Hacker News Reader

Comment by teddyh | Hacker News Reader

Better argument against “Real Names”:

https://geekfeminism.wikia.org/wiki/Who_is_harmed_by_a_%22Re...

All the identity politics aside; I find a simpler argument tob be “One can easily triangulate my real life identity, and interact with my corporal body from finding my real name, and I do not wish for that..”

I had a discussion on H.N. a while back where I found that the G.D.P.R., in fact, prohibits the collection of “biometric data” but not real name and address, which I found rather odd to say the least.

If I had to choose between my real name and address, or my retinal or fingerprint patterns ending up on H.N., I would certainly choose the latter, and I think I'm not alone in that. — it is far easier to triangulate someone's corporal body based on the former than the latter.

Odd? Not every business is a social media platform. Businesses shouldn’t keep more data than they need (including/especially biometrics) but there are plenty of legitimate reasons why many businesses will absolutely need your name, address etc.

There are reasons why they need it, because the same politicians that claim to be so concerned about privacy do not create the frameworks to obviate those reasons.

It would be trivial to implement a scheme where I might requæst at the postal service a randomly generated code that maps to my address and name. The postal service is the only one that actually needs my address, and they will ensure that every package onto which that sterile code is printed, will arrive at my doorstep.

Thus, the sender need not know my name and address, and can send me mail regardless but can never find out where I physically live.

If those politicians truly care as much about privacy as they say they do, such a scheme would be implemented decades ago, for it is not expensive nor technologically difficult to do so at all.

That they are not actively searching for mechanisms that allow businesses to function without people having to surrender their location of residence, many of which being rather simple to solve, makes me think they do not care as much as they claim they do. Or rather, as is common, they only care when it concern new and scary technology, but addresses are old, and therefore not scary. When a man utter concern about various dangers, what he is most afraid of, is often simply change.

When ordering online, you don't actually which carrier will be used: all carriers would then need to have access to the database of random codes -> physical addresses... Not much of an improvement, and lots of room for failed deliveries! Better use a PO box, or a parcel drop-off point.

Note that the actual reason businesses legally need a name and address is for invoicing, though.

> When ordering online, you don't actually which carrier will be used: all carriers would then need to have access to the database of random codes -> physical addresses... Not much of an improvement, and lots of room for failed deliveries! Better use a PO box, or a parcel drop-off point.

There is a great deal of improvement if only registered carriers have access opposed to every single party whom one might receive a package from, including simple private citizens.

That I need to tell a man where he might physically locate me, ere he can send me a package, is a problem that need not exist.

> Note that the actual reason businesses legally need a name and address is for invoicing, though.

This too could be solved in many ways.

Governments can easily devise systems where payments can happen without leaking this information, and that the information can only be forced to be surrendered in the case the company has a complaint of non-payment.

I don't think it actually makes that good of an argument against real names. For instance it shares a link to a study that found accounts with feminine names got more malicious messages in IRC rooms [1]. However, the people sending said messages didn't have to use their real name. That doesn't mean a real-names policy would make things worse. It could be that people, when forced to use their real name, are less likely to send harassing messages.

I certainly think there's places for pseudonymous or anonymous discussion. That link talks about how people may face social repercussions for deviant interests: sure I wouldn't expect a real names on e621 and the like. At the same time, real names provide a level of accountability that's beneficial in a lot of contexts.

1. https://phys.org/news/2006-05-female-name-chat-users-malicio...

Contextual accountability is hard.

Real names / pseudonyms tend to be sweeping across a service, particularly large goliaths like Facebook where you could do things like political activism in a group. You either get more exposure than you're comfortable with, or more privacy than other people are comfortable with.

Real name policies also tend to be cultural where usage of real names tends to encourage more usage of real names, even when it might make sense not to use a real name.

Even better, a technical argument: http://habitatchronicles.com/2017/05/what-are-capabilities/

Did you link the wrong essay? That one is about Capabilities and access control, not real name policies.

I think I get it.

The idea is that you assign capabilities based on whatever authentication mechanism. Access to read email sent to this email address, access to withdraw money from this bank account, etc.

The way a lot of people think about this is that a set of permissions is associated with a person with a Real Name and then a person with a Real Name is associated with an account or some other context.

But the middle step is irrelevant from a technical perspective. Your name isn't a secret and can't reasonably be used for any kind of authentication. It's effectively an alphabetic account number.

Using the same Name for all of your accounts is only useful if you want to give companies the ability to correlate them all, which is often the opposite of what you want.

If you take it out you're left with a set of capabilities associated with an authentication context, which works just as well from a technical perspective and doesn't have that problem.

Yup. Or, worded differently: you do not need authentication to achieve authorization. So many people conflate the two.

As sibling says, they are deeply linked.

"The capability paradigm is about access control. When a system, such as an OS or a website, is presented with a request for a service it provides, it needs to decide if it should actually do what the requestor is asking for. The way it decides is what we’re talking about when we talk about access control. If you’re like most people, the first thing you’re likely to think of is to ask the requestor “who are you?” The fundamental insight of the capabilities paradigm is to recognize that this question is the first step on the road to perdition."

"That’s highly counterintuitive to most people, hence the related controversy."

Reply on news.ycombinator.com