Hacker News Reader

Comment by xtracto | Hacker News Reader

This.

I don't trust in the government, but I think digital "personal data" should be only available for "confirmation" to companies that need it. Say, a government entity could have an API that allow you to send hashed personal data that they can verify is right. This way companies will ask the user for their data and hash it client-side. Then they can send the hashes (hashed with a custom provided salt to the entity (government, maybe private) who will basically reply with a True or False on the verification of the different data.

It may even be an interesting use case for a public blockcahin, where your personal data is stored in a Merkle Tree type of data structure, so that one can verify that certain pesonal data of a person is true, without disclosing the data.

View on HN

It's probably not implemented as closely as what you described but check out Europe, this small continent across the pond and the tech scene in the smaller countries.

For example Estonia has had famously and online identity stuff linked via a federal ID (in europe there are more republics then federations so it's easier to manage country-wise) [0] [1]

Or more familiar to me with a bigger sample is a movement in Poland which is gaining popularity - mojeID (myID) which is a Single Sign On system with major banks as providers (they really regligiously check the identities when you open a bank account) or the statebacked login.gov. The mojeID system allows other entities to use your actual identity as an authentication factor without having to keep that much data and pose risks - for example an online alcohol shop can verify the age. [2] [3]

[0]: https://en.wikipedia.org/wiki/Estonian_identity_card

[1]: https://e-estonia.com/solutions/e-identity/id-card/

[2]: https://www.kir.pl/en/administration/mojeid/

[3]: https://www.mojeid.pl/#zastosowanie

Italy use a similar system, it's called SPID (Italian acronym for Public System for Digital Identity)

https://www.spid.gov.it

For many reasons, good or bad, the idea of mandated federal ID or national ID isn't quite accepted in the US.

Wouldn't this fall down as soon as someone enters your details with the wrong casing or uses a +country code rather than a localised phone number and so on?

Humans will error and enter data incorrectly so the hash would be different every time potentially despite being "correct" to a human at a glance?

You could standardise everything (lowercase etc) but I imagine there are country and regional edge cases such as capitalisation having meaning in a given language (I can imagine it being a thing but I don't know it for sure)

There could be instructions in place to specify only all lowercase or just use .toLowercase() when sending. Also there could be a specified format for phone numbers or a function that turns all input into the desired format by stripping all special characters. Possibly only hashing the last 9 digits of the phone number for non mission critical applications instead of the full 10 digits.

This sounds like a good use case for short brief documentation.

Reply on news.ycombinator.com