Would you use a government-issued ID to prove your identity online?

We've been using it in Europe for years. However, I use it exclusively for government services like social security, car registration etc. It would never occur to me I would use it for commercial services like Google or Facebook. The moment any such service asks for a proof of identity, whether physical or digital, I cancel it.

There were two exceptions. One was Airbnb - and I understand them, they have to do some minimum verification of people given the history of abuse and the very nature of human interaction. The other was Hetzner - again, I understand they need to do their duty to protect themselves from spammers, scammers and other abusers. These were the only 2 exceptions in the last 20 years or so for me.

We already do this in The Netherlands. We can use our drivers license or newer id cards to activate a digital identity app from the government, by scanning the nfc chip in it. Works great honestly. I believe many services you log into then do not store much personal information, only what’s needed to connect to your id and of course whatever is needed for the service itself.

A failure mode that is common in many shared identity providers is that the services using the IdP often are able to ask for and receive information that should generally not be seen as mandatory shared information. A simple example of this is email address. Giving the same email address to many companies generally means that eventually that address will end up on spam lists. This is a one way non-recoverable situation (once you're on the list, that email is burned), with a probability of it happening scaling approximately linearly with the count of services that use the same address. The impact scales in the same proportion (if you choose to disable the address, then you have to change with all the services).

This is not theoretical. Services that use GitHub auth do this regularly.

Only for government services / banks, everywhere else no. Nordic countries already do this. Japan also recently introduced "MyNumber" exactly for this purpose and makes doing taxes more straightforward, though "MyNumber" is kinda mixed bag as it allows connection to many third party services and offers points for purchases etc..., I only limit my use for the taxes and government services.

In the EU, eIDAS allows companies to use government-issued identification: https://digital-strategy.ec.europa.eu/en/policies/eidas-regu...

It's yet to be seen how this new version will work, however they say in the story it's an upgrade of mygovid.

Mygovid as it stands is a cluster. It insists you have a single email address as your one true name, if insists you use that one true name everywhere you use mygovid to authenticate, if you upgrade your phone it throws away the ID. It's unreliable, as in the app have race conditions with it's internal state and external requests to identify yourself. Those race conditions cause it to not identify you at all, not notify you there is ID request and various other indeterminate states.

As a cherry on the top, mygovid is used in to authenticate against my.gov.au (the closeness of the two names is so confusing they have to put big red warnings not to confuse the two), and my.gov.au has been the victim or rampant identity fraud to the tune of $0.5B.

As others have mentioned here, there were far better thought out identity schemes around when mygovid was introduced. They chose to roll their own instead.

I hope this is an improvement, but there are few grounds for hope. The bill moving this forward is based on what the government needs - so although they allow for many ID providers the bill repeatedly mentions just one, I presume they want one true name and a centralised data store. Amusingly at first glance the bill looks devoid of technical details and I'm guessing that's because the lawyers think they left the design wide open so the subject matter experts can implement something that works. In reality and probably unwittingly, they've already set the technical foundations in stone, and they've chosen the wrong ones. Nonetheless if it defrauded like the present system has been, they'll blame the implementers.

For commercial services, no. There's a new W3C standard named DID that's much better for this. Using DIDs and a trusted authority, you can prove you're a real person without having to reveal your identity. You can even choose which verified data to reveal (e.g. age). But I guess some large entities would have to push it into the market for it to become widely used.

Definitively not for porn and alike, no issues for my banks or public administrations services. I use them since they was introduced...

Beside that I criticize two aspects:

- many state (at least here in EU) have chosen private companies to provide identity services at least for eIDAS level two authentications (user+password + OTP, essentially) witch can't be trusted and generally impose Android/iOS macrospy devices, so something insecure and untrustworthy by default;

- many states have introduced smart-card BUT with proprietary middlewire and crappy crapplications to use them;

both trends MUST be demolished from the ground before digital identities became the norm for all serious things. We need instead to build a chain of trust model where the public sign a citizen subkey as a proof valid for the public, and private parties might agree something similar each others for their customer/purposes.

I think this is the future, for better and for worse. Functional governments are already the ultimate authority on personal identity.

In Canada to access some government services we log in using a trusted partner, which is usually a bank at which we have an account.

If it was proving my ID to my own Government then yes, otherwise no - I’d work around the restriction.

In India we use Aadhar, the associated phone number and a digi-locker app to verify our identity. Mostly used for governmental, financial and insurance verification. Works seamlessly most of the time.

For government purposes? Sure. For anyone else, under no circumstances.

Would be nice if such a system would make specific (and to the user clearly understandable) verifications possible, without revealing the users identity.

For checks like: age > 18

> But at least some Coalition senators also voiced concerns about privacy. Matt Canavan and Gerard Rennick expressed dissent during the Senate committee process

> Senator Gallagher called the senators "conspiracy theorists" and accused the Coalition of appeasing them.

The government denouncing elected officials voicing the smallest of concerns over privacy as "conspiracy theorists" should set off a lot of alarm bells.

The Australian government has a history of spying, often illegally, on citizens for such 'crimes' as being Muslim or caring about the environment.

Some examples:

https://www.abc.net.au/news/2021-11-25/victoria-forests-agen...

https://adi.deakin.edu.au/australian-muslims-experiences-of-...

Considering the airport is testing out facial recognition systems to replace IDs:

Would you allow your face to be scanned by a government system to prove your identity online?

Imagine that you have to use your personal id to log into various services online. Google. Facebook, Reddit, this site and others. But then you are like me perma banned on most of them because of radical ideas. Never ever in your life you will be able to use those services. Sorry the computer says no.

respectfully, fuck that. it's not an "option" to verify with private companies because those companies make basically the sole decision about how ID and auth are set up. by making it easy, making it like a "sign in with google" button, the government spreads this further

we created unions because although employment is technically a free choice, a few companies hold huge power on negotiations relative to one tiny, individual worker. similarly, this may be a "voluntary adoption" but in practice is not. privacy has no value to companies and destroying it is worth 50% lower fraud

i don't have a good philosophical basis for this but am actually a strong believer in leaving open the possibility to commit crimes. so we should go back to circulating large-denomination bills, reduce the burden of KYC, and not create this non-falsifiable new ID regime

Sweden has been doing this since 2003 with BankID. Welcome to the 21st century.

You can use it to log into bank account pages, file taxes, book appointments with dentists, place orders in (private) pharmacies, check your electricity company account and many more. Any reasonably serious company could request integration.

this is just a matter of time

NO, obviously NOT.

Maybe Republicans will be able to run a DMV if we force them to do this.