Digital ID Done Less Badly

We lost the war against a Digital ID the moment we all started relying on smartphones. With many jurisdictions bringing in Digital IDs, and just as many of those jurisdictions suffering catastrophic data breaches, there needs to be hard legislation around them in order to force implementations to protect the us, rather than harm us. This article presents an approach to digital ID that is less terrible.

What Is The Problem?

You start a new job and on the first day, you're instructed to sign into a dozen new online services, handing over a ton of very sensitive information for these fly-by-night apps to store in some undisclosed location until the end of time. Copies of passports, work permits or visas, social security or other credit/tax identifiers, name, address, date of birth. Essentially enough to cause someone decades of trauma and grief when put in the wrong hands.

During your lunch break, you decide to sit at your desk and pay some bills online. In addition to credit card details, you're having to again hand over information that is so sensitive that you need it for almost everything these days.

You go home and want to cleanse your mind of the day's woes and sit down for an hour or two to take the day's news in the only remaining palatable medium -- troll memes. But unfortunately for you, you live in a jurisdiction that is legislated by Neophyte Fuckwits, such as Australia, The UK, The EU, USA and Canada. Because pretty-much anything online can be construed as adult content by the legal department of the website or app, and you're now required to go through an ID check process, which involves a copy of your passport being uploaded to fuck-knows-where, along with a short video of yourself in your underwear doing dance moves from a Village People song to prove it's you in the photo.

You decide to head out for a couple of frosty pints at the local watering hole -- away from the technology that's harvesting your for every impulse and datum. The bouncer at the door wants to see ID. You show him a driver's license. He hands it back and grunts "It's expired". You're still just as human as you were a few days ago, even if your privilege of driving a car is temporarily on hold. If anything, the law would prefer that your driving and drinking don't mix.

As you walk back home, you notice a dozen TVs on in a shop window all showing the same cable news TV segment on the latest data breach. 150 million (half the US population) drivers licenses have been stolen from a government department.

Why Are We Still Here?

Much of the data collected is being collected by copying one or more ID documents not because that is the only way to solve the underlying problem. It's collected this way because that's the way we used to do it in the days where we used dead trees to store everything. A filing cabinet full of photocopied data in an office somewhere was never secure from attack. But what we have done is taken that filing cabinet, put it on the Internet in multiple places, and filled it with millions or billions of people's data.

There isn't a single more tempting and lucrative honey pot for a nefarious actor than any of these thousands of repositories of stored identification information.

What Needs To Be Done?

The technical approach to minimising these problems will never happen without a push. The Internet has had decades to not fuck up security on their own volition and we've seen how well that's worked out. There's no incentive or penalty for ruining lives and companies are beholden only to their shareholders.

What's needed is legislation (and accompanying technical guidances and reference implementations) for mandating specific technical constraints when dealing with sensitive data. For example, mandate that certain common checks be done using ZKPs (see note below) instead of reading a passport, parsing out the details and storing the image and data somewhere to be stolen.

If it's easy for a website to quickly validate that you're a government-certified human being to give you a Blue Checkmark without needing you upload yourself, they're more likely to comply. If there's a compelling reason to need to know that you're over a certain age, this too can be done without transferring the data. The proof can even be kept, but isn't useful to anyone at all if stolen.

Another benefit of this approach is that the checks and proofs are between the citizen and the remote website. There is no need to query a central government or corporate system to check each time, thereby not creating a complete digital history of everything you touch on The Internet. Even if you trust your government with this information, you probably shouldn't trust the people who will steal this information from the government.

There are myriad technical details and problems that I haven't laid out the solution to here. An example of that would be revoking an stolen ID. These do have solutions that I'm happy to go into, but I wanted to keep this article short and high level.

Summary

Personally, I don't want to see a digital ID and for that to become pervasive. I also believe that we lost that battle already. Long ago. The solution is privacy and digital sovereignty legislation to protect us all online, and for the digital ID and its use to be implemented under that legislation. I would go further and suggest that this is a human right and belongs in the constitutions of most/all nations. It will not happen without us demanding it.

To summarise, a secure, privacy-centric digital ID system would look something like this:

Having legislation and good technical tools and guidance for businesses is the only practical way forward. Building the technology and waiting for it to catch on hasn't worked. It's probably time to contact Your Elected Neophyte Fuckwits and demand that we put digital sovereignty and privacy on the table and invite the right people to the conversation.

If it's not stored, it can't be stolen.