Hacker News Reader

Comment by thequux | Hacker News Reader

The US does identity verification by asking for a driver's license (which has no chip or biometric data) and possibly a series of questions about your past drawn from public data. All of these credentials are laughably easy to spoof. Compare this to Europe, where every resident has an eID containing a keypair and X.509 certificate signed by the government containing their personal details. It is trivial to check the validity of these cards and nearly impossible to forge without subverting either the national PKI or printing apparatus

View on HN

The security around the facilities which make the documents is also significant. Getting the printing apparatus is no small feat.

    > Compare this to Europe, where every resident has an eID containing a keypair and X.509 certificate signed by the government containing their personal details.

Woah. First, on HN I keep seeing this term "Europe". Europe is 50 countries. Please try to be more specific. Did you mean EU? If yes, then my question: Really? All 27 EU nations support and actually use this identity programme with financial institutions? I never heard about it. And, just saying that it exists isn't enough. Do normies use it (like your parents & grandparents)?

It's an EU thing. Yes, normies do use it, as it is a chip embedded in your personal ID card and your passport. You hand your ID to an officer, they read the chip data and verify the signature. You don't have to know anything about how it works. It also contains biometrical data (your fingerprints, etc).

Implementation of eIDAS is still in progress. It's not even mandatory for every citizen to haven an eID until end of 2026. And it's also not used yet everywhere for everything. But it's gradually growing.

The first time I had a chance to use was just some months ago, when I could activate a SIM-card online through and my smartphone reading out my ID-card via NFC. I pay daily via NFC, but it's the first time ever I had to use the chip in my ID-Card, despite it having one for 15 years now. Laws and regulations are good in theory, but reality can be often quite a bit different.

Fingerprints are collected only from criminals or people who visit US. Why did Europeans agree to being treated like criminals or tourists I don't understand.

>Fingerprints are collected only from criminals or people who visit US. Why did Europeans agree to being treated like criminals or tourists I don't understand.

Only if you assume that anyone who works for a SEC regulated company[0], applies for a California driver's license[1], current and former US Military personnel[2] healthcare workers, teachers, real estate agents, child care providers and others[3] are either "criminals" or "tourists."

If so, into which bucket would you place CA driver's license applicants? Criminals? How about US Military personnel? Tourists?

Please do elucidate.

[0] https://www.law.cornell.edu/cfr/text/17/240.17f-2

[1] https://www.dmv.ca.gov/portal/vehicle-industry-services/occu...

[2] https://www.law.cornell.edu/uscode/text/8/1440f

[3] https://blog.certifixlivescan.com/state-by-state-guide-to-fi...

Yes the government wants to treat everyone as a possible criminal and collects fingerprints for this reason. There is absolutely no logical reason for collection of fingerprints for a driver's license. Collecting fingerprints doesn't make driving safer in any way. Making driving exam more difficult and having to take it more often would make driving safer, limiting the speed would make driving safer, but fingerprints wouldn't.

Driver's licenses serve as the primary form of identification in the US.

But you wouldn't know anything about that, would you Ivan, especially since many (most?) Americans don't have a passport.

Are your papers in order, Ivan? It would be a shame if you ended up in a Siberian gulag, eh?

Nobody, surprisingly, our regime doesn't require us to provide fingerprints yet (although that might change; our government loves to say "we just do the same thing all Western democratic governments do, so don't complain"). The punishment for not having valid "papers" is usually a fine (the fines for not having valid documentation related to military service were significantly increased recently for obvious reasons). Unless they close the border, I think we don't need to worry.

Also I always thought that it is weird, having to take driving exams to get an ID and calling an ID a "driver's license".

Fingerprints are only stored on the chip. Collection/retainment for other purposes is against the law.

That's just the first step to let people get used to giving away their biometric information and then change the laws.

It's currently being deployed across the european union[1], I think the 2026 target they gave it's a tad too unrealistic, wouldn't be surprised if we get major coverage not until 2030.

[1]https://commission.europa.eu/strategy-and-policy/priorities-...

That target is for the new and improved version where you can use NFC to self-identify on the web. The old version (with a smart card inside, so only offline auth) was rolled out in Germany in 2010.

Can't remember if they ever released the 1st version either in Italy or France, a few days ago my septuagenarian mum got the NFC enabled one in Italy.

The iOS app is surprisingly decent. She could still request the old, paper-only id but this one could be also used to pay for local ordinances straight from her phone, and it's less cumbersome than the SPID-based[1] authentication.

[1]https://it-m-wikipedia-org.translate.goog/wiki/SPID?_x_tr_sl...

Don't know about the whole Europe (or EU) but I strongly suspect it is indeed (almost) everywhere. I'm Turkish and Turkey has it too. And yes, my mother uses it, and my grandparents used it when they were alive. You can't do anything government-related, open a bank account, or even visit a hospital without your government-issued ID card (which contains a chip). And a few decades ago, before the chips, there were other security measures tied to ID cards.

Reply on news.ycombinator.com