Hacker News Reader

Comment by acqq | Hacker News Reader

"To wit: our digital world doesn’t have a good system for identifying us, or helping others confirm that we are who we say we are. Because no one has solved this problem, we all live in dune-drifts of lousy passwords."

No. It's that we don't want to have the equivalent to "certificate authorities" mess for our identities too. We don't want the "obvious" "solutions" because we are aware of the bad effects of them.

View on HN

Not to mention that there are a lot of good reasons that someone should remain anonymous when they're online.

A solution for identity doesn't necessarily imply a lack of anonymity on the entire internet.

It sure would be nice to not have to update so many payment details after a card number gets stoken though.

Last time my card was stolen I had to update a tremendous number of services. Usually I just wait until I get some sort of notice or my account stops working somewhere but it's a pain in the butt.

The reason the new number is issued depends on the update procedure being non-trivial and hopefully less broad than the last time. Otherwise, they'd just let you continue using the same one. That's the most convenient solution.

> A solution for identity doesn't necessarily imply a lack of anonymity on the entire internet.

Are you sure it's possible to have a solution with all requirements the article specifies yet without infringing on anonymity?

A bunch of solutions I'm thinking about suffer from one or more shortcomings.

Why wouldn't you be able to use your theoretical identity card only where you wanted? I don't show my id when I buy toilet paper, and neither would I to post on reddit.

While this might be contentious on HN - I wish Facebook would just follow Keybase.io's lead and give everyone a generated public/private key pair. Users that wish to can upload their own public key (FB recently implemented this part) while all other users would just have their private key generated by FB and saved by FB encrypted.

Then create an API so third parties can use FB as a public key server for baking encryption into applications. Doing this you get identity and encryption for free. While identity guarantees aren't quite as good as Keybase's tracking mechanism it's decent since FB accounts can be verified with lots of friends/connections and it's way better than the fantasy of key-signing parties taking over.

As a bonus over a seventh of the earth is already on FB and that's including everyone who doesn't have internet access. I wouldn't be surprised if it was nearly half of all internet users. Plus it seems like it wouldn't be that hard to implement, but maybe I'm underestimating the complexity.

Seems like it'd be a big win for encryption and PGP.

Do you by any chance have the idea how much Facebook (and Google, and, and) already tracks you on the internet?

"What could possibly go wrong?"

Not sure how that's relevant - it's a platform and a very widely accepted one. It'd be a very convenient keyserver for third party applications (or really everyone).

If you're worried about them holding your private key then you could generate your pair locally and only upload your public one.

Actually, I don't want having to use Facebook for anything. Or any other big site or company. From all the companies, the internet provider can "know" the most about me, but I wouldn't even like them doing more than they are already doing.

Google is certainly the second "omniknowing," and I'm not happy with that too. And I don't use Facebook.

Yeah, the prologue to this was an example about credit card fraud. It seems like by far the weakest link is the poor security around credit card numbers.

Chip and pin is a highly regarded approach to securing CC #s. Maybe to secure web logins, everyone should pony up for one of those rsa [the company] SecureID dongles that generates identifiers

http://stackoverflow.com/questions/8340495/how-does-rsa-toke...

Credit card fraud detection is actually the "good working system." The author complains that he has to enter the new one on all the sites he uses. Well duh, the reason he got the new cc number is that only the vendors he really needs get the new one. And he complains that the sites don't know that "it's he" so he has to write down the passwords to which I answered that the alternatives are central authorities and they appear to be the worse solution than the problem.

Is there anybody here who'd like that Google or Facebook or Microsoft or Verisign or the government opens all the sites he visits? The named entities would be happy, it seems.

I remember when Microsoft first suggested single signon for the Internet (Passport) and everybody on Slashdot had their pitchforks out and started writing long screeds against giving a single company so much aggregate data about their browsing habits.

Yes, I remember that I was almost scared as I imagined how wrong it can go. I remember being on some MS organized conference then, even the attendees there, you know, at that time every new technology from MS was cheered by default, were highly skeptical. The guy on the stage wanted to "sell" it, he even did something like "who trusts MS" and raised the hand, an almost nobody followed him. Then he said "I trust them, because, why would they not be straight?" Really.

I don't want a central authority, but CC fraud is still $6 billion annually. Why not build a chip reader into devices?

http://www.statisticbrain.com/credit-card-fraud-statistics/

It's an awfully quaint notion that you should be able to take money from someone's account (credit/debit/checking/etc.) just by knowing the account numbers. This unauthenticated, default-trusting system needs to be entirely replaced.

Probably, authentication will be solved by Apple's fingerprint-reading phone, or the iwatch. They have to use that mechanism anyway for the iWallet (or whatever it is called).

Solving the problem for the elite that can afford to spend ungodly amounts of money (by global standards) on a smartwatch is not really solving it.

Reply on news.ycombinator.com