Google and Apple should be legally mandated to federate with nation state identity systems. This prevents them from revoking access, as the identity management is within nation state control vs big tech. You potentially have recourse with your government, you have no recourse with Google and Apple (current state). They may consume your identity for your benefit, but they may not control your digital identity. If a Big Tech company chooses to ban you, they should be required to provide you, at their cost, a copy of all of your data stored with them and report that they did so to a regulator.

I strongly doubt the US would mandate this, but could see the EU doing so. The technical primitives exist and implementation is straightforward. Without a law, this will not change, there is no incentive for it to change.

▲

subscribed an hour ago | parent | next [-]

> Google and Apple should be legally mandated to federate with nation state identity systems.

With which states?

I'm I'm a citizen of two and live in the third, potentially having eSIM of the fourth?

	▲	toomuchtodo an hour ago \| parent [-]
		The same states and countries they integrate with today for digital identity verification. If you have a passport, national ID card, or US state ID or driver's license, you have a government provided digital identity that can bound to and authenticated against. I'm probably missing a government credential in scope, but the backend database lookup is trivial. The US Login.gov idp is about to roll out identity attestation using your state issued government credential provisioned in your mobile wallet (mDL), for example. I can perform identity proofing and attestation with my digital driver's license and passport in my iPhone Wallet today (at a TSA or CBP checkpoint, for example). Why can I not login to Google and Apple with that identity? It is federated identity management fundementally. https://zendesk.login.gov/hc/en-us/articles/51945946704148-m... https://learn.wallet.apple/id https://wallet.google/intl/en_us/digitalid/

▲

PontifexMinimus 2 hours ago | parent | prev [-]

The way the EU could implement this is to mandate only using identity providers can guarantee they will not revoke people's identities, and the only way to make that guarantee watertight is to mandate only identity providers based within the EU.

	▲	toomuchtodo 2 hours ago \| parent [-]
		There are no guarantees unfortunately, just contracts (formal and informal) that can be broken and paths as to what happens when those contracts degrade or fail. Agree with you on mandating EU only idps for those who reside within the EU jurisdiction.