That's not really true though philosophically speaking. Even if I forget everything about myself, my identity (as far as my creditors are concerned) is the same.

I think that there should be some kind of hardware key or smart card system issued by the government, where if you loose it or get it stolen, you can go to the post office or DMV or something to get the old key revoked and a new one reissued. The post office or DMV would verify your identity by biometrics or N other forms of ID.

Ok, how do we use that to build a useful system? How do I open a credit card in this world such that my key can't be stolen/exploited?

Public key cryptography.

Key-based cryptography falls apart once you have a manual component to it. Let's say hypothetically I have an ID card containing my keys -- how do I use it to pay a bill online?

Facemask. Could voice act. Well, it's non-trivial for most people, but so is hacking.

Everything about you is a data point that could be copied.

You missed the parent's point. The kind of identity he alludes to is not copiable with a "face-mark".

Think more of some uncrackable government issued id card, that anybody that wasn't to hack it should go to the police station to get one.

> to get one

Which you can only do after proving that you are who you say you are - which ultimately involves some (hackable) data.

Which is a moot point, as it moves the barrier to getting it to "impersonating another person in front of US authorities", so more like getting a forged passport.

If only most online authentication was that hard, and with so much risk for those attempting to fake it.

You're right that ryacko missed my point. And, you nailed exactly the benefits of an in person government issued asymmetric key process.

Even if showing up in front of US authorities was completely hackable, it'd still be better than the current state of affairs, because you'd have to hack people one at a time in person. (Unless you discovered some 0day in the key generation process or the hardware or something)

That naturally limits identity theft to a targeted attack on one individual, rather than being able to steal half of US adults identities all at once. Also, the hacker (or their accomplice) would only be able to hack one person per DMV (or Post Office) per month. And they'd have to at least vaguely fit your race, height, gender, etc.

A gang would maybe have the organizational skills to farm it out to a bunch of people. But, that's still limited to something on the order of thousands of people.

Let's not let the perfect be the enemy of the good.

True. This is the crux of the issue. In the beginning of commerce, identity was literally your physical presence. As business evolved, it gradually became a collection of information contained in documents, sometimes bearing seals and signatures. It was a lot easier to copy than someone's physical body, but still not trivial. With the advent of the digital age, it's become trivially easy to copy any data used to identify someone. So we moved to secrets, but that requires two people to keep the secret, only one of whom is really incentivized to do so. Then we turned to public key encryption. It's the best thing we've been able to come up with, but still suffers from computational loopholes, often due to implementation flaws or poorly secured private keys.

Does it just come down to the cost of copying? Should all businesses who use identity data indemnify their customers against identity theft (as suggested elsewhere in this thread)?