News for hackers. Stuff that matters.
Re:NY Man Pleads Guilty in $20M SIM Swap Theft by AnthonyMouse on Thursday December 16, 2021 @07:44PM (#29586175)
I don't understand why people think religion is the main reason to oppose this.

The main reason to oppose this is that if you had a low friction government ID system, surveillance capitalism would then require you to present your ID to do anything whatsoever and all privacy would disappear forever.

Re:NY Man Pleads Guilty in $20M SIM Swap Theft by yjftsjthsd-h on Thursday December 16, 2021 @09:33PM (#29587007)
But we already have that? If you pay with a credit card, have an address on file, or use a state-issued ID (drivers license), I don't see how that would be worse.
Re:NY Man Pleads Guilty in $20M SIM Swap Theft by AnthonyMouse on Friday December 17, 2021 @12:51AM (#29588368)
Credit cards are already a privacy catastrophe for anything where you have to pay money, but people will push back if you demand one for anything where you're not supposed to be paying anything because people are rightly wary of being charged when they ought not to be. Anyone who gives their credit card number for a "free trial" learns that the hard way and then becomes appropriately cynical.

A state-issued ID generally doesn't work over the internet, which is good. Some of them can be read electronically in person, which is already being abused to a limited extent and should be gotten rid of.

Which is the general response to your concern: "This is already a problem" means we need to go the other way and address that so that doesn't happen anymore, not intensify the problem and set it in concrete so it can never be fixed.

Centralized identity is a design flaw. Your bank needs to know if you're authorized to withdraw from your account, which is why you have a bank card. Your email provider needs to know if you're allowed to access your email account, which is why you have an email password. Your apartment building needs to know if you're authorized to enter, which is why you have an access card. What we don't need, and should not have, is a single primary key binding all of these things together so it can be correlated in a single database.

Re:NY Man Pleads Guilty in $20M SIM Swap Theft by pjc50 on Friday December 17, 2021 @03:30AM (#29589451)
As someone who campaigned against UK ID cards 20 years ago, we failed to realise that the ID requirements could be imposed without providing the ID scheme.

Since then the UK has imposed ID (technically "proof of right of residence", but that kind of has to be ID) on having a bank account, having a job, and both buying and renting houses. All without having a coherent ID scheme other than passport or driving license.

Re:NY Man Pleads Guilty in $20M SIM Swap Theft by PeterisP on Friday December 17, 2021 @12:26PM (#29595269)
IMHO the difference is that the status quo (a high friction non-universal government ID system + almost universal private "ID"/tracking systems) has all the same disadvantages anyway, but simply fails to realize the possible benefits.
Re:NY Man Pleads Guilty in $20M SIM Swap Theft by AnthonyMouse on Friday December 17, 2021 @02:14PM (#29596961)
What possible benefits actually are there, compared to non-centralized identity systems we already have? The only thing you get from a centralized identity system is the bad thing -- it allows surveillance bureaucracies to correlate separate authentication tokens with each other.
Re:NY Man Pleads Guilty in $20M SIM Swap Theft by PeterisP on Friday December 17, 2021 @08:30PM (#29600567)
This means that each and every institution has to verify identities "from scratch" which they are not really capable of. Bootstrapping trustworthy verification of identity that is useful for commerce (e.g. where you can practically collect debts/credit and prevent creating fake identities so that you know who you're dealing with, can reach them for contract enforcement if needed, and can ban people you don't want to deal with) is really hard, so everyone is essentially delegating it to someone else - webstores to credit card issuers, all kinds of institutions to social security numbers, some to phone numbers, and everyone is doing that poorly and failing at making it secure since there is no solid foundation for any of it, resulting in the extremely costly identity theft problem (in USA it's like $50bn per year?) and in cases like this, where companies have to rely on "phone numbers" and ridiculous "security" questions like mother's maiden name - because they don't have anything better to use.

Privacy and anonymity are not the same; there are many domains where anonymity is reasonable and default, but also many domains where it is not; in those someone can respect privacy and at the same time refuse to deal with anonymous partners, and it's an entirely reasonable choice that they should be able to make not only in theory but in practice - having an effective, secure mechanism for a person to verify their identity to someone else.

Proper identities are a key basis for trust - without them you can do one-off immediate barters (perhaps many times), but prolonged relationships, various forms of credit and "credit-like-effects", accumulation of reputation are highly beneficial for society; and from the perspective of incentives it's worth noting that the harder it is to "get away with" betraying trust and start from zero, the less incentive there is to defect and more incentive to cooperate; there's a good reason why the game theory iterated Prisoner's dilemma (which relies on preserving identities) gets so much better average results for everyone than non-iterated or fully anonymized Prisoner's dilemma.

Re:NY Man Pleads Guilty in $20M SIM Swap Theft by GoblinSlayer on Friday December 17, 2021 @12:05PM (#29594954)
We already have phone numbers for a low friction ID system used for surveillance.
Re:NY Man Pleads Guilty in $20M SIM Swap Theft by AnthonyMouse on Friday December 17, 2021 @02:12PM (#29596924)
People can reasonably get multiple phone numbers. A good countermeasure against this would make this easier and less expensive for people to do, e.g. you buy one phone plan and the phone company gives you two phone numbers, either of which you can change at your leisure. Then you give one to your friends and the other to your enemies, and change the second one every time you encounter a new enemy.