Hacker News Reader

Comment by Almondsetat | Hacker News Reader

This can only be done by delegating the verification to national eIDs systems. This way the website simply asks the government: is this person >18? and the trusted government platform can reply without disclosing additional information.

View on HN

It doesn't need to be a national system. The relying party could give the browser a list of acceptable token providers to choose from, and the browser selects one it knows the user has already registered with, for example. There's no reason a private party couldn't be considered trusted to perform identity verification (e.g. banks have KYC requirements already).

Realistically the only acceptable sources are government. For example in the US you basically need a state ID (driver's license), military ID, or passport. And the state systems are now federally regulated (Real ID).

The bills I've seen in the US indicate that you need to use a commercially acceptable solution (so don't mandate government), and include regulations for private providers to follow (e.g. that age validators are also barred from retaining information about the validation).

Sadly, most companies aren't competent enough to delete data and the government isn't competent to verify whether they delete data or not.

I would not want my browser to do this shit.

Why do you think that's the only way?

Your public, verifiable identity already exists because the government keeps track of it. Why would a third party need to be involved if the infrastructure is already available straight from the source? Also, if multiple providers existed, how could platforms avoid duplicates, in case of need?

You talk like we all live under the same government, and like it would be a good thing if we did.

This is your own, personal, twisted interpretation of my reply

I don't see how we can arrive at an alternative interpretation if we follow your argument to its logical conclusion.

If you don't see it then that's your problem

Not all countries have centralized systems with comprehensive national databases, some purposefully fragment record-keeping across different agencies and limit their access accordingly.

Privacy laws and constitutional protections vary widely across democracies and - in my estimation - for very good reason.

This is about pure and simple national ID. National IDs are already managed at the national level, by definition. Other kinds of records are outside of the topic

Would that be your SSN in the US for example? I don't think most people would be in favor of that.

Australia, Canada, Ireland, New Zealand, the UK, and the US have no government-issued compulsory identity cards for all citizens.

I don't want government to be able to get my id. Especially the British and German governments have proved that their lack the maturity to work with such data. They couldn't even keep their fingers from Corona app data.

I would even prefer it to give my info to Elon Musk. He may be crazy, but he wouldn't be interested in my stupid opinions.

It's not the only way, but since the government already has lots of personal information about you, having them also do the ID thing means that I wouldn't need to expose myself to yet another company or otherwise expand my attack surface.

That's not how "attack surface" works. Having your information centralized is what makes you vulnerable.

My point is that my information is already centralized in one place. Giving that information to additional places increases the odds of that information being misused, so I'm not willing to do that. It increases my vulnerability.

You can verify that you're above a certain age while remaining anonymous by way of zero knowledge proof, for example. There is no need to involve a government in a transaction of information that is outside its scope.

Reply on news.ycombinator.com