Hacker News Reader

Comment by akdev1l | Hacker News Reader

> credit bureau industries are obviously impossible to run safely and should be destroyed

I am not sure I agree with that premise.

I would say there are literally no incentives to secure that data and no penalty for leaking it. Hence for profit businesses will never operate this securely.

I think it’s the same conclusion but a worthy distinction

View on HN

There's no way for someone to make an identifier that's also a secret secure. You could have huge penalties, give the corporate death penalty, and you'd simply see old insecure companies replaced with new insecure companies. Add a real death penalty for the CEO, and you'd just find all the new companies are run by people who have nothing left to lose (or death row inmates suddenly find they have a bunch of new opportunities).

Secure identification is a solved problem, you have a public part and a hidden secret part. Everyone knows your public part, but the companies never knows your secret part so they can't impersonate you.

This is what other countries are doing, this is a solved problem so identify theft shouldn't happen any more in any competently run country.

You may be taking a narrow view of "the problem". Stella Rimington, head of British (internal) intelligence (MI5) courageously spoke some clear truth a couple of decades ago. She said there isn't and cannot be a reliable connection between information and an active body in the world with agency. In other words, she thought "identity" is a weak idea and forcefully opposed the idea of "ID cards".

Individuals may occasionally be of interest in intelligence, but less than you think. Identity really comes from banking, law and medicine so that we don't give the wrong person money, drugs or put the wrong person in jail. It's low-level, procedural, civic stuff.

Beyond that there's a lot more dark, unwanted applications of identity and we forget how much it is a cultural artefact of the individualistic society we presently inhabit.

We do have plenty of nearly-good ways of _re_cognising_ a living person, if we have previously "cognised" them. Images, voices, faces, and various biological scans are all limited and likely to be defeated with coming technology.

So separating "trust" (as expected behaviour) from identity is a major challenge, and a most fascinating one. They are not the same thing.

Could you share a quote or source for others to check out what she said? It sounds very interesting, I'd love to read or listen to what she had to say there.

These [0,1,2] are press opinions on her opposition to ID back then. The woman behind all that is far more interesting, but I can't find you more direct sources. She's a writer (fiction) too and may have expressed more in her autobiography or stories after coming out.

[0] https://www.theguardian.com/uk/2005/nov/16/idcards.uksecurit...

[1] https://www.mirror.co.uk/news/uk-news/a-really-bad-idea-5656...

[2] https://www.theguardian.com/uk/2005/nov/17/idcards.immigrati...

> Her own opinion was that ID cards would be of use "but only if they can be made unforgeable".

Internet identifiers with private keys are unforgeable unless the certificate authority is compromised, so seems like she would be in favor of this.

There is no disadvantage with this compared to just having a public identifier with no private part (current SSN scheme in USA).

> so seems like she would be in favor of this

No I don't think she would approve of any zealous solutionism. Not that I personally drink tea with her, but from what I've read SR occupies that class of intellect that deals in philosophical fundamentals of human affairs high above the 'technician' who says "Oh we've solved this with new fangled thing X now". And I'd bet my comfiest boots on some "certificate authority" being compromised before the ink is dry on this comment. I mean... look at what the title of this thread is about. :)

That doesn't solve the whole problem. Identity is fundamentally about what you are. What you have, or what you know, are merely proxies, and they need to be connected to you in a trusted way, which is hard to do in a robust and efficient way.

Or, in other words, when you misplace your private key, you don't want to irrecoverably lose everything you have. Fortunately, the world isn't some nightmarish cryptocurrency dystopia - there are ways to prove you owned the lost credentials and keep the ownership of what you had. The flip side of it is that someone else can prove they own your stuff too, with enough effort.

It solves the problem of having to give the company enough information for them to steal your identity in order to do business with them. That isn't a power companies should have over you, and those who do should be extremely heavily regulated to ensure their data protection is top level quality.

This way it isn't a big deal if small businesses leak data, since they don't have the important parts, so they don't need to be regulated that hard.

> There's no way for someone to make an identifier that's also a secret secure.

There is, but it requires assymetric cryptography, so entities can verify you have access to the private key without having access themselves.

And that would be more technically sophisticated, and difficult to deploy, so I don't see it happening any time soon.

Right, its not like you have a public identitifier (your email address) with a secret (your password or even MFA)...

Could you imagine if we just treated knowing your email as being proof it was you in financial deals?

> There's no way for someone to make an identifier that's also a secret secure.

umm what? Private-Public key authentication exists.

The public key is, by definition, not a secret.

I agree.

I think it is not theoretically impossible, but it is we live in a world where these services are offered by race-to-the-bottom-of-the barrel providers (to merge a couple expressions).

Reply on news.ycombinator.com