Hacker News Reader

Hacker News

Comment by JimDabell | Hacker News Reader

Parent Full thread

JimDabell

Services need the ability to obtain an identifier that:

- Belongs to exactly one real person.

- That a person cannot own more than one of.

- That is unique per-service.

- That cannot be tied to a real-world identity.

- That can be used by the person to optionally disclose attributes like whether they are an adult or not.

Services generally don’t care about knowing your exact identity but being able to ban a person and not have them simply register a new account, and being able to stop people from registering thousands of accounts would go a long way towards wiping out inauthentic and abusive behaviour.

I think DID is one effort to solve this problem, but I haven’t looked into it enough to know whether it’s any good:

https://www.w3.org/TR/did-core/

View on HN

Agreed that offering an identifier like this would be ideal. We should be fighting for this. But in the meantime, using a passport ticks most of the boxes in your list.

I’m currently working on a social network that utilises passports to ensure account uniqueness. I’m aware that folks can have multiple passports, but it will be good enough to ensure that abuse is minimal and real humans are behind the accounts.

The main problem with this is that a hell of a lot of people don’t want to give sensitive personal documents to social media platforms.

Yeah. That will be the challenge.

I hope that enough are willing to if the benefits and security are explained plainly enough. For example, I don’t intend to store any passport info, just hashes. So there should be no risk, even if the DB leaks.

First, not everyone has passports - there are roughly half as many US passports as Americans.

Second, how much of the passport information do you hash that it's not reversible? If you know some facts about your target (imagine a public figure), could an attacker feasibly enumerate the remaining info to check to see if their passport was registered in your database? For example, there are only 2.6 billion possible American passport numbers, so if you knew the rest of Taylor Swift's info, you could conceivably use brute-force to see if she's in your database. As a side effect, you'd now know her passport number, as well.

> Second, how much of the passport information do you hash that it's not reversible?

That doesn't even matter. You could hash the whole passport and the passport could contain a UUID and the hash db would still be usable to correlate identities with accounts, because the attacker could separately have the victim's complete passport info. Which is increasingly likely the more sites try to use passports like this, because some won't hash them or will get breached sufficiently that the attackers can capture passport info before it gets hashed and then there will be public databases with everybody's complete passport info.

Good point.

That’s a very good point and indeed it is a potential attack vector.

I’ll have to think about that. Perhaps I can get away with not tying the passport hash to a particular user.

Reply on news.ycombinator.com