Proving Identity Trustlessly(barisser.com)
barisser.com
Proving Identity Trustlessly
http://barisser.com/2015/10/consensus-and-identity/
5 comments
I don't think meeting physically is a problem if you only do it once, or periodically during your life. The problem happens when every organization that wants to be sure you're really you requires you do go through the same ordeal.
Imagine there was a company that had offices around the world which would prove your identity and give you a USB key to reuse that proof whenever you needed it. You could use the same identity to open a bank account, get married, get a drivers license, get a passport, everything.
Imagine there was a company that had offices around the world which would prove your identity and give you a USB key to reuse that proof whenever you needed it. You could use the same identity to open a bank account, get married, get a drivers license, get a passport, everything.
That's what a government-issued ID is for.
Like Estonian e-Residency: https://e-estonia.com/e-residents/about/
This is a promising approach. I believe what the author is suggesting is that we construct an unbroken chain of custody binding various real-world proofs of identity to an arbitrary address on the blockchain. For instance, If there is a secure and unforgeable way to take periodic photographs of ourselves, which doesn't sound infeasible given the existence of modern facial recognition systems, we could certify the evidence in a mutable fashion using the timestamping data. The general idea is to provide a way to document some uniquely identifiable set of details that only we could have access to at a given time.
It doesn't necessarily have to be a photograph. Doctored personal IDs, attestations from third parties, and biometric devices could serve a similar function. All we actually need to do to prove uniqueness is to be the person who maintains this continuously updating record of entries.
The main draw back has more to do with the fact that you could still create more than one identity by re-using the uniquely identifying information, in which case we would need some kind of pattern recognition system to analyze the number of times the information has been invoked to create multiple identities in some larger public dataset.
It doesn't necessarily have to be a photograph. Doctored personal IDs, attestations from third parties, and biometric devices could serve a similar function. All we actually need to do to prove uniqueness is to be the person who maintains this continuously updating record of entries.
The main draw back has more to do with the fact that you could still create more than one identity by re-using the uniquely identifying information, in which case we would need some kind of pattern recognition system to analyze the number of times the information has been invoked to create multiple identities in some larger public dataset.
How much does real-life identity actually matter online? There are only a few situations (e.g. interviews) where identity should affect the outcome of interactions, yet face-to-face meeting is impossible.
Most interactions online are not affected by identity, but by action. I don't care if this article was written by the real Andrew Barisser or by the pile of hyper-intelligent cats posing as him.
Most interactions online are not affected by identity, but by action. I don't care if this article was written by the real Andrew Barisser or by the pile of hyper-intelligent cats posing as him.
It matters enormously in financial transactions for regulatory reason. Companies that want to process transactions need to have at least a defensible mechanism for identifying their customers.
Contact discovery is a desirable feature, one no one has really figured out how to do without sharing info with a server.
I posted this on the reddit post too, but briefly: this is a solved problem for decades now. The PKI exists to do exactly this: bind public keys to identities, both internet-based and physical/legal.
I have a public key bound to my legal identity in a USB stick. I use it to sign PDFs and things. This is not a problem that requires block chains or anything new. If you want to see people do it more often, the existing infrastructure is fine - it just needs polishing. The software works but is often clunky.
Of course that's a circular problem. The reason it's clunky is not that many people care about digitally signing things or encrypting messages. After the big initial investments in the 90's, companies realised these were niche features. So they stopped investing and the whole thing kind of fell by the wayside and got bitrotted. Now apparently we have people who don't even know about it at all!
I have a public key bound to my legal identity in a USB stick. I use it to sign PDFs and things. This is not a problem that requires block chains or anything new. If you want to see people do it more often, the existing infrastructure is fine - it just needs polishing. The software works but is often clunky.
Of course that's a circular problem. The reason it's clunky is not that many people care about digitally signing things or encrypting messages. After the big initial investments in the 90's, companies realised these were niche features. So they stopped investing and the whole thing kind of fell by the wayside and got bitrotted. Now apparently we have people who don't even know about it at all!
That picture with block chain can be facelifted. Also it looks very much alike those imprisoned inmate entry pictures, except user is self-policing.
My 5p, use steganography on picture to embed actual blockchain piece, to add protection against facelifting. Do not hold it on picture.
If you want true proof that a certain identity belongs to someone, you either have to meet with them physically and get the key, or trust a 3rd part to have done it for you. So far, everything else have fallen short, and this is not an exception.