Hacker News Reader

Comment by mindslight | Hacker News Reader

Further cementing this broken idea of "identity" as something that can be stolen is most certainly not what we need! Rather we need AG's to start going after companies that attempt to collect negligently verified and other fake debts for the outright brazen fraud that it is, and a law that allow victims to procedurally recover triple damages for time/money spent defending against these companies and helping the companies clean up their own messes. Separately, we need a law like the GDPR that lets individuals audit, control, and opt out of the surveillance records being kept on us.

View on HN

Exactly. The whole idea that end users are responsible for their stolen "identity" is absurd.

It was a successful tactic used by banks and credit bureaus to shed their responsibility of proper verification when opening lines of credit or other accounts.

I would go one step further, saying that proper verification is prone to fraud because of failure in government (in the US; not sure about other countries). It still baffles me that identification typically comes down to two things: social security card and driver's license, and both are managed by agencies whose primary objective is not identification. IMHO, it's time for a single agency at either the fed or state level that's in charge of just identification. That's it. Fund that agency and let them do it properly. However, inevitably someone will scream "Big Brother!", and we'll end up back where we started, with this Rube Goldberg system that basically leaves individuals to fend for themselves.

I'll go yet another step further, and say that the main opposition to having a better technical system of government identification is because we're lacking a comprehensive privacy law akin to the GDPR. As it stands if the government started say issuing smart cards for identify verification, then every business would gradually force their customers to identify themselves, for helping the commercial surveillance industry track everything they do. This is the current dynamic with mobile apps, phone numbers, and existing static identifiers, and it's only held back because one can feign not having them and/or being worried about giving out that info. Whereas with actually secure technicals, that friction basically disappears. And so the only way to prevent this dynamic (and make it so better identification isn't itself a security vulnerability) is by gaining the legal right to inspect/audit/reject the collection, use, and storage of such information in the first place.

There's also a significant constituency that believes any nationwide system of identity is the "mark of the beast" as spoken of in the Bible.

It feels like the people who literally believe this as an actual political concern is a vanishingly small contingent, especially given that the ship has already sailed with SSNs and the like, making this more of a partisan talking point strawman. Of course I do respect that the relevant political party has made their whole platform one of stirring up such tempests in teapots instead of focusing on substantive policy. But still regardless of the possible superstitious narratives that objections may end up taking, the best way to eliminate objections is to address the actual practical concerns. And that is chiefly the myriad of ways in which existing identifiers are being abused.

Phone numbers already do that.

Digital identification can be done correctly, i.e. give business one time pseudonym maybe with one time email pseudonym. Then businesses won't ask for such identification :)

Or it can require ATM, which is not frictionless.

Businesses already ask for phone numbers anyway. Can it become worse?

Phone numbers are bad, but of course it could be worse. Phone numbers have both escape hatches (VOIP, shared number burner services, or your own psuedonymous SIM + device ID), and friction (people are wary of businesses spamming them).

Pseudonyms don't work for the topic under discussion, issuing credit. And for the general case, since credit issuers would be able to require you to do a non-psuedonym identification, then any other entity can require this as well, unless there were a privacy law.

(no idea what you mean by "ATM")

>Pseudonyms don't work for the topic under discussion, issuing credit.

Because businesses want spammable addresses. That's why they won't ask for properly designed digital identification.

By ATM I mean you use ATM with your card to authenticate yourself. You can't use a smart card with thin air, can you?

Strong disagree that such a responsibility exists. I should be able to open a bank account with _nothing_, save perhaps a _de minimis_ initial deposit (one penny, or similar).

I can walk into a shop with a handful of cash, buy an item, and leave without anyone knowing who I was. That should be true of any good or service, including banking, that does not require additional data for direct practical reasons related to the provision of the service, e.g. cleaners need to know where you live. "Prevention of fraud/laundering/terrorism/whatever" is not such a reason.

I'm sympathetic to your comment, but we are talking about the issuing of credit. Surely you see that this idea is a non-starter for a bank issuing credit?

This is further complicated by US bank accounts including an intrinsic bit of credit from writing checks and other ACH debits.

That is fine for opening a deposit account. The fraud we're talking about is for obtaining credit or future financial obligations. It is wrong to let this be done with so little proof of identity and enforce the obligation in courts.

Banks have notaries of the public. After you have established a relationship with a bank, the notary may have enough evidence to authenticate you for others. If you have continued to use the bank in an anonymous manner, then you should not be authenticated to others.

This is the best comment ever. Thank you! ... The narrative around "identity theft" and "personal data" needs to change.

Reply on news.ycombinator.com