Hacker News Reader

Comment by xvilka | Hacker News Reader

The original idea for the ID verification was broken by design anyway. The only safe and secure way is a chain/tree of trust, e.g. with PKI, where you could generate some certificate just for that particular service, while keeping your root key safe. Then, in the case of leak, the most you lose, is one particular key for one particular service that could be immediately revoked. You could even slap zero-knowledge proofs for particular properties (e.g. if the person has a driver license or not) without de-anonymizing the account. In the rare even of root key leak you should be able to physically go to the authority and make a new one, while revoking the old key. I don't see any other better alternatives than this.

View on HN

This is effectively the EU age verification system.

Your government (which already has all your details) generates certificates and you just give those out. The other side can the use simple public/private key verification to ensure the cert is valid. Also government does not get information who you gave the cert to and if you create a bunch and single use them the other side can’t follow you between uses using the certs.

The EU age verification system requires tying yourself to Google/Apple [0] (ie will not work with GrapheneOS) which is a non-starter. This means you will need a mandatory Google/Apple account. What if your Google account gets banned?

[0] https://github.com/eu-digital-identity-wallet/av-doc-technic...

My Google account is in good standing but has other issues. In between startups and side projects I cannot link my phone number as it has been used "too many times". So apparently, to Google, if I want a new account or to set this up, I need a new phone number. Enquiries to support have gone as well as you'd expect with Google.

I have a gradfathered account from before Google Workspaces or whatever its name (Google Apps for Domains?) became a paid service, and it's in an extremely weird state after so many changes to what Google offers, integrates, fixes and unfixes, that I sometimes can't even login to Google services.

Ended up moving my mail and info from Google away, just not to deal with it.

The problem in the US is that the government doesn't necessarily have all of your details. Most people's ID is a driver's license, but you're not mandated to have one of those. The federal government doesn't control those databases (hi, REAL ID), and few people actually have passports. Your citizenship documents are just a birth certificate that is an image on file with a particular state's health department. A centralized identification system on that scale in the US would take generations to get up and running

> A centralized identification system on that scale in the US would take generations to get up and running

Cultural pushback has so far prevented such a system from being created. I hope that continues but am not optimistic.

And then there's the problem of undocummented / illegal immigrants that the US has, which nevertheless can often get some state services and have enough ID to pass by. Because it's a political issue, nobody can either legalize or deport them without getting into the political quagmire that is immigration reform.

In functioning ID systems (and not having or wanting one is a valid political position which both the US and the UK took) this is not an issue.

I live in Poland, and we force rotating IDs on a (staggered) 10-year schedule, just so we can slowly upgrade them and introduce new features like these.

I'm not quite sure what immigration has to do with a national ID system in the US. Seems like you just wanted to bring that up to be able to say "man that'd be so much easier if you got rid of all the immigrants" which it would have no impact either way on this particular issue

Also on the rotating schedule thing, driver's licenses expire in the US, usually on a 5-10 year cadence. Replacing the physical cards was not even remotely close to the issue we had with getting REAL ID implemented, the cards themselves aren't special they just have an extra indicator on them. It was about putting in requirements around new documentation and proof of identity, citizenship, and residence and most states not being ready to handle that

For example my home state of Alabama issues licenses through the state department of public safety. That's who does the initial test to see if you're fit to drive, etc. But, once you have it you can then renew your license at a city or county office. These offices take a HUGE burden off the state, but they're not qualified to do the verification needed under federal law for REAL ID. So, to get a compliant ID you'd need to go to one of the very few state offices and they were overwhelmed

This is the type of issue with the system in the US, not the physical card, not the big scary illegal immigrant problem

> I'm not quite sure what immigration has to do with a national ID system in the US.

It was explained right there in the comment. Illegal immigrants are often able to get services because the ID system is such a patchwork that they can manage to slip through the cracks.

And attempting to implement any sort of widespread centralized ID is going to be met with resistance not just from people such as myself but also from those who attempt to shield illegal aliens on the basis of opposing those who want to reduce immigration.

You do not need to be a documented US resident to get a driver's license, it is surprising anyone would expect that. Immigration is federal — the state only wants to know if you know how to drive. The state cares very little about your immigration status for almost all things.

We were talking about national versus state managed ID systems, not drivers licenses.

isn't the immigrant question a real obstacle for political change towards fixing this problem? That we would have to come to some kind of consensus on what to do for illegal immigrants

As long gangs are running the political discourse (anti-id, anti-flock, etc) - good luck in having functioning society. I say that as someone who just spent 3 months in Europe and witnessing farcical bureaucracy.

Hmm, so if you are anti-flock because you were disturbed by the girls swimming pool cameras being viewed hundreds of times by employees and cops, you are also a gang?

We are all supposed to be pro-perversion now too?

IDK seems opposite - these people are quick to summon simpsons meme if child protection is ever mentioned. Some are trying to protect their rights to delivering them mindwash porn and other sexual exploitation material that can’t even be mentioned in this forum without getting banned.

Don’t gangs almost always run political discourse?

>driver's licenses expire in the US, usually on a 5-10 year cadence

Standard Arizona drivers licenses only expire when the licensee turns 65 years of age, and must be renewed every 5 years thereafter.

You don't have to update your picture? You can be wandering around using a 40 year old ID card? That doesn't sound right.

The photograph does have its own expiration timeline, which is not printed on the card. So yes, it was a little surprising to receive that letter, calling me into the office for another photo shoot.

> which is not printed on the card

So what happens if you just don't show up?

I don’t really trust anyone to get PKI right. There’s enough mistakes in the www realm that pretty well prove bad actors will get through.

The alternative is do it offline.

eID PKIs have very little in common with the web PKI. There's a national root of trust with strong attestation. It's a very simple trust relationship. You already trust the respective government to issue IDs.

Plenty of European countries have an eID CAs and it works fine. The PKI part is a solved problem.

Doesn't even need ZKP, the CA can just issue an attestation.

I've experienced this "solved problem" when visiting Germany during COVID. On every entrance to a mall there was somebody with a scanner device, and they only let you in if the scanner showed a green mark. I've been fully vaccinated (not EU) but my code didn't show a green mark on their scanner and I was promptly denied entry. The solution was to show them my German friend's code on my phone, this registered just fine, so I could enter anywhere.

So the whole "eID/CAs/ZKP/PKI" mumbo jumbo can be easily fooled by a gif file.

That part seems to qualify as an unsolved problem. But could anyone have taken the scanned data (or the GIF file) and used it to open a bank account in your friend's name? That seems like the main issue that is genuinely solved by correct implementation of this type of system.

Already today nobody can open a bank account in my name with just a picture of my passport, as the original would be required. My passport doesn't have any of the "eID/CAs/ZKP/PKI", so the question of "what exactly the addition of it solves" remains open.

My national ID card supposedly has some of it, the 17-year olds who want to pass as 18-year olds usually show a doctored gif file of their ID card, with a year of birth one or two years before the actual one; this works in ~98% of the cases.

Actually it does. Biometric passports (and IDs) have a chip which is read via NFC and the information the NFC provides is signed by a CA which is the government that issued the passport. ICAO compiles a database of public keys corresponding to each government (plus countries exchange their public keys via bilateral agreements). Unless somebody is doing purely visual inspection, any time a passport is scanned there's PKI involved to validate if the information is genuine.

None of that applies to my (non-biometric) passport, and we were talking about banks that don't have the passport-reading equipment to begin with.

That’s not what the new schemes are about, and they aren’t going to be based on a qr code you can just copy, no.

If you’re genuinely interested, look into things like OpenID credentials systems, and similar standards like w3c verifiable credentials.

yes, just as age verification can be fooled by an older friend who gets the check mark.

Reminds me of

   If you think cryptography can solve your problem, you don’t understand your problem and you don’t understand cryptography.

(Bruce Schneier dug into origins of this here: https://www.schneier.com/blog/archives/2026/05/laurie-anders...)

If the scan also included a picture, that was signed with your private key, then it would be harder to spoof.

Not really, the attacker would just need a picture of you which he could then sign (since we're assuming here that he gained access to your key IIUC). That's a pretty low bar compared to the first step of gaining the key.

You’re conflating the real life need of ID, with trust in the organisation.

Sorry. Wrong.

or just not ask for it at all.

The three times I've needed to provide a scan of my passport were: to enroll in a university course, to buy from an e-commerce site, and to become an app developer. None of those orgs really needed a scan of my passport, which can't be revoked like a cracked password, and will now sit unencrypted somewhere until the end of time or until they are hacked and subsequently shamed into handling their customers data more like radioactive waste.

The only times I had to provide a scan of my passport was to cross a border:

    - get a VISA to be allowed to cross the border
    - send to the airline for my flight that will cross the border
    - show the real passport at the border

I have another ID for authentication inside my country, which by the way, is not a driving license (which is used only for car driving usage).

I sold a house recently, my lawyer/solicitor who’s physically known me for 6+ years had to scan my passport & licence to “verify” me according to new AML laws.

KYC & AML is poison.

Edit: to be clear, this lawyer also represented me when I bought said property.

In my experience, hotels in other countries also take a copy of the passports of all guests.

Also learned “know your customer” laws require US people to give passport + SSN to a foreign bank who then reports it back to the US. Given that such bank’s website involves disabling right-click for “security”, the only glimmer of hope is that the data is catastrophically lost due to stupidity before it can be compromised.

The US Government is one of the reference implementations of PKI.

Unfortunately, IDs are issued 50 different ways by the less competent states.

Combine that with accusations that getting new IDs constitutes systematic racism (a widely held belief on HN), ignoring that the ruralest of India has been able to do this successfully, and you're not getting digital ID any time soon.

IDs being required for voting is essentially a poll tax the way that it's argued for in the US. There's a minimum amount you have to spend to even get one that will expire in a certain amount of years.

That's also assuming you can get all the documents you need for the initial ID. If you don't already have all the essential documents you'll need multiple appointments at government facilities. The local social security office usually has just one location. Mine required time off from work because they were open from 10 till 4 four days a week. This was just part of the process to get an ID for a child when we only had a copy of a couple documents instead of the originals.

Getting an ID for my grandma who made the mistake of being born black in the rural South during Jim Crow was a year long process, since she didn't even have originals of most of the documents. It took that long and was handled by one of her children that was a lawyer. For her we were getting an ID so the family could take her traveling, years before it was turned into a political issue to disenfranchise people.

Nobody arguing for the ID laws ever argues for raising their taxes for an ID that all citizens are guaranteed with the supporting infrastructure. They're arguing for it because they know people they don't want to vote will have trouble getting one

So… requiring an ID to buy a gun is also an unconstitutional tax on a right?

Taxes on guns are completely constitutional. The 24th amendment explicitly outlaws poll taxes.

"The right of citizens of the United States to vote in any primary or other election for President or Vice President, for electors for President or Vice President, or for Senator or Representative in Congress, shall not be denied or abridged by the United States or any State by reason of failure to lay pill tax or other tax" - 24th amendment to the United States Constitution

It’s not a tax on the gun though. It’s a tax to exercise the right, identical to the poll tax.

Yes, it is.

Agreed, but I like that the “requiring ID is racist but only in the USA” crowd doesn’t like the direct relation.

Hey, you know what...

The difficulty for the US is people seem to be against a Federal Government ID. India doesn't seem to have this stigma and hence rural India can solve this problem.

I don't think people are against it, we already have the social security identifiers as a government layer... it's just that no one in the government is willing to do it for free in a way that is accessible to everyone

> I don't think people are against it

Every time national ID gets moderately serious discussion it is revealed very clearly that yes, the people are against it.

RealID—which was simply national standardization of state issued ID (when used for a variety of important purposes) had intense resistance, too—and its the closest policy to national ID that has passed.

Social Security identifiers are not ID for the person, and anyway were adopted nearly a century ago at a moment of higher-than-current trust in the federal government.

It would help if the federal government didn’t show itself to abuse ID databases every time it gets ahold of one.

I don’t see how we could develop a national ID in an environment of such low trust (bidirectionally). You need a government that’s responsive to citizens and obeys constitutional guardrails, and citizens who trust the government to protect their best interests. We haven’t had that since the prior century (and last century the government was still breaking our trust, it just didn’t make the news).

People are against national IDs because of privacy, not racism like a previous comment in this thread suggested

People are against requiring certain types of IDs to vote as racism or other forms of voter suppression because it may cost money to get those IDs or be very very hard to do so, when there are other methods to authenticate a person for voting

Those are two separate issues and complaints.

Just to add a bit. In a few different places in the US I've had multiple ID offices within easy driving (or bus) distance and wait times ranged from short to annoying but bearable.

When I lived near the ghetto in a different state I had roughly 2 choices, one 30 minutes out and the other over an hour (by car without traffic). Bus? Hah! Have fun. Arriving at the nearer of the two within an hour or so of opening in the morning there was already a multi-hour line for service.

Don't worry though, there's definitely not any sort of institutional racism behind the various efforts to require certain forms of ID to vote. /s

before you could get a social security card replaced online I lived in a poor area and getting a replacement took most of the day between getting there and sitting in an awful waiting room for hours... god forbid you forgot something or they rejected your proof of identity and you had to do it all over again

real id is also a massive pain in the ass, which is probably the bigger issue

give people a moderate benefit to do it, like a tax credit, and I think you'll find the majority of people hold their beliefs not so rigidly

I think this is the horse shoe theory where the far left and right are against it. https://www.aclu.org/press-releases/aclu-conservative-and-li...

I know people who don't have a social security number because their parents didn't want them to be tracked by the system.

Do they live in the woods? How do they work and pay taxes?

Yes, very rural place or the woods. No idea about taxes, etc. I remember him explaining that you only need a SSN if you want to receive it and a diatribe about the mark of the beast.

When the guy was trying to get a passport, he asked if anyone could show a picture of him from our high school yearbook.

America has a substantial fundamentalist christian population who was handed a conspiracy theory about ID cards being a sign of the antichrist as depicted in Revelations decades ago and just will maintain that conspiracy theory for eternity.

The minimum size of this population, people who are adamant that the world is 10k years old, that god created everything as it currently is within those past 10k years, and therefore that all of science is a conspiracy in league with satan to deceive you from god, is about 30 million people. That's the percentage of Americans that willingly state such a belief when an alternative survey option is "Earth is old but god is still real and meaningful and doing everything" ie the current Catholic Dogma.

That exact same cohort is the singular reason for the Satanic Panic back in the 80s, for every child that "wasn't allowed" to participate in Halloween, for kids that weren't allowed to read Harry Potter because it "promoted witchcraft". These people insist we are in a constant and active war against actual physical demons that have infiltrated much of society. They believe they are losing this "war". They believe they are following God's orders. They believe anything is permissible in this war

That's not a conspiracy theory. It's a cautionary tale in the same vein as Don't Create the Torment Nexus. Some people proceed to take it overly literally and engage in wild fantasy (ironic considering the typical views of that population on things like D&D).

It is a problem for millions of Americans: https://voteriders.org/article/who-doesnt-have-an-id-in-amer...

Systemic racism is very much a thing, and while perhaps not foundational in this particular issue, we see still see political fuckery that definitely targets by race: https://www.nbcnews.com/politics/2026-election/tarrant-count...

"India does it!" is not the absolute proof of a lack of racism that you believe it is.

For multiple reasons.

every application packet for a US National Security clearance for twenty years, was stolen in bulk, by Chinese agents. Your characterization of the perfection of US Federal data management appears to be lacking nuance.

While that can certainly be true it is still generally safer than username/password for authentication.

> the most you lose

Yep that's the only thing you lose, apart from a huge number of literal images of kids in the hands of literal criminals.

> I don't see any other better alternatives

Not doing age verification!

age verification is the current mandate of multiple governments, not doing it for many services means shutting down

I don't mean the services I mean the governments.

That sounds like this prediction from 2003

https://www.fourmilab.ch/documents/digital-imprimatur/#SI_an...

Passkey?

I think with passkey you don't own the private key. It's in your device and managed by the OS. That's one of the reasons I don't use passkeys (the other being that if I lose the device I can't access my account)

Yes, you can. Either you can physically own the key on the physical device (i.e. Yubikey/Google Titan/HSM) or you can use software (KeepassXC, Bitwarden).

Most operating systems and browsers come with a sync mechanism that many people default to, but it's no more than that: the default.

As for account recovery, most websites have a way to recover your account when you lose your password, there's no reason why that wouldn't work for passkeys. Every website with passkey access I've used so far makes passkeys optional and forces you to set a password already. If they switch their default to passkeys and add a password as an optional step, nothing would change.

> Most operating systems and browsers come with a sync mechanism that many people default to, but it's no more than that: the default.

Assuming the FIDO Consortium approves. Otherwise you might be like KeePass, being unceremoniously threatened with revocation of attestation, for offering to do what the big players are able to do.

There are even open source hardware passkeys (NitroKey) so you can have security with freedom.

My passkey is synched with iCloud which has all hardened settings set to on, so if I switch devices (I have) its seamlessly. You can also export Passkeys is my understanding but I have not tried it.

When I'm on non-Apple I can scan a QR code on my phone and it will validate it the same way, using bluetooth to send enough info to the target computer to get me logged on.

Bluetooth is actually only used to establish proximity. Both your phone and the browser connect to an internet relay, which lets the phone essentially pretend to be a USB security key connected to the computer.

> think with passkey you don't own the private key. It's in your device and managed by the OS. That's one of the reasons I don't use passkeys (the other being that if I lose the device I can't access my account)

It is not true. You can move passkeys between OSs if you have a password manager or an OS that has this ability. For example, I store my Passkeys in iCloud Keychain and I have them synced on all my Apple devices.

There are cases though, where the website can force the requirement of a device bound passkey, but that is something it is not very likely you will encounter.

I have considered making a website that specifically enforces the use of a hardware passkey such as a yubikey since you can verify that it it is a real device signed by yubico meaning that if you want a bunch of users to come discuss a subject they are verified by means of having to purchase a physical key. Obviously, there is nothing stopping someone from buying a bunch of yubikeys but you can then ban said users with those yubikeys

But you don't own your passkey. That's the biggest red flag. It's yet another wall by apple to prevent you from leaving their ecosystem

I think the OS is needed to sign the challenge, but the private key can be taken wherever. And passkeys are multiplatform. Not Apple-only, by a long shot.

And I suspect that most geeks, hereabouts, could set up their own signing system.

My passkeys are in my self-hosted Vaultwarden. If I can't put them there, I don't use them.

It's not all sunshine and roses, though. Despite having Bitwarden set as the only passkey provider in my Android setup, the phone persistently only offers me Google. Which is empty, because as I said, I won't use one tied to things I can't control. Works great on desktops, though.

Passkeys can theoretically require you to be on hardware, I haven't found anything yet that requires that.

This sounds like a Bitwarden specific issue, because I don't have that problem with Proton.

More poking around suggests it is an Android 14 issue.

I think you can do passkeys wile having private key. When os has the private key its just more convenient way of doing passkey.

I think you can but it has to be supported by the website that you are using

I don´t think I've ever come across a service that only used passkeys. Username/email + password + 2FA is usually the primary form of verification. There's usually a way to recover your account through email.

Doesn't that defeat the purpose? I thought the objective was to get rid of passwords

I use passkeys only, for the backend admin app for my app.

They work fairly well. I use a login ID/PW to set up the passkey, then the passkey, for everything else.

Passkeys work well, but I feel as if they are still a bit too “fiddly” for your average mensch.

I’m pretty sure the private key is transferable, but Apple keeps them in the Keychain, so they seem locked into the OS. On my machine, I can also keep passkeys in 1Password.

A while back, I wrote up a series on implementing passkeys in iOS/MacOS: https://littlegreenviper.com/series/passkeys/

You can, with for example KeePassXC. But following passkey development it does seem that in time they will want Google or Apple to own your private key and for you to use it through them.

Reply on news.ycombinator.com