They offer plenty of ways to actually authenticate. The classic one is that you receive a voucher, go to a post shop, the employee there checks your ID and prints you a verification code (iirc). They also added video calls for identification and from my experience, it seems as if they are aware of the potential security implications. They ask you a bunch of questions and require you to do different things (for example hold your ID card right in front of your face, cover one side of your face, etc) presumably to counter this attack vector.
The smoothest way is to use the ID card integration. With that, assuming your ID is already set up for the online authentication, the whole kyc process for a new bank account is done within two minutes. Unfortunately it seems like some banks still disable this option, at least I did recently open an account and did not have this option for use with postident.
Give them a little while and the AI will be able to do all that so you can finally prove to the government that you are indeed a panda bear.
> Das Gesetz hat sogar eine eigene Website mit einem Dashboard,
But yes, in general, we’re SO CLOSE…then you have to go do Anmeldung with a paper form in person
That stuff honestly improved quite a bit in the recent years. Most of these services are just not advertised or integrated enough so far.
Imagine, for example, that upon declaring a protest unlawful, the police could simply scan all the RFID-enabled ID cards in the area and issue everyone a court summons.
Not carrying an ID card? No access to anything - public transportation, payments, and can’t even authorize your car to start. Also, it’s a felony to do so intentionally and with intent to evade law enforcement monitoring.
State wants to search your laptop? Your 2FA and disk encryption is mandatorily tied to your ID card, and the state holds keys in escrow.
Some things should be onerous for the state and decentralized. This is absolutely one of those things.
But, for things like banking, car registration, etc... we require strong ID'ing, and it behooves society to make it secure.
I still think municipalities should own their own data rather than have it stored at a central federal level, but we need municipalities to rely on something better than a serially-issued social insurance/security number which I have stored in a million databases that can pop at any second.
It's easy to dream of the future dystopia and ignore the one we live in now, where identity theft is trivial.
How about just denying you federal services _after_ providing ID? How about putting you on a watch list?
Governments have been using IDs to deny services to oppressed peoples since IDs existed, but I think the options that leaves you with is to fight for a free and democratic government or not have IDs.
Can you elaborate on what you mean by "strong"?
I've been involved in precisely three car purchases over the last 20 years, and I don't recall what was involved in the way of ID checks. Have the feeling that at most some government-issued ID may have been pulled out of a wallet, presented ... and glanced at. The dealer handled the registration in every case.
Oh, and in all three of those purchases we drove a (brand new) vehicle away from the dealer having paid not even a deposit and clutching a paper invoice(!) with the verbal instruction to pay it "straight away".
Guess we seemed trustworthy :)
Absolutely agree that currently you can get away with faxed signatures, photocopies of IDs, and all manner of incredibly "weak" ID'ing.
Why? I’d much rather live in a world where privacy is prioritized over making life easier for the police.
> centrally managed, and cryptographically-backed state identification cards, complete with RFID.
Does not necessitate:
> universally mandated
> No access to anything
> felony to do so intentionally
> Your 2FA and disk encryption is mandatorily tied to your ID card
All the latter things are awful, but we can have the first thing without any of the latter things.
> A slippery slope argument (SSA), in logic, critical thinking, political rhetoric, and caselaw, is an argument in which a party asserts that a relatively small first step leads to a chain of related events culminating in some significant (usually negative) effect.
Small first step => significant negative effect
"centrally managed, and cryptographically-backed state identification cards, complete with RFID" => everything the parent commenter said, basically
Additionally, “centrally managed, and cryptographically-backed state identification cards, complete with RFID” is not a “small first step”.
That’s a huge step that centralizes a great deal of power that can be readily leveraged through small subsequent steps.
Also, you clearly don’t understand what it means if you are nitpicking about the size of the first step. The whole point is that it builds up, and nobody can truly predict how it would shape up.
Trying to do so to fit a doom and gloom narrative is, once again, the literal definition. Just because you’d not like it doesn’t suddenly make it not so.
The opening of the 4th seems just about tailor made for this(because it was I believe?)
Emphasis mine, obviously.
> The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.
In neither place, nor any country with mandatory ID as far as I know, you get "no access to anything". The worst thing that can happen is that if the police choose to stop you, not carrying your ID can lead to you being taken to a police station temporarily. Which is not great, but not anywhere near close to what you are suggesting is inevitable. And police can detain you arbitrarily in places without state-mandated IDs, this is just a cute excuse that they can add to their repertoire.
If you give your governments tools that can be used for oppression, even if they aren’t abused today, it would make it easier for a new authoritarian government to abuse them later on.
Spain was a dictatorship for much of the 20th century and Argentina had had multiple military dictatorships too — it could happen again. Europeans are far too confident that they have overcome the problems of the past by building the EU etc. A bit more American-style distrust of government would be a good thing.
But even if mandatory RFID IDs were a critical tool of authoritarian governments, what would prevent the dictator from issuing mandatory IDs after taking power?
What prevents a dictator from issuing mandatory IDs? The resistance of the people. Yes, the government has police, and an army, and fighter jets, etc. But in the past few decades we have seen that insurgencies and popular resistance can succeed anyway -- the US got kicked out of Afghanistan and had a lot of trouble in Iraq, Ukraine is outfighting Russia despite massive disadvantages numerically and technologically, and even in China the government softened the zero-Covid program after mass protests. The people have more power than we think and can resist such things, if they want to.
Unlike facial recognition cameras, which there's at least some political will to ban (https://www.politico.eu/article/europe-edges-closer-to-a-ban...).
You are somewhat misinformed about the Ukrainian war. Ukraine has 3-4 times less population than Russia, but it started full mobilization early in the war. Meanwhile Russia started partial mobilization just recently. So it was common for the Ukranian army to have a numerical advantage on the ground. Most of the recent Russian retreats can be attributed to the lack of personnel to properly mount defensive positions.
As for technological advantage... It depends. Ukraine effectively has the whole NATO and a number of additional countries as its rear and supply base, while Russia depends only on itself and a bit on Iran. In terms of communication systems, intelligence, and likely anti-tank and anti-ship systems, the Ukrainian army is miles ahead of Russia. Russia has advantage in air, artillery, anti-air, and ground-to-ground rocket systems.
Not adding it today does nothing to ensure a dictatorship cant use it in the future
Yes it does, if the people have the will to fight. Insurgencies have been surprisingly successful against the most powerful militaries in the world in the past few decades. Even in China, the threat of mass protest forced the government to soften Covid restrictions -- and the protesters didn't even have guns, or any leverage at all except their willingness to put themselves in harm's way.
Every dictatorship that has ever existed started off with the consent of the people, at least at first. All of the dictators in history were swept into office on a wave of popularity, and the people only regretted it later on. It's just not possible to impose a dictatorship on a population that doesn't want it.
Nope. The American distrust is resulting in a self-fulfilling prophecy of a failing government. Your bureacracy is years behind basic things we've had in many European countries, and because there's massive distrusts there's no investment making it impossible to improve.
E.g. your tax process is a massive joke, but will it ever be fixed? Not until one of the only two parties claims government is by default incompetent so any money spent on it are by definition a waste.
We don't want it. We don't want to "fix" our tax system -- we want low taxes and lots of deductions, and that is why we have them! We want cars. We want suburbs. We don't want the government to be our mommy. This is not a failure, it is an intentional feature of the American system.
Also just remember that if we built a competent bureaucracy that enforced a nationwide ID system, it might be handed over to Donald Trump if he wins the next election, and he really could win. Every power we give the government, assuming that the government will be good, will also be given to a bad government. Sometimes it's better to refuse to give that power at all.
You can have that without having to rely on third parties you pay for to get there. How exactly does a middleman help if the point is low taxes?
> We want cars. We want suburbs
Funnily that's in direction contradiction to your previous want. Suburbs and cars are much more expensive, therefore you have to pay more for them, either in taxes to pay for the useless infrastructure, or to pay for it directly.
> Also just remember that if we built a competent bureaucracy that enforced a nationwide ID system, it might be handed over to Donald Trump if he wins the next election, and he really could win
And how exactly would someone like Trump abuse an ID system?
And yet we have the infrastructure. This is not a thought experiment. I am posting this comment from a house in the suburbs with high-quality roads and utility services, which we have managed to build despite our tax system.
So where is the contradiction? Clearly it's possible to live like this, because we do now, and we have done so for a very long time.
You can pick whether you want to have an ID card or a passport or both. You are not required to carry your ID card with you.
In general the actually existing surveillance of mobile phones that were in a certain area at a certain time is much more worrisome to me.
"I am not a lawyer" but:
"Deutsche im Sinne des Art. 116 Abs. 1 GG sind nach § 1 Personalausweisgesetz (PAuswG) verpflichtet, sobald sie 16 Jahre alt sind und der allgemeinen Meldepflicht unterliegen oder sich überwiegend in Deutschland aufhalten, einen gültigen Ausweis zu besitzen und ihn auf Verlangen einer zur Feststellung der Identität berechtigten Behörde vorzulegen sowie einen Abgleich mit dem Lichtbild des Ausweises zu ermöglichen."
You must either carry a national ID document or, if you are requested to identify yourself by the police, make it available to them in reasonable time on request (say, if you left it at home, show it to them at a police station the next day).
If you’re required to have it and present it on demand, then almost everyone will carry it, and the tiny minority not carrying their card will be automatically suspicious.
It’s a very short step from there to simply requiring that it be on your persons.
Exactly this is the kind of fine details that a lawyer distinguished in the law.
So no. Absolutely no. You do not have to carry it with you. If it comes to the need, then maybe the police have to scort you to your home and you have to show the ID. But you are not requested to have it with you at all times.
Slippery slopes work exactly because people are incapable to predict the long term consequences for eroding safety standards and are at the same time arrogant enough to believe to be very much capable. Its cognitive biases at work in selecting some of the most reckless approaches for dangerous situations.
An empty promise today is easily broken tomorrow. The best defense-in-depth against future abuse is not building the abusable system in the first place.
Adoption might start as a voluntary choice, but pervasive integration with other technology and services result in it becoming effectively mandatory.
> In general the actually existing surveillance of mobile phones that were in a certain area at a certain time is much more worrisome to me.
Integration of government ID with our smart phones is literally the next step:
Automatically issuing court summonses without first using chemical weapons and forced restraints is pretty good actually. If youre trying to make it so the government can't prosecute people for protests, you need to get rid of the idea of an illegal protest
The government can already torture, enslave, and kill you. If you can trust your government to handle those well, then this is no problem because they'll also handle ids responsibly.
If government can't handle those things well, the ids don't make for much of a change wrt to the government
The bigger disadvantages of a national id I think are that it moves ownership away from you, and to the card, like with block chain systems, the card is the owner, and you only have access to the card
Of course it does. It’s expensive, inefficient, and plays badly on TV.
How much easier would it be if every single person could be identified automatically from a drone and arrested out of public view?
How much more efficient if people suppressed themselves, and never attended a protest, out of fear of it being declared illegal and automatically receiving a summons (or worse, an arrest warrant)?
> The government can already torture, enslave, and kill you. If you can trust your government to handle those well …
I don’t trust them to handle those well. That’s why the legal system incorporates strong checks and balances, and even then is still ripe with corruption and abuse.
Why would I want to give them more powerful tools with far less oversight?
> If government can't handle those things well, the ids don't make for much of a change wrt to the government
That’s absurd; if you don’t trust a government, facilitating their abuse of citizens obviously has a material impact on the scale and scope of their actions.
Your argument, taken to its conclusion, would justify any privacy violation by the government.
I find the idea of using social security ID or a driving licence as an ID very backwards.
I have a wallet that has RFID protection.
Public transportation uses a different card, payments also use a different card (a normal bank card, like you surely have), and I don't see why you think these payments will be forcibly linked to the ID card.
And don't get me started about laptops or smartphones. There's an application for smartphones that allows to have your ID digitally inside the app, and that's it. Your ID is not tied to any encryption or login.
So, you actually sound a bit unreasonable. I repeat: the use of social security numbers or driving licences is very awkward in my opinion. An actual ID has many advantages.
However, as an Italian, i understand your feelings.
Public administration has always been the land of bureaucratic people that want to see sheets of paper, stamps and signatures.
They’re almost often unfamiliar with technology and they are mostly unwilling to change their workload.
The real problem if very often that upper management is often also old and unfamiliar with technology too, hence incapable of understanding the value that technology could bring hence unwilling to push its adoption.
I really like the development that has gone into the e-ID. They even have thought out a safe way to update your PIN (https://www.pin-ruecksetzbrief-bestellen.de/)! The biggest drawback of all is the lack of any marketing, IMHO.
Some Herr Doktor probably followed all the best practices to implement "trust zones, certificates, authorization features, and much more" in the ID, doing their job really well. But actually changing the processes to use those features is not anyone's job, and might actually eliminate a lot of jobs, so it never happened.
They might be slow, complicated, budgeted terribly, unbelievably incompetent by standards of typical for-profit mega corporation, but a lot of those projects work at first try and works for decades, in the end.
SLS capsule came back in one piece on first try. That German ID system probably works too. And that’s great.
Such a thing will never fly in the US. Both the left and right will rightfully or wrongfully oppose it for different reasons.
Edit: E.g. see the left opposing voter ids in the US.
FYI, the left wasn't opposing voter IDs. The left was opposing Voter ID laws, which required a voter to have an ID, while selectively providing these IDs to the population.
That's a uniquely American problem. We wouldn't have an issue with a Voter ID law if everyone was guaranteed to have a state ID, regardless of where they live, whether they have a car or not, and whether they have money to pay for it (it should be free).
No IDs in an election are a culture war issue in US and lefties argue irrationally on the topic. Btw, I am not a Trump supporter.
Do you live in the US?
If not, looks like you're missing the important context that the Republican party makes access to facilities that issue IDs limited.
For most Americans, the primary ID is the driver's license.
And for those that don't drive, it's... non-driver license, also issued by department of motor vehicles.
Which is often not accessible by public transportation.
And whose locations strategically avoid black and poor small towns.
So no, it's not a "culture war", and the arguments are rational once you learn the context of the issue at hand.
They rolled that out together with finger printing.
People value their privacy here and this was overstepping too many boundaries.
Those features have also never been explained to the average Michel here. Even IT interested people are not aware or understand the good things about it.
> With IRMA it is easy to log in and make yourself known, by disclosing only relevant attributes of yourself. For instance, in order to watch a certain movie online, you prove that you are older than 16, and nothing else.
That’s not “cool stuff”.
Besides, at least around here they already ask for an ID if you look young enough, for some movies. This is not enabled by new technologies.
For the unfamiliar, with identity-based encryption, the recipient's public key is a function of the key authority's public key and some "identity", such as a national ID number or email address. Their private key is a one-way function of their identity and the key authority's private key. So, the recipient needs to ask the key authority one time to generate their private key for them, but there's only one public key to distribute. For the whole system, the sender can calculate the recipient's public key. The private key isn't even necessarily calculated before the sender has sent their message! It's very convenient and flexible!
Of course, the downside is that the private key is deterministic and can always be re-generated by the key authority, so it's fundamentally vulnerable to attack by the key authority. Also, some of the underlying math is less well studied than standard ECDHE/DHE/RSA, so we're less confident about vulnerabilities lurking just under the surface.
Right now most platforms don't do ID validation because users hate sharing their details. By making it more privacy-safe more platforms will do it because the barrier is lower. I really hate that, I think the internet should remain anonymous. So I can pick whatever nick and even have multiple.
I mean I would also make them passports but I think that is impossible.
The IDs are actually heavily unified nowadays https://en.m.wikipedia.org/wiki/National_identity_cards_in_t...
It's the same for driver's licenses [2], they are accepted in all EU member states and basically look exactly the same, just in different languages and show a different flag.
[1] https://en.m.wikipedia.org/wiki/National_identity_cards_in_t...
[2] https://en.m.wikipedia.org/wiki/European_driving_licence
Usually I'll argue for market efficiency over other concerns; but in this case the Europeans are on to something with the GDPR. The role of government is to make this sort of personalised identification hard - not to enable it. The end game is going to be hard times and mass discrimination against minorities.
Despite Germans have made bad experiences with that, the idea survived the 3rd Reich.
The idea that as a human being you need "governmental documents" to identify is an authoritarian core value that is fundamentally against individual freedom.
Jews were forced to always carry their "Kennkarte" with them.
Please do not tell me about positive use cases that are based on the naive idea that "the government is the good guys".
When electronic IDs are not rolled back everywhere then democracy and individual freedom will be lost for a very long time.
Yes there’s plenty corruption and disastrous bets (ISDN…), but let’s not pretend the situation isn’t intentionally created.
It has always been incredibly sad to me that the German ID card (Personalausweis) has an RFID chip inside with trust zones, certificates, authorization features, and much more and just never had been used. Like at all except for getting cigarettes at vending machines.
12 years after the first RFID Personalausweis had been issued it is only possible to register you car in some cities. Maybe there are other minor uses but it's negligible.
It's a very cool technology with a certificate authority and cryptographically secured claims for various things (proving you are over 18 without revealing you DOB, only giving out the name and address, authenticating as a German citizen, etc.). All functionality is also available for use over the internet.
The German Wikipedia has a good overview: https://de.m.wikipedia.org/wiki/Personalausweis_(Deutschland...