Re:atproto and the ownership of identity
by immibis on Saturday January 18, 2025 @05:42PM
(#42752008)
Government intelligence agencies, which can print passports at will, will be able to create millions of fake accounts, while the rest of us will be limited to just one. It's a similar problem to the money-given-to-charity idea: when you trust any actor to enforce identity, you're trusting them to enforce identity.
[ Parent
| on HN ]
I don't really think being resistant to evil governments is within scope here. Using passports isn't perfect, but practically speaking it's a hell of a lot better than what we have now which is a free for all.
It only takes a single government losing their signing keys (through whatever means) to break such a scheme.
And if that happens, what do you do? Deny service to that country's citizens?
How often does something like this happen? In that scenario there are a number of options though, one of which is just putting a banner on accounts that are impacted.
More often than you might think. The EU COVID-19 immunology status certificate scheme saw some fraudulent issuances, for example.
And "putting a banner on impacted accounts" both partially deanonymizes and effectively bans legitimate users for no fault of their own.
Travel documents are not a digital identity scheme, and using the ICAO biometric travel document scheme contrary to its explicit design goals is just asking for trouble.
Consider the theory that Russian-government-sponsored bots ran wild with COVID disinformation. It doesn't matter whether you actually believe that theory or not - just consider it. If you allow Russian passports as a valid identification source, then Russia would have no problem running that operation. The same applies to every country of course.
Yeah, and this is why we capture the country that issued the passport we verified. Worst case we can add a feature that allows users to share which passport country they used. And yes, this will mean that Russian users will be screwed unfortunately.