For example you could have the website never knowing your actual ID but simply passing an encrypted string to the national server, which would return a 200 response if the document is valid. You could also have additional requests like "is the user 18+".
The website will just know the request is coming from something which has a valid ID available. The state will also not know which pages you browsed, only the domain of the request, just like with HTTPs your ISP does not know exactly the pages you browse but just the websites themselves.
And before someone talks about the state knowing your browser history: they already can by calling up your ISP, and they would get a lot more information than this mechanism would provide.
A) used as political chaff for jockeying by power hungry politicians as distraction fodder or FUD material
B) centralized by the intelligence community of your country, or an allied country with an agreement that they'll do the work for your government that your government can't.
There are things that simply should not, nay, must not be made.
The Single Identification Number is one. We have all the tools to do it today. The only thing keeping it from happening is refusal to implement at the grassroots level.
Ah, ha!
The PR spin necessary to kill this in the US would be to connect it national ID. I hadn’t thought of that.
A narrative about national ID with some vague “mark of the beast” insinuation thrown in and suddenly a large political faction who otherwise would care about this would be opposed. I like it.
I think a political strategy of getting rural school districts + 20 State governments to go on record saying they will not purchase or use computers that have Google WEI could be very effective.
If any of that trust is broken my privacy is at risk.
> And before someone talks about the state knowing your browser history: they already can by calling up your ISP, and they would get a lot more information than this mechanism would provide.
That depends on how you browse the internet today, and how the ISP tracks it. Simply using a different DNS service goes a long way, and using a VPN or the tor network may not be totally fool proof but should get around the basic drag nets am ISP is likely to use.
The ISP, with SNI implemented, would only be able to tell the state that "a device connected through this physical location accessed a server through Cloudflare".
My ISP will tell them I spend most of my time connected to Mullvad VPN, and Mullvad will tell them they don't know anything about what any particular IP address was doing.
Having to give identity attestations either directly or proxied by a government server would make such anonymous browsing much more difficult, if not impossible.
1. 18+website tells the browser age verification is needed, gives a random token
2. Browser signs a verification request with the local ID card (or a key temporality allowed to do so), forwards it to government server
3. Government server sees the request with random token, signs both, answer the browser
4. Browser forwards signed attestation to 18+website.
The government server only sees the random token. The website only has the attestation. There are other things that can be nitpicked against, but not this. For instance, can we require local ID cards? What about foreign visitors? Possibly an attestation from their passport? And of course, browsers sit in the middle and see everything.
However, this could be a useful mechanism to have. For age verification, nationality check, or even identity check on official websites. And if we have this, it's bound to be abused in some ways (Facebook could require an ID check).
No, there isn't. It's basically an OAuth login flow. The spec is publicly documented, anyone can register applications and check if the government is responding as desired, both by correctly requesting auth for the correct scopes in the government-hosted auth page, and by checking that the data returned from the gov matches what the spec promises.
It's also worth considering where this stuff comes from instead of ascribing anything the other team says to superstitious fools and their invisible sky man.
Branding people like cattle wasn't invented in modernity. It's infamous Nazi behavior, and the Nazis weren't the first to do it either. It's so old that people centuries ago saw how bad it turns out and put a warning against it in their ancient book.
You don't have to believe in the devil to believe that history repeats and learn a lesson from the people who came before.
Google is loving this, I bet.
I didn’t say any of that. You have no idea what I believe beyond that I don’t buy into the “mark of the beast”. Anything else you read into my comment is something you read in.
That you went straight to comparing my comment to Nazism seems a bit uncharitable.
Conversely, that system is not secure if the site conspires with the government, because the government could record the signature (or the token) and then compare it to the one the site has to violate the anonymity of a legitimate user. There are forms of encryption that prevent this (the user does a cryptographic operation on their own device that munges the data so the site can still verify the signature but can't tell which one it was), but now you need the government to implement that system -- and update it if any vulnerability is found -- and do a coordinated update of all the sites in the world with the new protocol that patches whatever vulnerability is found -- and do this rapidly and competently because in the meantime the system would have to be taken offline to avoid it being actively exploited.
Do Not Attempt. Failure inevitable.
I'm not comparing your comment to Nazism, I'm comparing universal identity systems to Nazi behavior, because that's what they are. Their primary use, the major thing they do that decentralized credentials systems don't, is to facilitate mass surveillance and authoritarianism.
My point is that this has been understood for a long time, and the people who say "mark of the beast" have a legitimacy to their concern that has been demonstrated throughout history, regardless of whether or not you believe the fine details of the allegory.
Just the domain is still a pretty major information leak.
> And before someone talks about the state knowing your browser history: they already can by calling up your ISP, and they would get a lot more information than this mechanism would provide.
Yeah, but they have to ask. This creates a system that requires preemptively sending them that information.
I took your particular reply as accusing me of being critical of religiosity-- specifically "...ascribing anything the other team says to superstitious fools and their invisible sky man."
I took your statement about "branding people" as a statement on this perceived accusation that I was speaking unfavorably about religiosity.
Your clarification that your were comparing universal identification to Nazism makes me read your comment in a different light.