Hacker News Reader

Comment by showerst | Hacker News Reader

Somewhat tangential to the article, but here's what I would like: A site like reddit, but you have to get your government ID verified when you sign up.

You can still pick any alias you want, but mods see your location within, say, 100 miles.

Imagine reddit with no bots, banning has consequences, and local subreddits can actually just be people who live there.

The painful sign up flow makes that totally unreasonable, but it would vastly improve my online community experience to live without bots and more limited trolls.

*edit to clarify* -- i don't want them to _have_ my ID, just use some kind of service from stripe or visa or whoever where they get a hash, so that banning is stickier.

View on HN

Isn't this basically what Parler tried to do? They got hacked and the PII of their users was leaked onto the internet and they were derided for collecting so much information.

You can do third party verification without storing the physical credentials. Parler was many things, and poorly designed was one of them.

I suppose, although Parler came at it catering to a very specific and volatile community.

"Don't get hacked and dump PII" is sort of a prerequisite for starting any online business these days, so I don't see that as a huge downside beyond the already comically difficult signup flow. Ideally, ID verification comes from someone like stripe or visa who's core business is handling that data, so the host is only storing a hash and a location.

Way back in the earliest days of the cypherpunk movement this was one of the things that people thought Chaumian blind signatures were going to offer and one of the crypto techniques that fascinated me the most. These signatures offered a way for a government to issue you an isa-person cert that you could use to sign up for various online services. The thing about this key was that it was like a blinded ecash token, if you double-spent it you could be revealed. If you set up your reddit account with your cert/token then you would get one account, trying to set up a second would trigger a double-spend reveal and your identity would be exposed. You could set up various ways to do blind reveals of specific info (e.g. gender, age, etc) for various types of classification purposes. Stefan Brands pushed this work even further, but it all sort of disappeared during the dot-com bust. Now if you search for 'stefan brands ecash cryptography' google assumes a typo and you get a bunch of links for some shitcoin being pushed by comrade Segal.

A bit of a long and winding road to head off in the direction of noting that some of the old techniques that were being explored in the crypto cambrian explosion of the early 90s are still out there and still have merit. They just seem buried in the back-and-forth jousting between all or nothing when it comes to online identity.

Do you trust a site like reddit to keep your government ID secure? I don't.

I was thinking more of a "verified by stripe" type flow. They just need a location and a hash that prevents multiple signups. I realize that's just moving the problem, but hey the whole idea is impractical anyway.

As a reddit user for 15 years now I would just move to gab (I think that's the name) or whatever other platform there is if they start asking for government IDs.

I would prefer just making users pay some fee.

This doesn't really solve any problems, because it just makes trolling/harassment cost a few bucks. It also practically incentivizes commercial shilling since that has an easy to calculate return.

Any amount of money that would make it cost prohibitive to get banned would also kill the userbase.

As an interesting alternative, imagine that the site asked you to print out a random number on a piece of paper and (within a 2 hour window, for example) film yourself holding it in front of a building or landmark that you claim is within 100 miles of your home.

You could cover your face during the filming, or temporarily affix the paper to some surface, like a tree, and then upload your video clip to a selection of randomly chosen existing members who would cross-reference your location with Google street view, and try to check that the image isn't a deep fake.

Of course people would eventually start offering a paid service of carrying out this process on behalf of the bot farmers, but the algorithm could demand that your filming location not be somewhere that a lot of people have already used for their recordings, which would push up the cost of someone trying to create multiple identities locally to them.

Also, offering this location spoofing service could be classed as (conspiracy to commit) fraud, and the risks of getting caught by going to a specific location at a specific time as part of a sting operation should be pretty high, and not worth being paid minimum wage for.

I don't know why this is such an unpopular idea. For comparison, people have implemented a "Proof of Humanity" system[0] which requires users to record a video of themselves holding up a key-derived number. This is very similar to my idea, except it relies on the uniqueness of faces rather than the cost of visiting a location.

Both ideas seem imperfect, but obviously a system that links your ID to your face is less private than one which links your ID to a circle of radius 100 miles.

It is also interesting to see that the system I linked to uses a "court" system among its members, where people are randomly picked to adjudicate claims about invalid IDs. There is even a system for claiming that a user has died and having their key revoked if they cannot prove they are alive.

[0] https://www.proofofhumanity.id/

Reply on news.ycombinator.com