Hacker News Reader

Comment by sneak | Hacker News Reader

Absolutely not! The moment you have universal state-issued identity, you will be expected to provide it for everything, including tons of stuff that doesn’t require identity. Don’t be a privacy defeatist, the fight isn’t lost yet.

Resist every single effort to make it easier for merchants and private entities to strongly identify users. The rows go into databases and they never go away.

State-issued identity is one of the fundamental building blocks of a totalitarian police state that has universal surveillance.

View on HN

We have universal ID cards here in Belgium. They have a chip and along with a special card reader usb device you can log in to govt websites related to taxes, pension and basically everything else.

If you have a smartphone you can use an app to scan a QR and log in that way. It's super convenient.

Where is the privacy problem if you use this system to consult your own civil data ? Privacy is a thing in the EU and it's a complex issue mainly because of these tech behemoths that need to know your shoe size before you can use their todo list app.

> Resist every single effort to make it easier for merchants and private entities to strongly identify users

How is this related to govt issued ID cards ?

If it's easy enough to connect such an ID with arbitrary companies, I don't trust US privacy laws to prevent them from requiring it.

Maybe not having IDs is the reason why US doesn't have privacy protections and everybody can buy all the data anyway for 5 bucks from ad tech and telecoms.

The moment private entities can avoid spending money on auth and anti-sybil, they will simply default to using the government IdP, because auth is hard and fixing exceptions is expensive (CSRs, etc).

Then, you will simply have to provide full government ID to every business for every transaction. Instant surveillance state (given that they can access all business records).

This is not a world in which you wish to live. It is very important that you be able to transact without ID.

> Absolutely not! The moment you have universal state-issued identity, you will be expected to provide it for everything, including tons of stuff that doesn’t require identity.

Indeed this has happened in Denmark already where for example DBA (Danish version of ebay) started soft-mandating MitID verification. Soon to be actually mandatory.

At one point I was researching using the Norwegian BankID system to ensure that accounts where real people. The pricing model didn't make that look like a reasonable choice. While I'm not surprised an eBay like service would be fine to pay to combat fraud. For a lot of offerings, paying the cost of using such services will not be worth it.

The way identity providers are supposed to work is to not necessarily divulge your identity, but properties necessary for the respective service. For example, they can attest that you are an adult and a citizen of $country, but don’t need to disclose any further information. When using an identity provider with a third-party service, the attested attributes are displayed to the user to approve their disclosure. This is a bit like app permissions, where you can specify which app should be able to have which permission.

But most sites will just require you to attest your full name. Additionally, they will require a unique ID that the govt might not bother changing between websites.

Real name and central ID requirements are anti privacy and have the tracking problems OP highlighted.

I've lived both in countries that have state-issued IDs and in the US, and I don't have much doubt about where I've felt better protected in terms of data privacy...

I'm so sick of retail clerks who insist on scanning the barcode of my driver's license. To verify I am 21 you don't need my height, weight, eye color, and home address. You can ascertain that my visually inspecting just the first two digits of my birth year.

Sounds like you may be aware, but no one should allow that to happen. When showing ID in retail situations I don't allow it to be removed from my hand.

Do they actually compare the picture on the driver's license to your face or do they only scan the barcode? In some cases the barcode is on the backside. I've many times seen that they don't even look at the side of the card with the picture. So you can just present a suitable barcode for them to scan. "Verification" indeed...

Reply on news.ycombinator.com