| ▲ | grebc 5 hours ago |
| I don’t really trust anyone to get PKI right. There’s enough mistakes in the www realm that pretty well prove bad actors will get through. The alternative is do it offline. |
|
| ▲ | lima 3 hours ago | parent | next [-] |
| eID PKIs have very little in common with the web PKI. There's a national root of trust with strong attestation. It's a very simple trust relationship. You already trust the respective government to issue IDs. Plenty of European countries have an eID CAs and it works fine. The PKI part is a solved problem. Doesn't even need ZKP, the CA can just issue an attestation. |
| |
| ▲ | grebc 41 minutes ago | parent | next [-] | | You’re conflating the real life need of ID, with trust in the organisation. Sorry. Wrong. | |
| ▲ | maratc 2 hours ago | parent | prev [-] | | I've experienced this "solved problem" when visiting Germany during COVID. On every entrance to a mall there was somebody with a scanner device, and they only let you in if the scanner showed a green mark. I've been fully vaccinated (not EU) but my code didn't show a green mark on their scanner and I was promptly denied entry. The solution was to show them my German friend's code on my phone, this registered just fine, so I could enter anywhere. So the whole "eID/CAs/ZKP/PKI" mumbo jumbo can be easily fooled by a gif file. | | |
| ▲ | benregenspan an hour ago | parent | next [-] | | That part seems to qualify as an unsolved problem. But could anyone have taken the scanned data (or the GIF file) and used it to open a bank account in your friend's name? That seems like the main issue that is genuinely solved by correct implementation of this type of system. | | |
| ▲ | maratc an hour ago | parent [-] | | Already today nobody can open a bank account in my name with just a picture of my passport, as the original would be required. My passport doesn't have any of the "eID/CAs/ZKP/PKI", so the question of "what exactly the addition of it solves" remains open. My national ID card supposedly has some of it, the 17-year olds who want to pass as 18-year olds usually show a doctored gif file of their ID card, with a year of birth one or two years before the actual one; this works in ~98% of the cases. |
| |
| ▲ | pas an hour ago | parent | prev [-] | | yes, just as age verification can be fooled by an older friend who gets the check mark. | | |
|
|
|
| ▲ | HlessClaudesman 2 hours ago | parent | prev | next [-] |
| or just not ask for it at all. The three times I've needed to provide a scan of my passport were: to enroll in a university course, to buy from an e-commerce site, and to become an app developer. None of those orgs really needed a scan of my passport, which can't be revoked like a cracked password, and will now sit unencrypted somewhere until the end of time or until they are hacked and subsequently shamed into handling their customers data more like radioactive waste. |
| |
| ▲ | BobbyTables2 6 minutes ago | parent | next [-] | | In my experience, hotels in other countries also take a copy of the passports of all guests. Also learned “know your customer” laws require US people to give passport + SSN to a foreign bank who then reports it back to the US. Given that such bank’s website involves disabling right-click for “security”, the only glimmer of hope is that the data is catastrophically lost due to stupidity before it can be compromised. | |
| ▲ | dolmen an hour ago | parent | prev [-] | | The only times I had to provide a scan of my passport was to cross a border: - get a VISA to be allowed to cross the border
- send to the airline for my flight that will cross the border
- show the real passport at the border
I have another ID for authentication inside my country, which by the way, is not a driving license (which is used only for car driving usage). |
|
|
| ▲ | martyfunkhouser 2 hours ago | parent | prev | next [-] |
| The US Government is one of the reference implementations of PKI. Unfortunately, IDs are issued 50 different ways by the less competent states. Combine that with accusations that getting new IDs constitutes systematic racism (a widely held belief on HN), ignoring that the ruralest of India has been able to do this successfully, and you're not getting digital ID any time soon. |
| |
| ▲ | abirch 2 hours ago | parent | next [-] | | The difficulty for the US is people seem to be against a Federal Government ID. India doesn't seem to have this stigma and hence rural India can solve this problem. | | |
| ▲ | micromacrofoot an hour ago | parent [-] | | I don't think people are against it, we already have the social security identifiers as a government layer... it's just that no one in the government is willing to do it for free in a way that is accessible to everyone | | |
| ▲ | dragonwriter 13 minutes ago | parent | next [-] | | > I don't think people are against it Every time national ID grts moderately serious discussion it is revealed very clearly that yes, the people are against it. RealID—which was simply national standaedization of state issued ID (when used for a variety of important purposes) had intense resistance, too—and its the closest policy to national ID that has passed. Social Security identifiers are not ID for the person, and anyway were adopted nearly a century ago at a moment of higher-than-current trust in the federal government. | |
| ▲ | abirch an hour ago | parent | prev [-] | | I think this is the horse shoe theory where the far left and right are against it.
https://www.aclu.org/press-releases/aclu-conservative-and-li... I know people who don't have a social security number because their parents didn't want them to be tracked by the system. |
|
| |
| ▲ | mistrial9 6 minutes ago | parent | prev | next [-] | | every application packet for a US National Security clearance for twenty years, was stolen in bulk, by Chinese agents. Your characterization of the perfection of US Federal data management appears to be lacking nuance. | |
| ▲ | Larrikin an hour ago | parent | prev | next [-] | | IDs being required for voting is essentially a poll tax the way that it's argued for in the US. There's a minimum amount you have to spend to even get one that will expire in a certain amount of years. That's also assuming you can get all the documents you need for the initial ID. If you don't already have all the essential documents you'll need multiple appointments at government facilities. The local social security office usually has just one location. Mine required time off from work because they were open from 10 till 4 four days a week. This was just part of the process to get an ID for a child when we only had a copy of a couple documents instead of the originals. Getting an ID for my grandma who made the mistake of being born black in the rural South during Jim Crow was a year long process, since she didn't even have originals of most of the documents. It took that long and was handled by one of her children that was a lawyer. For her we were getting an ID so the family could take her traveling, years before it was turned into a political issue to disenfranchise people. Nobody arguing for the ID laws ever argues for raising their taxes for an ID that all citizens are guaranteed with the supporting infrastructure. They're arguing for it because they know people they don't want to vote will have trouble getting one | | | |
| ▲ | pstuart an hour ago | parent | prev [-] | | It is a problem for millions of Americans: https://voteriders.org/article/who-doesnt-have-an-id-in-amer... Systemic racism is very much a thing, and while perhaps not foundational in this particular issue, we see still see political fuckery that definitely targets by race: https://www.nbcnews.com/politics/2026-election/tarrant-count... |
|
|
| ▲ | austin-cheney 3 hours ago | parent | prev [-] |
| While that can certainly be true it is still generally safer than username/password for authentication. |