The banks then created a digital ID system (BankID) on top of this which is now used by everyone for real ID verification. Your physical ID is checked by a bank teller, and after that you get either a digital certificate file or a 2FA token that you can then use online to prove your identity for signing contracts (insurance etc), filing your taxes, or just logging into bank accounts etc.
Practically it works pretty well, even though I know philosophically an ID number like that would never fly in the US, and security-wise I'm sure experts have lots of objections.
Form auto-population by ID is rare here, though.
There are only really two groups that have issues: the very young (who are not used to checking up) and the very old (who are not used to computers).
Nobody is unenumerated, everybody has our version of a social security number, you are mostly required by law to have a bank account (and banks are required to give you one, except in specific individual cases such as you acting in an inappropriate manor)
I have so many problems with online authentication it's not funny.
So yeah, I'd love a global system of identification, but please let's not tie it to an address or phone number
I accept that I'm an edge case, but a large minority of (for example) Australians have dual nationality, and will have lived in either of the countries that they're citizens of for long periods of time. Some haven't settled on one yet, and skip back and forth every few months/years. All of them (us) have stories of identity systems, bureaucracy and banks not understanding that they moved country.
You're asking for a replacement asymmetry when the thing you're replacing in the first place isn't actually useful.
But, to answer the question: email is the one thing I'm pretty sure that I and I alone can get to. I have two email addresses, from different providers, using 2FA (google Authenticator on my phone). The 2FA bit is probably enough asymmetry.
However, even that, I could lose: if I fall into a swimming pool while carrying my backpack and phone, I'd have a hard time proving who I am to anyone until I got everything back up and running. Even worse, if I fell into a swimming pool while moving accommodation I'd have my passports in my backpack... not a comforting thought at all.
And getting one for people can be difficult as many people especially older ones don't have supporting documentation e.g. birth certificates and so can't prove identity.
Society requires foundations.
Sure you can. Identity documents exist more to prevent (the “wrong") people from functioning as citizens than to enable people to do so.
Anyway never had an issue with getting a package with my drivers license, and I didn't recall having issues before I got that. My passport is expired, because travel is inconvinient and mostly made obsolete with the internet.
It is possible to go your entire life without ever doing any of those things, or having any desire to. And as a general rule, it's the people who are of legal age who least care to do them. Also, some countries don't have age restrictions on such things to begin with (or don't enforce them at all).
> post office when receiving package
Who goes to the post office to receive a package? They come to you, and are then satisfied by the fact that they delivered the package to the address on the label.
> getting drivers licence
This a major reason why this is pointless. If you're going to have an ID, how do you identify yourself to get the ID? It's fully circular. You can't prove who you are unless you can already prove who you are, in which case you already have an ID.
In the US a large percentage of the population don't have passports. When you get a driver's license, they nominally ask you for some other ID, most of which (e.g. birth certificates or company/school IDs they have no way to authenticate) are trivially forged and useless at proving the person is who they say. Because it has to be that way -- you can't make having an ID a condition of getting an ID.
The whole idea is silly. Identity is context. If you create an email address with Google, you set a password. Then Google knows you're the person that email address belongs to because you're the one with the password. Your government "identity" has nothing to do with it, nor should it.
> opening bank account
The only reason banks care about this is that the government requires them to. Otherwise they would be completely satisfied to give you a numbered account with no person's name attached and simply put a hold on your deposits until after they've cleared, as they do for most anyone regardless.
> getting loans etc.
To get a loan what they care about is whether you're creditworthy, not what your name is. Prove that you have a job and a history of paying back debts, or post some collateral, that's what they want.
One system by which they automate this is to have credit reporting agencies that aggregate this information and associate it with your name, but there is no inherent reason it has to be done that way -- and some good reasons not to. See Equifax data breach.
Yes it is possible but you are describing outliers. Which first world country doesn't have age restrictions on alcohol or tobacco?
> Who goes to the post office to receive a package? They come to you, and are then satisfied by the fact that they delivered the package to the address on the label.
Envelopes and small packages (which fit) are left in mail box. In order to get everything else you have to go to your post office. Courier services deliver package to you personally and they don't leave it at your doorstep so anyone can steal it.
> This a major reason why this is pointless. If you're going to have an ID, how do you identify yourself to get the ID? It's fully circular. You can't prove who you are unless you can already prove who you are, in which case you already have an ID.
I don't really know how it is done today but in theory you could prove it by taking DNA/fingerprints at birth and registering accordingly.
> The only reason banks care about this is that the government requires them to. Otherwise they would be completely satisfied to give you a numbered account with no person's name attached and simply put a hold on your deposits until after they've cleared, as they do for most anyone regardless.
We are talking about reality not a situation where government regulations doesn't exist so there is no way of having a bank account if you don't have some sort of ID.
> To get a loan what they care about is whether you're creditworthy, not what your name is. Prove that you have a job and a history of paying back debts, or post some collateral, that's what they want.
This is just plain wrong, they care about the identity in case you stop paying so they can go after you.
P.S. You also need ID to own property, companies etc. I can't deny that if you are living in the middle of woods off grid you might get by without an ID but if you are an average person you will need an ID eventually.
In many parts of the US the restrictions are not actually enforced, or you can prove your age using non-government-issued identification.
I also dispute your assertion that people who don't drink or smoke are outliers. The majority of people don't smoke and a large minority don't drink. In some major cultures and religions drinking is outright prohibited.
> Envelopes and small packages (which fit) are left in mail box. In order to get everything else you have to go to your post office. Courier services deliver package to you personally and they don't leave it at your doorstep so anyone can steal it.
In the US they leave it at your doorstep so anyone can steal it, because in practice hardly anybody actually steals it. Who is going to risk federal prison or getting shot by the homeowner over a mystery box which is probably just a $25 bulk pack of shampoo?
> I don't really know how it is done today but in theory you could prove it by taking DNA/fingerprints at birth and registering accordingly.
This doesn't work for anyone who is already an adult, and isn't already being done for newborns so won't work for them either, which means you've got more than a hundred years before something like that could be used without having living people it doesn't work for. It also fails permanently for anyone born and raised in another country.
On top of that, it still isn't solving the unsolved problem, which is identity theft. You can't use DNA or fingerprints over the internet (they're trivially forged if you control the reader), so they're just going to issue you a card or a PIN or some other thing you can use and then someone can steal/hack/forge it and impersonate you. Being able to prove your DNA doesn't disprove that you're the person who used your card+PIN to buy $50,000 in already-provided goods and services, or pay for an email account used to send spam etc.
> We are talking about reality not a situation where government regulations doesn't exist so there is no way of having a bank account if you don't have some sort of ID.
We don't have mandatory national ID cards either. If the proposal is to make a policy change to improve things, let it be the one that doesn't double down on a bad idea.
Also, around a quarter of Americans and half of people in India don't actually have a bank account, largely because they don't have any money to put in it and can't afford the fees that come with not having a minimum balance. So they get paid in cash, or something they immediately convert to cash, and pay for everything with that.
> This is just plain wrong, they care about the identity in case you stop paying so they can go after you.
That is why they require collateral. If you take out a mortgage they put a lien on the house. If you don't pay, they take the house. If you're on a beach in Argentina with a million dollars in cash in a briefcase, what does the bank care as long as the house sells for more than they're owed?
> P.S. You also need ID to own property, companies etc.
There are millions of people who don't own real property or companies, or even cars.
And even then, it doesn't require a national ID -- they all exist without it. They even predate modern identification. Because all of those things are local. If you want to transfer property, you go to a notary. The notary will want to know who you are, but that doesn't mean national ID. They could just take a picture of you and keep it for their records, or accept a non-government ID or an oath from a person known in the community that you are who you say you are.
Centralized identification is at the same time unnecessary and actively harmful.
Nearly 1/3 of of people in USA have experienced package theft and it is only a federal crime if you steal USPS packages not Fedex/DHL/UPS etc.
> That is why they require collateral. If you take out a mortgage they put a lien on the house. If you don't pay, they take the house. If you're on a beach in Argentina with a million dollars in cash in a briefcase, what does the bank care as long as the house sells for more than they're owed?
I can get a personal loan without any kind of collateral as long as i have X income. Credit cards doesn't have collateral as well.
Honestly, i feel that we live in different worlds - i cannot fathom not having an official ID as there are occasions where i must have it (voting, travel, banking as well as government e-services where you can use bank login or your ID card certificate to identify yourself). There isn't a lot of press or reports from Personal Data Watchdog about somebody doing monetary damage from using other people data, in fact our ID numbers (like SSN) in some cases are public knowledge. I am not saying that our system can't be abused but right now i feel like it works just fine and i wouldn't want it any other way.
That statistic is from a survey done by Comcast as a precursor to trying to sell you a home security system. That is not a reliable source.
And stealing a non-USPS package is still a state crime, so the main difference is whose jail you sit in. Unless you manage to steal something which is actually worth a lot of money, or is involved in interstate commerce etc., in which case welcome back to federal prison.
> I can get a personal loan without any kind of collateral as long as i have X income. Credit cards doesn't have collateral as well.
These are small loans, in which case the collateral is your job. They verify where you work, so if you don't pay they know where to find you. The only way to avoid them finding you is to quit your job, which they don't expect to be worth it for you to do over such a modest amount of money. Notice that the interest rates on those kinds of loans are dramatically higher -- because of the risk that they're wrong. If it was really your identity doing most of the work you would expect the interest rates to be much closer to those for loans with more substantial collateral.
> There isn't a lot of press or reports from Personal Data Watchdog about somebody doing monetary damage from using other people data
According to DOJ statistics, more than 17 million people in the US are victims of identity theft per year.
> Honestly, i feel that we live in different worlds - i cannot fathom not having an official ID as there are occasions where i must have it (voting, travel, banking as well as government e-services where you can use bank login or your ID card certificate to identify yourself).
You feel that way because you live in a place where having an official ID is required to do everything. That isn't a law of nature, it's just a law of the place you live. It's completely reasonable to do things a different way.
Creating one single place to change your address gives the attacker one single place to change your address. Compromise one system, bribe one police officer or DMV employee, get nation-wide root access to everything.
And how does it even solve the problem? The problem isn't that Google doesn't know whether you're John Smith. It's that Google thinks John Smith is a scammer they won't do business with, and they aren't willing to spend their resources helping you to clear your name.
Similarily, you can have corruption at phone carriers and credit-card companies too. What matters is the audit-chain. If a police officer keeps id-ing fraudsters they won't be in the job for long.
That public servants are more corrupt and less competent than the corporate employees one depends on is not a universal experience. Not for me anyway.
Not really, because that isn't how fraud happens now, and nothing about that would change it.
People don't commonly commit fraud by going to a government office to get an ID issued in your name, they do it by waiting for you to do that and then stealing it from you or otherwise convincing you to give them the information they need to authenticate using it.
> Similarily, you can have corruption at phone carriers and credit-card companies too. What matters is the audit-chain. If a police officer keeps id-ing fraudsters they won't be in the job for long.
That's assuming the audit chain is both secure and less susceptible to corruption than the original system. Audit logs don't help if they're compromised by the people with privileged access. Or you nominally have individual accounts but in practice they're shared or not secured against compromise by privileged users.
And assuming that the corruption problem is specific identifiable people rather than a systemic issue where >=5% of police are corruptible so one getting caught only requires the fraudsters to use any of the thousands of others.
> That public servants are more corrupt and less competent than the corporate employees one depends on is not a universal experience. Not for me anyway.
The difference in this case isn't that the quality of the people is different, it's that the nature of the system is different. Whereas an individual company might have five employees with sensitive access, across an entire national government there would be a hundred thousand or more, so the attacker has a hundred thousand chances to find the lowest common denominator instead of five. And then when they succeed the scope of the vulnerability is not limited to that one company, it's universal.
An /actual/ (inter)national ID and Identity verification service. One where disputes about identity and authorization can be escalated somewhere that makes sense, to the jurisdictions issuing these IDs.
Ideally someone should be able to go to a police station (locally for local IDs, if on vacation/out of hometown in liaison between departments) and have their identity verified in a trusted way, and that verification reported as pass/fail to a third party whom is asking.
This would also be the way of officially disputing fraudulent uses of identity; they would be reported via the same actions, but as a customer initiation (and statement of legal testimony taken in a case that would then be opened and reported to the involved parties).
BTW, such a system SHOULD also include address resolution, for physical mail, voice, and electronic services (any sub-name actually).
I would LOVE to only update my address in ONE place when I move, instead of trying to remember everyone I've ever given it to.