Comment by d110af5ccf | Hacker News Reader

Comment by d110af5ccf | Hacker News Reader

Parent Full thread

This is not great. It's using the current issues to push for an ID system that could be leveraged by private parties and is thus likely to significantly reduce online (pseudo)anonymity. It also explicitly calls for the involvement of the private sector in delivering any solution.

I want state governments to have a reliable online identity option. I want it to be optional by law - I should be able to make an in person visit instead. I do not want private parties to have any access to the service whatsoever. I want private sector outsourcing of such services to be completely outlawed. No private third party has any business knowing about my interactions with any government provided service.

I should never have to share my data with private third parties in order to receive government services. Such usage data is very sensitive and thus a huge privacy concern.

Consider: If you ever had to go on food stamps, would you want retailers, potential employers, etc to be able to purchase that data? What about the risk of a data breach?

You should not expect anonymity when obtaining government services, full stop. That is the entire point of identity proofing and, at a higher level, identity and access management. I agree a private entity should not be required in the verification chain for interacting with government and obtaining government services.

My last link points to a blog recommending the USPS provide in person proofing, which I believe meets your in person proofing requirement. Login.gov is a service operated by the US government's GSA agency. It is not a private entity providing this service. It was developed as part of 18F and the US Digital Service.

I don't expect anonymity from the government (I suspect that would be a fairly absurd goal given current technology). Rather, I expect that absolutely no one other than the government should ever have access to such data.

My apologies for the misunderstanding. That's a high hill to climb, and I recommend engaging with policymakers to see that sort of legislation crafted and sponsored.

Why is that a high hill to climb? It's more like a slippery slope. Until recently it was definitely the expectation that your government information would stay only IN the government.

It seems wasteful to spend this thread rehasing the utter disregard the legislative branch has for enacting strong data and privacy legislation (California's CCPA aside), Equifax's willful ignorance towards data security with no consequences for them and no recourse for citizens who had their data leaked, etc. It's not easy, it hasn't been done yet, and it's a high hill to climb. Have to get in front of the folks who write the law, who currently aren't making it a priority.

Fair enough, the situation on the ground is at significant variance with people's expectations.

> My apologies for the misunderstanding. That's a high hill to climb, and I recommend engaging with policymakers to see that sort of legislation crafted and sponsored.

It might be a high hill, though softening to allow contractors involved in providing the service to know but requiring them to observe privacy rules similar to what would apply in the healthcare space under HIPAA, would make it much lower.

At the state level, for either version, I would recommend, if possible in your state, you to work with advocacy organizations who are willing to sponsor a public ballot initiative rather than focussing on policymakers alone; while industry insiders can and will buy ads against ballot measures, they can't cut them off by compromising strategically targeted legislators the way they often can bills in the legislature.

Anonymity and privacy are not the same thing

National, standardized, digital ID is inevitable.

Very difficult in the US because the Federal government has no authority to require one, and the Supreme Court has consistently ruled that any regulatory or back door methods to effectively achieve a similar result is not legal.

It is one of the reasons ID resolution in the US is largely outsourced to private entities, which have no such restrictions.

> Very difficult in the US because the Federal government has no authority to require one,

It absolutely could require one for functions within the federally-regulatable sphere, and not prohibit its use for private and state functions.

(If it was national-but-decentralized, it could just set standards for the digital ID and let states issue them, the same way it has for physical ID, see, e.g., REAL ID.)

Reply on news.ycombinator.com