Can you explain when this is the case? You can always vote with your feet and not use x|y|z.com. Not a once have I been forced to used some piece of software in my personal life.
> The latter is how human society has always operated. People behave differently in front of their parents and their friends. They wear different clothes to work and to play. They say things in confidence to people they trust that they wouldn't say to people they don't.
I'm not actually arguing that socially we shouldn't have "Personas" or access to multiple email addresses or whatnot, etc. I'm arguing that personas should be specifically chosen by products on top of a strong cohesive underlying human identity system (by not using some global id as a primary key in the users table or even storing it in the first place, or by allowing a less strict form of authentication). If your message board doesn't need to enforce uniqueness of humans, or enforce that posters use a real name, then it simply doesn't (maybe email is good enough for it). However, if your bank does need to, it has a good way to do so not a shitty one. And as a user I'd rather my account recovery be rooted in a socially robust system even if higher order services don't need to chain their account/user records back to a unique person ID.
> You're really looking for a rate limiter to prevent someone from creating a million accounts. You don't have to merge everyone's pseudonyms into a totalitarian centralized identity system for that. All you need is something that puts a price on account creation. A literal price would work fine. So would a dozen other things.
That's not what I'm looking for but I don't disagree that it's a solution to some of the spam and bot type of problems.
I'm looking for a strong digital identity system not rooted in a digital postal address. Some people are allergic to the idea because of all the ways it could theoretically be abused. I simply don't buy FUD around how an strong identity system could be abused to be reason not to build it. Powerful tools come with great responsibility. I believe there are enough people who care involved that we could develop and wield a better system than "your email is you" responsibly as a society. I actually think that a strong identity system would help us avoid slipping into a totalitarian nightmare where all the tracking happens in the dark behind the veil (essentially what we have today). I want people that need to track you to declare it loud and clear so that I can make informed trust decisions on a service by service basis.
Anyway you really seem to be arguing from a position where you assume this tool will be used unilaterally by everyone for bad. I simply don't buy it. Your fear is noted, and I think we've discussed as much as is productive at this point.
You don't want to give your real name to Facebook, but your friend group uses Facebook to communicate. Herding all the cats into using Signal doesn't work because some of them want to use Discord and some of them want to use IRC and some of them actually want to use Facebook, so you're stuck with the status quo, which is Facebook. You have no choice because the choice was made by the group before you arrived.
You don't want a record of everywhere you go being created and associated with your real name, e.g. because you're a persecuted religious minority or gay and don't want that secret being leaked when you go to services or gay bars. You can't use a car for this because the DMV requires your real name and requires you to display a license plate that gets recorded on ALPR cameras everywhere. If Uber requires your real name to use their app and the local transit authority requires your real name to buy a multipass and nobody else lets you buy transit without giving your name either, there is no "use a competitor" because there is no competitor that doesn't track you.
> I'm not actually arguing that socially we shouldn't have "Personas" or access to multiple email addresses or whatnot, etc. I'm arguing that personas should be specifically chosen by products on top of a strong cohesive underlying human identity system (by not using some global id as a primary key in the users table or even storing it in the first place, or by allowing a less strict form of authentication).
Then if you have two social media accounts meant to be separate, the social media company knows that they're both the same person, and when they get breached, so does everybody else.
> If your message board doesn't need to enforce uniqueness of humans, or enforce that posters use a real name, then it simply doesn't (maybe email is good enough for it).
But maybe it does anyway, even though it doesn't need to, because correlating identities is profitable. And because social networks have a network effect you still have to use that one to communicate with all the people you can't get to switch to one that doesn't.
> However, if your bank does need to, it has a good way to do so not a shitty one.
It's still not clear why they need one at all. You can't get a driver's license in someone else's name because attesting that they're you to the DMV is a crime. You can't get a bank account in someone else's name because attesting that they're you to the bank is a crime. What is being added by requiring the prospective criminal to do the former first and then setting up some system for the DMV to securely assert things to the bank? Just arrest them for giving a false name to the bank in the same way you would arrest them for giving a false name to the DMV.
Or stop requiring banks to demand this. KYC laws are ridiculously ineffective, and it's unreasonable that you can't easily buy things over the internet without giving your name.
> And as a user I'd rather my account recovery be rooted in a socially robust system even if higher order services don't need to chain their account/user records back to a unique person ID.
There are fundamentally two ways to do account recovery.
One is secrets. You have your email password or your secret key in your hardware security token and use it to prove that it's your account.
The other is laws. You assert that it's your account and if it's not then you go to jail. This one inherently has to be done within the jurisdiction because it's premised on seizing the liar and incarcerating them. It doesn't work if you can make the assertion from Somalia and be immune from consequences.
You can voluntarily tie these two together right now. Give the secret account recovery information to any trusted party you like that will only give it back to someone who shows up in person, asserts that they're you, and is subject to prosecution if they're not.
What you're asking for is the ability of corporations to force you to tie them together as the price of admission, even if you don't want to, which they then will any time they have enough market power that you can't avoid doing business with them. I like it better when it's voluntary -- that's not the same as take it or leave it.
> Powerful tools come with great responsibility.
This isn't a tool, it's a law.
> I actually think that a strong identity system would help us avoid slipping into a totalitarian nightmare where all the tracking happens in the dark behind the veil (essentially what we have today). I want people that need to track you to declare it loud and clear so that I can make informed trust decisions on a service by service basis.
But how does it solve that? Suppose you could still refuse to give your name in this new system. Well, you can already do that now and they'll still fingerprint your device etc. What's going to stop them then?
And if your answer is laws prohibiting device fingerprinting etc., wouldn't those laws do that without any centralized identity system? They're independent things.
> Anyway you really seem to be arguing from a position where you assume this tool will be used unilaterally by everyone for bad.
I think there are ways to solve the problems this purports to solve without creating the problems that it creates.
> The solution is build a strong robust framework around which information is clearly in the domain of user-controlled identity/PII and that shall not be abused without consequence, and then enforce the law. How is that not clear?
That has two major problems.
1) There is no way to verify what they do with it. Once they have the information, what they do happens entirely within their own organization, which the user has no way of knowing. They'll lie about it, or secure it inappropriately and then have it leaked. The only real solution is for them never to have it to begin with, not laws on what they can do with it that nobody can verify.
2) Defining PII in this way is basically hopeless, because whether something is personally identifiable is context-specific.
You want to prevent a social media company from getting your PII, so you never give them your name or date of birth, all they have is your username with them. If the same company owns a retailer, you make a separate account with the retailer and the social media service still doesn't have a physical address for your social media account even if the retail service does.
Give that company a way to prevent you from having "two accounts" and now you have one account and your social media account is correlated with your name and physical address. But they get to claim they need the information because the retailer has a legitimate need for your shipping information. And the username goes from not identifying you to identifying you.
> We live in a blurry purgatory where nobody knows what exactly is an identifier and how it should be respected because we don't have strong digital identity.
How would "strong digital identity" change that? All it would do is create an additional form of PII. All of the others would still be there and be just as uniquely identifying, including the ones that weren't created to be or appear to be at first glance but are, or are in combination with some other variables they also know.
> The ad industry doesn't need a credential document to track you. They just tag you with their own UUID when they see you and your shitty browser (also built by ad-tech) does the rest.
It's not that hard to maintain multiple identities and keep them separate. The easiest way for laymen is to use separate devices; older devices are cheap and more than fast enough for basic internet use if you just want to read the news on a device that doesn't know where you work etc.
Forced single identity kind of throws that out the window as soon as they find any way to correlate accounts using the same ID, and do you really think they won't?
> It doesn't create a single new problem (or if it does it's strictly in the realm of unsophisticated doom and gloom tirade FUD).
Okay, here's a single, specific, new problem: If your government ID is digital rather than physical then things that used to require a criminal to be physically present in your jurisdiction can now happen over the internet from countries where they have no fear of prosecution.
> It makes a shitty system better for the vast majority of humans who'd aren't super fond of internet trolling, scalping, spam, bullying, and all manner of activities that our current system tacitly glorifies.
There are alternate ways to address these problems that don't involve massive centralization of authentication.
> Privacy is not one dimensional. If you're competent you understand that privacy isn't "nobody knows anything about me". Privacy is about only sharing sensitive information with people you trust.
That's kind of the point. You're already free to give truthful information to anyone you trust. Now what do you do if you don't trust someone but they demand your info anyway and you're not in a position to refuse?
> I want technology to augment and enhance human systems. I don't want to evolve into a trans-humanist hive mind type of civilization where we're all faceless interchangeable worker bees without any sort of reputation or identity.
There is a difference between faceless anonymity and having multiple identities. The latter is how human society has always operated. People behave differently in front of their parents and their friends. They wear different clothes to work and to play. They say things in confidence to people they trust that they wouldn't say to people they don't.
But now you're not just saying it to the people you trust, you're saying it to people you trust and a huge corporation who records it forever and often gets breached. Keeping a thick line between these different identities is something we need to support, not inhibit.
You're really looking for a rate limiter to prevent someone from creating a million accounts. You don't have to merge everyone's pseudonyms into a totalitarian centralized identity system for that. All you need is something that puts a price on account creation. A literal price would work fine. So would a dozen other things.
The real problem is that services don't want something that adds friction to account creation, but they do want to track everyone. And what I'm saying is that we should fight against making the tracking everyone thing frictionless.