Hacker News Reader

Comment by williamcotton | Hacker News Reader

I’m so envious of the Baltic’s use of technology at the institutional level.

It seems literally infeasible for the United States to have state-issued PKI. It’s a meta-partisan issue: no side trusts the other to manage crypto or computer systems.

So for example instead of a public many-to-many digital publishing platform we are stuck with the whims of grown men who want to fist fight each other in the Colosseum and all because every X is convinced every Y is so despicable and corrupt that such a public system would be much worse than what we have now.

View on HN

The USA was distrustful of national ID cards decades before the current level of hyperpartisan rancor. We just don’t the government enough to let them track us everywhere.

Not that the current climate helps. The REAL ID Act of 2005 has been delayed so many times, now to 2025. Maybe we should just repeal it instead.

> We just don’t the government enough to let them track us everywhere.

That statement is both true and emblematic of the problem. Everyone is so cynical that a clean public-key, offline, certificate-based solution, with an absolute zero visibility to the government of who is doing what, would always be assumed to be part of some nefarious Illuminati/Democrat/Republican plot. Proving it to people with technical tests wouldn't prove it. They'll always be convinced.

What we need from the government is so minimal really, just to sign certificates if we prove our identity. But it'll never happen in the US due to the distrust situation.

Because there has never been a proposal for a "clean public-key / offline / certificate-based solution". It's always a central database that also does x and y and will be available for w and z departments to do as they will with it.

It doesn’t matter though, because the percentage of Americans who can understand public key crypto even in a vague way sufficient to critically read a technical analysis and judge it to be true, you could count on one hand. Nobody has proposed it because if any politicians have seen such a proposal on their desks, even if they themselves grasp it (unlikely), they know most Americans would freak out on principle.

Why are you talking about hypotheticals and abstract "distrust" ? We're already being harmed by existing central ID systems - social security numbers and drivers license numbers - with little hope for reform in sight. If there were something like the GDPR that prohibited companies from nonconsensually demanding, storing, or using these identifiers for anything but their bona fide governmental functions, then it might make sense to talk about adding a new system. But until the government is capable of reigning in abuse of the existing systems, any new identification system would inevitably be a gift to the surveillance companies.

> The REAL ID Act of 2005 has been delayed so many times, now to 2025

Can one fly without a REAL-ID-compliant license or ID?

Yes, with a passport you can

... Probably not what you were trying to ask. I thought the deadline passed for using real ID for TSA but I haven't looked for that info in years

The deadline has been pushed to May 7, 2025.

> We just don’t the government enough to let them track us everywhere.

Eh, that’s the pseudo-libertarian objection (which is… dumb as bricks, practically speaking) but the most common objection is one of access.

Until IDs are both free AND easy to obtain in the US (if you think they are, congrats: you’re in the lucky group) then a national id scheme will always be a non-starter.

IDs face the same problem voting has in recent years (and historically): the systems of power use limiting access as a tool to control those they don’t like.

> no side trusts the other to manage crypto or computer systems

Nor should they. Too much power for governments to have. Every so often some news gets posted here about some government official who just does not give a shit about people's rights, you can actually feel the contempt when you read what they say.

Government solutions are non-solutions. We should solve these problems with ubiquitous technology or not solve them at all.

Except our only solution to this problem today IS government provided already (ID SSN or Passport).

Which is dehumanizing. We are not cattle to be identified and marked.

Interesting. How do you identify criminals. Or for that matter, how do you identify anyone? "Just don't" or ... Some other solution?

I assume their version involves another individual unaffiliated with government or private industry taking their hand, gazing meaningfully into their eyes, and tearfully proclaiming “I see you” before letting them through the border or into the bank vault or whatever.

Ah so you are the man with no name, I assume?

My parents giving me a name is one thing. The state giving me a number and arresting me if I fail to produce that number to police on demand is another.

It’s funny you think there’s a difference

It's funny you think there isn't a difference between the humanity of your parents and some faceless governamental bureaucracy.

It’s funny you think there is a separation between the two in any practical way.

Which one of those is problematic to you? The state giving you a number or arresting you if you refuse to identify yourself? Because you've given yourself a nice straw man to fight by conflating them.

Oh he knows that, but that’s all their type has: faux-bravado against imagined threats.

Not least: they’re ignoring that simply having an identity is a traceable & trackable thing… because that would derail their paranoid fantasies where they’re a hero, fighting against a dystopian world.

But you need a way to identify people. If there's no good way to identify real people (government issued ID number), those that need them will invent bad ones (SSN, phone number, maiden name, maybe more). And companies like Google have their own identifier for you already, anyway. And you can't travel anywhere without a passport that is another identifier, anyway.

I'm impressed how much Americans dislike the idea of a mandatory government issued ID. I don't mean it in a bad way - this sounds like a very principled and idealistic stance. I just really like my government issued ID, and consider it a reasonable tradeoff.

I'm not american. Not only do I want the government to know nothing at all about me, I also want it to be illegal for others to develop those alternative identification methods. Those who "need" such things should have to figure out a way to avoid needing it.

If the government wants to do something they should publish open source code that implements a sane authentication system, and then have no part of operating it whatsoever. If it's good and free people will use it voluntarily. If it isn't then you certainly don't want the same people implementing anything mandatory.

The best part is that the US Government already did this -- it runs the second largest PKI. Second only to the Internet. It has issued more than 20 million certificates to individuals.

For those curious:

https://public.cyber.mil/pki-pke/interoperability/

Or in visual form:

https://dl.dod.cyber.mil/wp-content/uploads/pki-pke/img/fed_...

That's the part you don't want them to do though. Centralized PKI is bad for privacy and creates a single point of compromise. You don't want this, but for the whole population:

https://en.wikipedia.org/wiki/Office_of_Personnel_Management...

What you want is some well-reviewed code that a bank or utility company can "apt install" onto their server and get secure decentralized web authentication working in five minutes instead of leaving them to create some custom in-house contraption designed by a rotating committee of middle managers.

And they should really endeavor to break that PKI thing into smaller, independent, less centralized pieces. It's way too big as it is. There appears to be something called "Symantec" between "Federal Bridge" and "US Senate" and then another "Symantec" between "Federal Bridge" and "Naval Reactors" -- that doesn't seem great.

tbh I can't think of many cases where I'd want state-issued PKI. I already use public key crypto secured by biometrics (faceid) to make payments, login to my bank, etc. None of that requires interacting with the state. For most normal computer use I quite like how random social media sites can't demand my identity because it'd be too expensive for them to verify it using public records.

> I’m so envious of the Baltic’s use of technology at the institutional level.

You shouldn't. I don't know if anything changed in the last few years, but having to insert your ID into a card reader is very cumbersome from a user experience perspective. Especially since the world is moving away from having to plug stuff into computers.

Reply on news.ycombinator.com