Hacker News Reader

Comment by grey-area | Hacker News Reader

Digital ids are inevitable in my view, just as digital currency has become inescapable because it is more convenient and efficient, these ids will be issued and things like paper proofs of identity will fall away over time. Physical tokens like bank cards and driving licenses are neither necessary nor a good solution in a networked world.

Our focus therefore should be controlling what governments can do with them - for example disallowing blocking/removing someone’s id, just as we should disallow removing citizenship.

View on HN

I can't help but think people mean something else when they hear "digital ids" then what they are. Like I have a digital id from the government of the Netherlands that I use to log into their government systems to declare taxes or what not. I had an X509 certificate issued by Ukrainian government and have their app to do the same.

It's bad somehow?

The problem is what follows. They will make it mandatory to use the electronic ID to do anything, resulting in total surveillance. And if you happen to land on their "bad" list (which eventually everyone will), you're locked out of life completely. No banking, no traveling, no communication with anyone, no buying food, nothing.

"They" will make it mandatory? Who is they?

How will the current approach result in total surveillance?

I would much prefer hotels would have a scanner which just transmits the bare minimum of identifiable information from the ID instead of it being completely normalized in many countries/hotels that they take your ID card and scan the full thing.

Can you explain to me, how with an eID one would be prevented from communicating with anyone or buying food?

> Can you explain to me, how with an eID one would be prevented from communicating with anyone or buying food?

Some government (will) make mandatory: social accounts (so also IM apps like IG, WA, X, messanger), banks, buying simcard, internet, buying alcohol, cigarettes, energy drinks).

Some companies will make it mandatory implicitly or explicitly just for profit: selling your consumption data, analytics for themselves. E.g. in poland it's harder and harder to pay with cash because reduced stuff and huge queues - they force your use self checking. The pricing changed also that you have to use their loyalty apps if you don't want to be ripped - otherwise you will be paying 50% more.

> I would much prefer hotels would have a scanner which just transmits the bare minimum of identifiable information from the ID instead of it being completely normalized in many countries/hotels that they take your ID card and scan the full thing.

I don't like it either the problem is right now you mostly this being abused only in some hotels. Whats misleading that that this digital id won't allow tracking because you supposed to "trasmitting the bare minimum of identifiable information"

Are you kidding right now? Have you seen what's happening with ICE in the US? EU countries are just one effective social media campaign cycle away from the same policies. "It can't happen here" is foolish thinking.

See also: CCP

Policies are the problem here, not tools.

> Can you explain to me, how with an eID one would be prevented from communicating with anyone or buying food?

Why did you only ask about eID and not about "inescapable digital currencies" that was also mentioned in the same paragraph at the top of the thread?

> Who is they?

You see, the government wants to control the people so they can control the government /s

Only that it won't stay at the minimum information. They will want more and more, with some thinly veiled greed for more info.

For example hotels: Some chains may think to advertise using fear mongering, claiming that their hotels are the safest, because they perform background checks based on the information from their customers' ID. You don't want that? Fine! Go elsewhere then! This is private property, if you don't agree to these ToS, you are not allowed to enter or rent rooms, sooo sorry! All you had to do is sign your privacy away here and then let us mine your data ... You don't have anything to hide, do you??

The issue is, that every single involved party from business to government has an incentive to get more data from this system. If there are no laws with guaranteed severe punishments for violations edged into our inalienable human rights and constitutions and those are properly followed up on, in addition to making it technologically impossible to extract more information than necessary, the system sooner or later will be abused.

Easy. This was done during corona. They have security at the entrace of food stores and scanners. If you do not scan, security will escort you off the premises.

I prefer hotels without ID requirements. There is not a single shred of sound argument why a hotel needs to know who I am. Therefore I often stay in B&B:s without authoritarian ID-controls.

In Latvia we've had digital id for close to 20 years. Banks mostly use their own auth, some rely on digital id. No travel service has ever wanted me to use digital id, let alone any other kind of shopping. What we use it for is access to government resources, and signing digital documents. I trust this system WAY more than whatever some company comes up with.

This is an interesting and hopeful datapoint.

> No travel service has ever wanted me to use digital id, let alone any other kind of shopping

Yup, until they are regulated to do so in case you buy booze, porn, metal detectors, crossbows or who knows what else. And until silversmith tries to dodge the draft but he accidentaly bought some booze woth his gov eID to party with friends.

What's stopping anyone from requiring a passport scan right now?

No limitations during corona? Remember travelling through your neighbour during corona and was treated worse than a ww2 jew in germany due to not having the authoritarian corona passport.

This is what our every day will be like, when the state has internalized the enormous power of a 100% controlled digital ID. Bye, bye, freedom of thought.

You are most likely referring to the EU covid certificate. It functioned as a proof of vaccination or recent negative test, and yeah, that was required for travel at one point. And even then the verification end was `(code: string) -> valid: boolean` function, no personal data was accessible at validation point. It used the digital ID as SSO for accessing your records, so you could save / print the verification code, usually in form of a qr code. I know all this, because I'm friends with people that worked on the Latvian part of the system, and we spent long chat sessions discussing how to best do it in the least privacy-intrusive way.

If you were from outside EU, I fully believe the experience was subpar. 99% or more of verifications went through the EU system, and if you showed up with different kind of documentation, the people tasked with verification "at the edge" might not even know if it was valid form of proof.

Overall, I struggle with being outraged by the concept of digital ID. It's just a digital form of "show me your passport please". We have had physical national ID (mandatory from certain age!) for as long as I can remember myself. The state knows I exist. If a madman gets put in charge, lack of unified digital ID is not going to prevent airport style passport gates being erected around the booze stand.

I think what is happening is a rather philosophical rejection of the mere idea that the government should affect ones life in any way for any reason. Somehow all the laws that existed before are below the baseline, so they kinda fine, but the new things -- those cause outrage.

Then comes this post-hoc rationalization about how it will inevitably be abused, Jews in Nazi Germany, apartheid and chips under the skin.

>was treated worse than a ww2 jew in germany due to not having the authoritarian corona passport.

If you were to be treated worse than a jew in ww2 germany, you would not be writing about it here.

> And if you happen to land on their "bad" list (which eventually everyone will), you're locked out of life completely. No banking, no traveling, no communication with anyone, no buying food, nothing.

Not really. Government is not Big Tech. This happens with accounts of some tech companies precisely because they're private entities setting their own rules in the still wild "wild west" of the Internet. Governments set laws and processes to ensure the things you mentioned do not happen, except in very specific circumstances.

Think of it this way: being "locked out of life completely", resulting in "no banking, no traveling, no communication", etc. is not a new problem. In the off-line world we call that being sanctioned, imprisoned, deprived of personal freedoms, etc. Yes, it happens to some people, but usually for very specific reasons (called "crimes"), after a lengthy bureaucratic process (called "trial" and "sentencing"), with plenty of safeguards to catch and rectify mistakes during and after the fact (like "legal defenses", "appeals", or even "journalists"). It is not something you normally worry about.

Humanity has worked out best practices for these thing over thousands of years of various tribes and nations and governments forming, disbanding, collapsing, emerging, conquering or becoming conquered. Adding electronic IDs on top does not change the nature of the thing. So you won't get locked out of life for posting the wrong emoji in a tax report comment; that would be like being thrown to prison for drawing something on a government form - or rather, if that's even remotely possible in your country, you have much bigger problems than digital IDs, and your best move would be to emigrate somewhere sane before borders close or civil war starts.

Plenty of other things to worry about here (e.g. ID checks suddenly being required by every business, just because it's zero effort to them for some marginal KYC benefit), but getting banned from life due to ToS violation is not one of them.

Being banned from life due to a TOS violation is a real concern because it's already hard to do a bunch of things without a Google or Apple account. If Google and Apple can require a government ID to create such an account, it becomes very difficult to evade a ban.

Options to get around that problem include regulating Apple and Google or mandating that essential services not require accounts with third-party providers.

> Options to get around that problem include regulating Apple and Google or mandating that essential services not require accounts with third-party providers.

I would call for both of these things, for independent reasons.

All providers who get relied on in this way should need suitable regulation, even for non-essential things like supermarket loyalty cards.

Apple and Google in particular are now too heavily associated with a government hostile to the EU, therefore the EU should as a matter of urgency ensure that essential services do not require them in particular, and the surest way to do so (and make sure no shenanigans happen with mergers) would be to mandate that essential services do not require accounts with any third-party providers. Not even the postal system or a telephone number, you should always have a viable fallback to some physical office which is open at reasonable hours and is in a reasonably accessible location.

In both Canada and the US we had people who were "de-banked" in recent years because the government was irritated with them. No trial. No hearing. Just a letter from the bank saying "We don't want your business anymore. Here's a cashier's check with your balance." In Canada at least some of the accounts were actually frozen. "Yes, we have your money, but no you can't have any of it."

In the US there's a requirement for banks to refuse to do business with anyone who would be a "reputational risk". I think it was intended to suppress money laundering. Anyway, when the government calls and says such and such a client represents a reputational risk, the bank doesn't have any choice.

I don't know how it works in other countries, but here in the US you'd be hard pressed to function normally in society without a credit card and bank account.

The worry is not, that tomorrow you will be locked out of life. The worry is, that it will happen gradually, over maybe 20, 30 years.

As always when information exists digitally and can be processed rather easily, there is a strong temptation to misuse it out of its original purpose. As always there is a high risk of information leaking at some point, especially when in the not that capable hands of big organizations and governments.

The worry is also the drift towards disabling people's IDs for even on of the things the GP listed, at some point for any reason. The one with the bank account for example seems not too unlikely. Say at some point they associate financial information with that id. Banks demand insight on this data on grounds of wanting to grant loans only to people with good history. Later on they don't even want to give you a bank account when you ask, because there is no gain in it for them, because your accounts in the past tended to not have a positive balance and maybe at some point you had solvency issues. Try getting a flat to live in without bank account. Try getting a job without bank account.

The point is, that while governments are not big tech, they are also not tiny friendly grandma Emma's village shop. There are still lots of incentives to misuse and mismanage data, while at the same time governments often do not pay competitive salaries as businesses and often attract a certain kind of people working with your data.

Also keep in mind, that so far basically every such system that was implemented in countries like Germany had severe security holes. Just read up on the "elektronische Patientenakte" for example, or the CCC and the initial eID security issues. Trust has been eroded so far, it is at level zero for the government to get such a thing done right.

They already do this. KYC, and similar laws. You can't open a bank account in 2026 (at least in the USA) without ID. You can't get credit, open an investment account, buy a house, vote, or be employed without an ID.

A proper digital ID would eliminate a lot of problems we now have with identity theft, having to obsessively protect names, dates of birth, SSNs in our databases (these things were not considered secrets in the pre-internet era).

Yes, we need to be vigilant about freedoms and privacy. But the idea of a government-issued ID that "proves" who you are is not new and I struggle to think of any way identity can be "proven" without a central issuing authority.

A proper digital ID would certainly make things more difficult for thieves, but if someone actually did manage to clone your ID you'd be in a world of hurt, since businesses would start to trust that ID to a greater extent than they trust anything online now.

But governments would be obliged to ensure that wouldn't happen and fix it if it did. We trust them to do the same for passports etc and it works fairly well.

There's quite a bit less incentive to clone a passport, though. A guy in Pakistan can't clone my passport and use it to clean out my bank account.

>The problem is what follows

Does it actually follow? It's there for 25 years in some European countries and "everyone" isn't on a government bad list dying of hunger.

Not sure if that sarcasm or you are serious. But yes, people have issues with access to banking in EU all the time.

I heard stories about banks (mostly the app ones) closing accounts for "no reason" (there is always a reason and it's mostly quite simple), but I haven't heard stories about accounts being refused to be opened or clsoed for not having a digital id. And double so for this happening because the government put them on a list.

The government of course can put you on the list, but they don't need digital id for that. They pass a law, the regulator sends the list to all the banks and boom, you are blocked. I guess we should not have banks or not have the government too.

This is the way.

> just as we should disallow removing citizenship.

However lots of countries do allow removing citizenship In the UK it is a political decision too. Lots of countries allow locking people out of other things (e.g. freezing bank accounts). I therefore doubt we an effectively prevent this.

I do not see the problem with physical tokens. They are simple, do not create a single point of failure (if I lose my phone I still have my cards and cash), robust to network and systems failures. What is the drawback? Having to carry a few cards?

The drawback of physical tokens is that you can't use them online. I don't want to spend an hour waiting in queue at the city hall for something I can do online in 10 minutes.

The ideal state is having both physical and digital ID. But that will lead to a slow erosion of the willingness to carry physical ID, even if it stays available (which I believe it will for many decades. Even if national ID cards and drivers licenses were to go digital only, passports won't)

I use credit cards online all the time. I have logins for government services so I do not need to queue (I had to verify my ID using an app once for one of them). Getting a new driving license (for a change of address) was done online.

But you CAN use them online. Smart card readers are nothing new, and quite cheap.

Yes and I find this deeply wrong - what politician would you trust with this decision? Debanking is also wrong in my view.

I think we should focus on laws against things like that which lead to tyranny rather than attempting to stop progress.

Cash in particular is expensive to produce/process and no longer honours the promise printed on it, it will be phased out as the transactions with it approach 0%.

Cards are really no different than a token in a phone and don’t work for long either in the absence of a network (both will work offline but do need to be reconciled). I haven’t habitually carried a card in about a decade, I think for similar reasons to cash they will die off by general consensus.

Cards are significantly different from a token in a phone:

1. They are physically separate. They are not likely to be stolen at the same time as a phone. 2. They do not require battery.

Cash has the same advantages, but even more so as it does not rely on networks at all.

If you only have phones as a means of payment what do you do if you phone is lost, stolen or out of battery? How do you even buy a new phone!?

I think phasing out cash is very short sighted. It is robust and reliable. There is a good reason the Swedish central bank recently recommended that people keep a certain amount of cash at home (1,000 SEK, equivalent to about £80/$108/94 EUR, per adult).

Actually, there is a good point in this: What if I don't want to carry my phone somewhere? I shouldn't be obligated to do so. For example what if I want to go to a demo? Or I simply don't want to be location tracked for an afternoon. There needs to be a non-electronic alternative. I guess we could carry some QR codes with us, that can be scanned by police officers.

I think even digital IDs will tend to exist as physical tokens? Also worth noting that you can have a digitized and cryptographically signed ID on "paper" which can serve much the same purpose (security, machine readability) as an electronic one. Where electronic tokens shine (for IDs or otherwise) is attesting to the physical possession of a single copy.

Many EU countries already issue a chipcard IDs which can be used to auth for government services (via NFC or a dedicated reader).

So yeah, I'd expect those to move to a phone as an alternative to the card

This is not the same. For instance, we can access the internet without needing that ID. But right now there are attempts to force a digital ID in order to access information on the www - this is the whole idea behind "age verification". The kids are just used as excuse here. It has never been about the kids.

I think you're jumping to conclusions that aren't supported by the digital ID proposal.

Even with that: There's plenty of services dangerous to kids that we gate behind an ID check and I don't particularly see why internet is special in any way.

You think bad actors are going to plainly spell out their nefarious intentions? Or worse, the misinformed reactionaries that genuinely believe they're doing good.

No one claimed the internet should receive special treatment. The two forms of ID check that you're attempting to equate aren't the same.

Most passports in post 9/11 world have a chip. Thanks America!

I don’t see why they would bother with physical tokens nor would they be popular - things like passports are really quite expensive to manage and largely unecessary these days. An app or identity on people’s phone might be a good stopgap.

However I suspect biometric methods of id verification will render carrying anything redundant long term.

The databases for digital id already exist, they’re just not fully utilised yet and these databases will always be centralised.

I doubt everyone will still be carrying phones as we know them in a decade, so we might indeed be headed for a future where governments keep giant databases of biometric information. Works OK if you trust your government to handle that properly and not abuse it in the future. The real headache is crossing borders, where your details end up in the hands of a foreign state.

What? What to replace the phones with? And why whatever replaces them wouldn't be able to do the same things?

> so we might indeed be headed for a future where governments keep giant databases of biometric information

Don't want to wake you from that nice dream but that ship has sailed quite a while back, at least here in the EU.

We are already in that future and have been for at least a decade. Passports contain biometrics which are in a central db too.

Biometrics are usernames at best not passwords.

I don’t see why they would bother with physical tokens nor would they be popular - things like passports are really quite expensive to manage and largely unecessary these days.

OK. I'll bite. Why are they unnecessary?

Passports have two things. They have information on them, which can be read by looking at them. And they have information on them in chip form, which can be scanned, and is also cryptographically signed by the issuing authority (eg, a government).

To verify a passport you can look at it visually, but you can also scan and validate the info, including photo, in digital form. All you need is the CSCA, the 'country signing certificate' to do so, and there aren't may of those. Small readers exist which are updated with these certs, and so even in the middle of a war zone, with RF jamming, you can verify a country signed what you're looking at.

Relying upon the Internet being there for ID purposes is a massive fail. You'd don't need a networked reachable database to validate that your ID is valid, in a digital way, which can be really helpful with 1M refugees show up at your door during a war, or when the capital city of the issuing nation has been bombed.

You may think this unimportant, but the edge cases are what 99.999% uptime is all about. And the edge cases with ID really need 100% uptime. The last thing you need during a natural disaster is an inability to ... well, do anything.

So even if you have biometric methods to identify someone, you'll also want a local, on person method which has those on chip, and signed by a government saying who you are.

Having ID network connected is also a massive, huge, immense fail. There should be no network connected databases of anything about anyone, in any form. Why? It'll be hacked. This will never, ever, ever change. Never. Paper records can't be hacked en masse, and you can get the same protections by storing records on individual chips with other associated info in paper form.

Dismantling this infrastructure and replacing it with buggy, hackable, online databases just to get digital ID verification is a complete move in the wrong direction. Verifying digitally signed information is not.

And passports can be scanned by phones.

Which means that the info, cryptographically signed, can be verified by anyone in the world too.

Really, what we need is to have everyone chipped, like a pet. Because that's where this ends up, and that's also the only way to always have your ID with you.

As a snarky aside, I've spent my entire life interacting with society all the time, yet only in the last decade has it been necessary to be "carded" constantly to do so. We've literally taken a privacy conscious society, and turned it into a nightmare. I'm identified when I go buy a loaf of bread, the most dystopian, totalitarian government anyone could ever conceive of, is a joke compared to the amount of control and tracking now exercised over people's lives.

So I guess my point is...

If it's annoying and difficult to have to carry around a physical identifier of who you are? And use it regularly?

Why is the solution to make it easier to submit to slavery?

Think that's an over the top statement?

We all know how the US government has pivoted on many things during the current administration. We also know it has had, and continues to have (via private enterprise) a robust degree of information about every fiscal transaction made.

If you look at the McCarthy hearings, they literally went so far as to find documents from decades prior, paper records of course, of people joining socialist clubs in university. Eg, simply sign-in sheets, or their names listed in the minutes of such orgs.

Decades later, that information was used to blacklist careers, destroy lives, not for any proof of malfeasance by those accused, but simply because they were curious in college about socialism.

Those same accused were then used to "name names".

My point is, from the financial data currently being stored about people, anything that makes you stand out in any way could be turned into a problem 10 years down the road. Not to mention, how credit card usage, and digital tracking, and location tracking might hit some pattern.

No one who lived through the McCarthy hearings, just watching them, or lived through how Germany or Russia controlled the lives of their citizens, would ever think any of this increased fingerprint of people is a good idea.

It's all just very dumb. And it will not end well at all.

> Relying upon the Internet being there for ID purposes is a massive fail.

Why would you need internet? Document holder smartphone can cache the document for years and present it over NFC (including photo, signature, etc). Just like existing biometric passports work, but replace the physical passport with smartphone app.

To check against $your-local-law-enforcement-agency database, $your-local-immigration-agency for history of entry, etc.

The internet requirement is not there for the person presenting the document, it's for the person/system checking it.

System checking it just verifies the signature is valid and thus all data presented is valid? Your browser doesn't need to query any Root CAs to trust SSL certificate, https works without internet.

History of entry and visas/etc could be stored on device as well

If you want to argue for a theoretical system that is self-contained, only relies on the data that is present on either the physical (or the theoretical cryptographically signed digital) passport, you're free to do that.

But in the real world, the systems that deal with processing people's entries already cross-reference multiple other existing databases, require internet connectivity to do so, and I think you'll have hard time convincing anyone to stop doing that.

They check opportunistically but they are capable of operating without doing so.

This is not how the world already works.

If CBP's systems go down, they will not process (foreign, they'll process US citizens still) arrivals [1], even with physical passports in front of them. I assume the EU ESS works the same.

"If the internet goes down, your border checkpoint is down" is not some terrifying future we need to protect against, it's the reality of the world as you live in right now.

[1]: I've had to wait for an hour, at SFO of all places, because of exactly that happening.

TBF given that a temporary outage is abnormal it makes a certain amount of sense to default to shutting down. Whereas during an extended outage you can pick back up as long as the key parts of your system are capable of operating without the network.

— There should be no network connected databases of anything about anyone, in any form.

Couldn't agree more. The more we know, the more susceptible we are to bias and division.

For one thing, it increases resilience in the event of outages. It is a tangible aspect - just like citizens are encouraged to keep cash at home at least in my country (Sweden)

Does it though? Our world is now so networked that borders shut down if the network is down - see other responses on this thread.

Inevitable indeed. Rabbit hole ahead. UE has been for many years the way to prevent "controlling what governments can do with them". https://escapekey.substack.com/p/europe-goes-full-digital

> for example disallowing blocking/removing someone’s id

If I lose my passport I am obliged to call the police so that they revoke it, if I lose my phone with my digital ID on it they also need to be able to revoke that ID.

Sure, I meant disabling without replacement, making someone an unperson. Obviously updates and replacements would be required as with passports.

I don’t think governments should be allowed to do that. They do it with passports and I think it’s deeply wrong but also it would be far more damaging and immediate with a digital id (which will inevitably be used for a lot of services) - similar to being refused a bank account.

I don't see it as inevitable at any stage. Why would it be necessary? Why is access to information tied to a digital id suddenly? Also, where is digital currency inscapable? I can not pay with a bank note suddenly?

> Physical tokens like bank cards and driving licenses are neither necessary nor a good solution in a networked world.

I see absolutely nothing wrong with physical tokens. You could reason that this or that has more or fewer advantages but to insinuate that digital is always better, all of the time, is simply wrong.

> I can not pay with a bank note suddenly?

In some places you cannot. I was in London post-COVID and there were a bunch of tourist things, like a riverboat on the Thames, where you could only pay with a card. Went to a craft cider bar out in the countryside and again, they didn’t accept cash. Personally, I think businesses should be forced to accept all legal tender, which means cash stays as a first class payment method, but that’s not how it is in many places.

On the other hand, in Austria there are many places that are cash only, especially small restaurants in the countryside or community sporting events with coffee bars.

How beautifully naive. When was the last time you controlled the government? This idea, that we just trust the government to be good, and that it listens to the voters needs to die.

The government should always be assumed to be evil, and work towards complete and ultimate power. It is a cancer that spreads.

Therefore decentralization, and a private libertarian society, is the only ethical and long term sustainable society possible. Every other society, eventually collapses into authoritarianism and the burning of the jews.

Reply on news.ycombinator.com