Hacker News Reader

Comment by dakiol | Hacker News Reader

If only governments could provide a very simple “check identity” service online. I think this should be a basic service nowadays.

View on HN

> If only governments could provide a very simple “check identity” service online. I think this should be a basic service nowadays.

Slovenia issues personal certificates so you can identify yourself online. Mostly used for banking and e-gov. The commercial space has decided it’s too cumbersome.

Fantastic idea. Started rolling out when I was in college some 15 years ago. You go to the same place that issues your govt ID and you can also get the equivalent of an SSH cert issued by the government that guarantees you are you, your identity was verified at point of issuance, etc.

Unfortunately it’s about as fiddly to use as SSH. Okay for nerds, way cumbersome for normal humans who just want to log into their bank and pay their taxes damn it. Last I remember (moved to USA ~10 years ago) getting their e-signing browser widgets/extensions to work reliably on non-windows machines was hell. Most Mac/Linux users ran a whole VMWare VM just to do taxes once a year.

Imagine if you had to provide your government ID to use any website.

Even for employment I find the idea iffy, but seeing as it's in response to an actual non-imagined problem, I suppose it's the most reasonable solution to that...

You lack some imagination. One could verify their identity against a government service once every let’s say 5 years. You get a public link/code that you can share with employers (or banks or real state agencies or…) so that they can use the link/code against a government service to verify that you are who you claim to be.

Adding a session token in the middle of the process of a website getting your government ID won't stop the website getting your government ID though? Either way the website learns your full name and address, and you can only ever have one account - which will make you extra careful not to violate any real or imagined rules - the chilling effect on speech is still there.

They provide, don't they? In Russia there are "gosuslugi" (government services) that banks and other organizations can use to confirm identity. However, if you sign up, then you will receive draft notices for military service through the app so you better not sign up.

I am not sure it would resolve the issue. About 10 or so years ago I was contacted on LinedIn with offer to "rent my name and face" for a team of Chinese remote workers (probably not those exact words). I rejected the offer without asking for details. Not sure if they were actually from China.

If you sell your identity, you are accountable. That works in real life too; So there’s less incentive in doing it.

Isn't that what the E-Verify [1] system was supposed to be? Several companies are now discovering it's not all it's cracked up to be, as ICE shows up at their door.

[1] https://www.e-verify.gov/

E-verify is just to check employment authorization, it's not a general identity service.

We don't need a general identity service though. We need to know whether someone is authorized to work for a US employer, right? How can a DPRK worker have the necessary authorization? If they use someone else's identity, isn't that something e verify should catch? If these are US citizens/nationals/residents working out of DPRK, who cares?

They can buy, steal, or hire yours. If it were a general identity service, yours would get tracked. But if it's just a matter of authorization, with no authentication, they'd just use it indefinitely.

I suspect some of the fake job postings are schemes to harvest that type of data. If I live in Atlanta and someone uses my identity to get a job in Seattle, how long will it take for me to learn about the company in Seattle that thinks it hired me, especially if they don't use my home address.

One of the many reasons I don't like to give references, social security number, date of birth, and so on to anyone except the end client hiring manager. I don't really care if the talent manager software has a required field to put last four of social security number. I simply don't trust random job postings to keep my information secure.

Would it help if I could query some IRS service to check what paychecks have been sent to me? Does this have a delay of a quarter year or more?

How do these people avoid getting the people they impersonated and or scammed in trouble with the IRS?

You would also exclude everyone that is not a US resident; which might or might not be what you want.

I would guess many (most?) of the places with this problem are actually fine with people that aren't living in the US; just not in North Korea.

> We need to know whether someone is authorized to work for a US employer, right?

E-verify is only for US residents, and depends on the employer interacting in person with the prospective employee.

Its primary goal is to check that someone is a legal resident, so it has no bearing on hiring remote foreign workers.

Yes. It confirms someone with a particular name, DOB, and SSN is authorized to work in the US. It doesn't confirm that the person claiming to be that person actually is that person. It relies on the employer to be able to match the applicant to the photo in e-verify, which isn't always an easy task.

Reply on news.ycombinator.com