For example you could have the website never knowing your actual ID but simply passing an encrypted string to the national server, which would return a 200 response if the document is valid. You could also have additional requests like "is the user 18+".
The website will just know the request is coming from something which has a valid ID available. The state will also not know which pages you browsed, only the domain of the request, just like with HTTPs your ISP does not know exactly the pages you browse but just the websites themselves.
And before someone talks about the state knowing your browser history: they already can by calling up your ISP, and they would get a lot more information than this mechanism would provide.
If any of that trust is broken my privacy is at risk.
> And before someone talks about the state knowing your browser history: they already can by calling up your ISP, and they would get a lot more information than this mechanism would provide.
That depends on how you browse the internet today, and how the ISP tracks it. Simply using a different DNS service goes a long way, and using a VPN or the tor network may not be totally fool proof but should get around the basic drag nets am ISP is likely to use.
No, there isn't. It's basically an OAuth login flow. The spec is publicly documented, anyone can register applications and check if the government is responding as desired, both by correctly requesting auth for the correct scopes in the government-hosted auth page, and by checking that the data returned from the gov matches what the spec promises.
A) used as political chaff for jockeying by power hungry politicians as distraction fodder or FUD material
B) centralized by the intelligence community of your country, or an allied country with an agreement that they'll do the work for your government that your government can't.
There are things that simply should not, nay, must not be made.
The Single Identification Number is one. We have all the tools to do it today. The only thing keeping it from happening is refusal to implement at the grassroots level.
Just the domain is still a pretty major information leak.
> And before someone talks about the state knowing your browser history: they already can by calling up your ISP, and they would get a lot more information than this mechanism would provide.
Yeah, but they have to ask. This creates a system that requires preemptively sending them that information.
My ISP will tell them I spend most of my time connected to Mullvad VPN, and Mullvad will tell them they don't know anything about what any particular IP address was doing.
Having to give identity attestations either directly or proxied by a government server would make such anonymous browsing much more difficult, if not impossible.
The ISP, with SNI implemented, would only be able to tell the state that "a device connected through this physical location accessed a server through Cloudflare".
1. 18+website tells the browser age verification is needed, gives a random token
2. Browser signs a verification request with the local ID card (or a key temporality allowed to do so), forwards it to government server
3. Government server sees the request with random token, signs both, answer the browser
4. Browser forwards signed attestation to 18+website.
The government server only sees the random token. The website only has the attestation. There are other things that can be nitpicked against, but not this. For instance, can we require local ID cards? What about foreign visitors? Possibly an attestation from their passport? And of course, browsers sit in the middle and see everything.
However, this could be a useful mechanism to have. For age verification, nationality check, or even identity check on official websites. And if we have this, it's bound to be abused in some ways (Facebook could require an ID check).
Ah, ha!
The PR spin necessary to kill this in the US would be to connect it national ID. I hadn’t thought of that.
A narrative about national ID with some vague “mark of the beast” insinuation thrown in and suddenly a large political faction who otherwise would care about this would be opposed. I like it.
I think a political strategy of getting rural school districts + 20 State governments to go on record saying they will not purchase or use computers that have Google WEI could be very effective.
