved, or at least that they won't come to fruition.

Underhanded? I agree, most likely not. Created by busybodies though? Highly likely.

EDIT: And I say this because I was reading something about this (can't find the link now) where it said something like the rate of on-line retail is growing and is now a 30 billion dollar business (I might be misremembering the numbers). And we must do something about this to protect it, protect it from fraud and a bunch of other "problems" that were presented like . If things like fraud were real threats to the rate of growth and our dependence on on-line transactions, would we be seeing the rates of growth we're seeing? Wouldn't vendors be scaling back their sales (being more picky about who they sell to, or going out of business due to fraud) and consumers not choosing to buy online because things like identity theft were more prevalent.

From the OP:

Under the new program, consumers would sign in just once and be able to move among other websites, eliminating the inconvenience that causes consumers to drop many transactions.

Are the number of transactions being dropped really a threat, especially considering the growth?

I'm all for making things actually more secure, but doing so under the guise that the current status-quo, which is on a growth curve, is under attack is disingenuous.

These are contrived reasons. Contrived by someone who wants to push this because they perceive a problem (legitimately or just because they like their solution) that is actually smaller than they make it out to be. Busybodies.

Fraud is usually a lagging indicator of high growth. First you get the growth, then you get the fraud, then the fraud causes the growth to reverse.

It's quite possible that people are seeing a rise in fraud and pre-emptively trying to address the problem rather than wait until things become completely unusable.

I have to say I agree with you, there. I think there are benefits to be had, but saying "This is going to cause a huge shift in consumer use of the Internet" can only be described as overblown.

... you think the reaction would be substantially different if the Bush administration seriously proposed this? Same script, different actors. The best measure of how much of our political arena our politicians aren't actually serious about is which opinions flip 180 when control passes from the demopublicans to the republicrats. "Hey, remember how we were against the idea of the Internet being controlled by the government? Now it's peachy keen!" "Remember how all that spending was like, terrible last year? Now it's our turn and we have a moral imperative to spend! Wheee!"

(And just to be clear, no, neither of those are targeted at one party in particular.)

It's interesting, in just about every successful organization I've been a part of, the defining factor has been trust. Communities that trust their members tend to thrive; those who assume their members are out to screw them tend to get screwed.

And as a society, we don't trust anyone.

I wonder what that says about America.

The reason why we can't have nice things is because some people are so willing to give up on certain ideas solely out of fear that people like Glenn Beck will criticize them.

You seem to think that this will be a disaster and fail because of some crackpot lunatic association Glenn Beck will make, not because of the actual merits or dis-merits of the actual system. Do we give up on ideas that easily now? If so, then that is the reason we can't have nice things.

Perhaps the fact that I dropped his name is overshadowing my point.

I think the politics surrounding it are likely to create a large amount of distrust from both ends of the political spectrum regardless of its technical merits, and that will put it at a severe disadvantage. This is assuming that its success is measured by its adoption rate, and that its adoption rate is dependent upon the level of trust in the system.

Yeah, right. Let me know how that works out for ya. Like anybody is going to trust something like this, when the US Federal Government has it's fingers in the pie. This thing is dead in the water from day 0.

This idea is about as dead as the Norwegian Blue. http://www.youtube.com/watch?v=npjOSLCR2hE

Americans just don't trust the government; that's why so few people have driver's licenses. Oh wait.

I have a government drivers license so I can drive on government roads.

I don't need a government license to get online and check my email, thank you.

If you live in the USA you drivers license is issued by the state you live in. There is no USA national drivers license.

Don't confuse state's rights with Federal Government rights.

American federalism is under siege. There is, in fact, a plan for a national driver's license called REAL ID, and the states are resisting it.

If you live in the USA the states have governments too.

Not yet you don't!

Drivers licenses are mandatory, and you get heavily fined if caught driving without it. This on the other hand is supposed to be voluntary. I certainly won't be volunteering any time soon.

You make no sense. Driver's licenses are required, if you want to drive any car.

False. Drivers licenses are only required if you want to drive on public roads. If you have a lot of property with private roads (farms, quarries, etc), you're free to drive unlicensed. Hell, you don't even have to get a license plate for your car if you never put it on a public road (although you'll probably have to register it with the state for property tax reasons).

In other words, it will be possible to avoid this ID, but so ridiculously impractical for most people that almost everyone will be expected to have and use one.

Yeah, that sounds about right to me.

Oh yes, a very common case, people driving on their private roads.

1. Sarcasm.

2. Do you think the Federal Internet ID won't be required somewhere?

arpanet

DARPA contracted with universities to create it. Just because the military's interests were once aligned with advancing communication technology between academics doesn't mean we should accept that all or even some of the current government's "involvement" is simply for the betterment of mankind. These people ultimately rely on the threat and use of force to do their "job" no matter how remotely connected its authority is to the U.S. Constitution.

Doesn't seem so farfetched to me. If there is gonna be de facto centralized identity providers (Google, Facebook, Twitter, etc) the govt may as well get in on the game.

Only makes it more important that we get decentralized identity mechanisms (key based id) up and running sooner rather than later.

and this is part of why every email I send is PGP-signed. <3 this decentralized way of identifying me. All you gotta do is trust a guy who trusts me, or semi-trust several guys who (semi-)trust me.

It's nitpicky, but you're using the word trust wrong here. I don't have to completely trust the people who signed your key, and I don't have to trust you at all. I have to trust the people that signed your key to have done the proper background checking. That's all. I could think your a vile, lying, cheater, but still know that when you send me that lying email, it is indeed you sending it.

In the aggregate, you don't even need that much trust in any individual, just a spam filter on the trust endorsements.

Yes, you're correct, thanks for enlightening me.

Only makes it more important that we get decentralized identity mechanisms (key based id) up and running sooner rather than later.

Yeah, no doubt. :-)

“There’s going to be a huge bump and a huge increase in the amount and kind of data retailers are going to have.”

And government control too? Count me out.

There are already plenty of people buying things on the web - I don't see a real problem here that the govt needs to fix.

Since the web is a global community I'm not convinced that a US public / private partnership can be that effective. For better or worse (probably the latter), I think FB with it's substantial global presence is the horse to beat on this one... and if FB gets invited to the US gov's little slumber party, I'm pretty sure competing identity systems - potentially led by other governments - will spring up faster than you can order a Chinese takeout...

Why would we trust the government to secure our identities online? Does the government have any kind of interest to manipulate this system from the inside to respond to its needs? The federal intelligence community for one would be very interested by creating fake identities for its operatives thus creating a potential security hole for others to exploit. On the US money is written, 'In God we trust' but NOT 'In the Government we trust'.

“What is holding back the growth of e-commerce is not technology, it’s policy. This gives us the rules, the policies that we need to really move forward.”

Epic Lol!

Reply on news.ycombinator.com