Hacker News Reader

Comment by maze-le | Hacker News Reader

All this information in one database... Thats the real insanity here. Why would anyone think that this is a good idea? Leave aside security and safeguards for a moment, just compiling this database is neglectful at the very least...

View on HN

Isn't it like this in practically every European country? We have ID cards with every one of those fields printed on them, including thumbprints. All of that information is probably in one big table somewhere.

Most EU cards also integrate fiscal id numbers and national healthcare id numbers in the chip but arguably do exclude registered address, so only a city/province of residence is available.

Not sure about the rest but Spanish ID card includes full address.

Italian ID cards too, as well as the owner's signature, the fiscal code (an unique identification code similar to the SSN in the USA) and the fingerprints (though these latter are stored in the chip only, not printed on the card).

It's very likely that this data is also stored in some government database, which I hope will never get breached.

Nitpick (as you well know) - codice fiscale in Italy differs from USA SSN in that, for once, it has never had AFAIK any semblance of secrecy at all, as you can easily construct it starting from name, surname, place and date of birth [1] Funnily enough, this sometimes results in two individuals computing to the same code [2]

[1] https://en.wikipedia.org/wiki/Italian_fiscal_code

[2] https://it.wikipedia.org/wiki/Omocodia

Swiss cards not but well Switzerland is not EU...

It’s part of Schengen though. But I confirm, no adresse on our ID cards.

Germany supposedly does not have a central registry, I've been informed.

Because of (political) federation I assume, right?

However are the regional governments supposed to develop their own solutions, or are they using a centrally developed database, just with local unconnected instances?

"Contrary to popular belief, there is no central administration of resident registration in Germany. The exception is the registration of resident aliens (see Central Register of Foreign Nationals). Registration is organized by 5283 local offices throughout Germany.[18] "

https://en.wikipedia.org/wiki/Resident_registration#Germany

I was also told something on identity cards only lives on the cards, but cannot find the source or details on that.

Each municipality is free to choose their own solution to the legal requirements (which includes a standardized API). For the moment, there are eight different software solutions on the market (developed by both public and private entities), see https://www1.osci.de/meldewesen/xmeld/registrierte-herstelle...

Source? Even the Addresses (Melderegister) are centralized.

edit: Looking it up [0] it looks like there is far more data there, all in a central database since at least 2015 (not sure how it worked before).

[0]: https://de.wikipedia.org/wiki/Melderegister#Deutschland

It's been a little while, so perhaps things have changed, but I was told that quite a bit of the data exists only on the card itself.

From your link it seems i was not entirely misinformed: "Contrary to popular belief, there is no central administration of resident registration in Germany. The exception is the registration of resident aliens (see Central Register of Foreign Nationals). Registration is organized by 5283 local offices throughout Germany.[18] "

I'm unable to find the part about cards. will edit or reply more if i do find it.

Looking into it again, it appears the residential registration is indeed decentralized, but most of that data seems to still be saved in a central database thanks to Abgabenordnung § 139b [0].

There is something about sharing that information, but I can’t say I understand the legalese ;)

[0]: https://www.gesetze-im-internet.de/ao_1977/__139b.html

There is no central database, even after the changes of 2015. It is still hosted by each individual municipality (which is exactly what your link states).

However, there here is a standard API which allows some entities to query all those decentralized registers. It is designed to make it hard to siphon out all data at once (which hopefully trips audit systems in enough places that someone cares to look into).

The only centralized database of that kind is the one at BZSt, which contains far less data. For the moment access is limited to tax-related issues but it will be soon expanded to a centralized base data registry (Registermodernisierung).

What's in the BZSt?

To be fair, The security around the digital system in the Netherlands, is almost painful.

Japan is really good in this, they store everything on paper and fax it around.

They’re also starting with a national ID now though.

Everyone does it is not actually a persuasive argument that something is a good idea. It was an uphill struggle back in the day to get everyone washing their hands.

This is a predictable outcome of a government creating then storing long term secrets in a database. Governments are not good at keeping secrets. The data will leak.

I don't remember justifying it. Your comment seems a cheap karma grab.

Not in the UK (which is in Europe but no longer in the EU). Was planned before 2010 and then got scrapped by the subsequent government. What's in the works now?

I think so, but it doesn't mean that it is a good idea... Every bit that creates an official identity should be handled with great care.

The horse left the barn before you were born.

All of this information is in multiple single databases maintained by insurance companies in the US. And that data is in turn linked to all sorts of behavioral and affinity data. GEICO knows more about you than DMV.

I don't understand how you can seriously think that having two databases instead of one would make it any easier. OK, if we had two databases the overlap would be, let's say, 50% and there would be another 20% in the database A that doesn't exist in database B. Still 70% of information stolen.

That on top of the fact that having two separate databases means twice the probability of different bugs in two different systems.

We must all move away from using PI as passwords, that's all we need to do. Then this problem will go away.

> We must all move away from using PI as passwords, that's all we need to do. Then this problem will go away.

You make it sound like it's an easily solved problem, which it apparently isn't.

I just use password reset every time I have to log in and do enough login fails afterward to lockout my account.

What? How do you imagine that could work? Only paper records, and any interaction with any public administration thing takes a few months? It's generally a good idea to have the tax office, the healthcare ministry/insurance people, police, etc. know who the people of the country are and how to identify them. It's the norm in the EU, and works fine as long as security is taken seriously (which obviously wasn't in Argentina).

This is a country where when they installed license plate scanners on highways they accompanied them with large screens that show the plate that was just scanned.

So as to... I don't know, brag that you're collecting all this information, that is to be inevitably leaked in a while? To make people feel safe, while clearly indicating the highway exits to avoid if you actually steal a car?

> This is a country where when they installed license plate scanners on highways they accompanied them with large screens that show the plate that was just scanned.

This is done in France when it catches you driving too fast. "ABC 123" you're going too fast! It's a bit jarring your plate up on a screen so it works kind of well against speeding. They don't need to store your plate to use this feature.

Of course plates are being scanned (and probably stored) all over the place now (toll booths, big roads in & out of the cities), not denying that.

In our case its not shaming you for speeding or anything specific, it just displays every plate that it scans to advertise the scanner.

Also in a not very surprising turn of events, a lot of the screens just show a fixed plate these days which makes you wonder which component broke (is it the screen, or the scanner?)

Yes, I think it's a good idea for government to have that info. Government needs to provide services and manage resources, which means knowing who and where people live, and have a proper ID number to manage that data.

The alternative is for government to have 90% subsets of the same data in a a thousand different databases, one per-department, per-jurisdiction.

And then Dept A thinks you live here, Dept B thinks you live there, Dept C thinks you have a warrant out for your arrest, and little municipal dept Y.43 thinks you're dead.

Yeah, I can see a few problems with that.

That's a basic citizen database.

The only non-obvious information is the labor identification code. Except for that, it's just "who exists and how do we call them?"

Reply on news.ycombinator.com