Mozilla publishes position paper on the EU Digital Identity Framework

https://blog.mozilla.org/netpolicy/2021/11/04/mozilla-publishes-position-paper-on-the-eu-digital-identity-framework/

by xoa • 5 years ago

216 156 5 years ago

blog.mozilla.org

max_• 5 years ago

One of the most important ways in which browsers protect users is through website authentication. For instance, if a person wants to visit Europa.eu, the web browser must reliably ensure that the site is actually under control of the owner of the domain ‘Europa.eu’, and not an attacker on the network impersonating the European Commission’s domain.

MR4D• 5 years ago

Authoritarianism raises its head in all sorts of interesting ways.

Interesting to see the EU choose the path of Kazakhstan.[0]

[0] https://www.internetsociety.org/news/statements/2019/interne...

theplumber2• 5 years ago

A proper online identity framework is long due though. Maybe this is not the proper one but sending copies of my passport, electricity bills and lately selfie recordings as well to "prove my identity" doesn't seem right either.

xoa2• 5 years ago

Governments though can do that through their own passive demand. Ie., they can issue proper smartcards/tokens for citizens to identify themselves with, and then say that those can (and eventually must) be used for electronic interactions with the government itself (taxes being a big one but they'd easily be useful for a range of stuff). Follow/improve open standards. With something good, open and convenient private usage will naturally follow. Government can also by definition get involved with the issue of legal liability and fix BS like "identity theft" by shifting liability for businesses who do not meet good authentication standards. Doing it that way also creates room for fixing serious issues in practice before a natural rollout, as it starts by the government dogfooding its own standard. And if a lot of sites demand it, browsers will respond absent overwhelming reason not to, which itself is a good form of pressure to get said overwhelming reasons fixed.

I'm very doubtful though that trying to just directly legislate how software universally works though bypassing process is a good idea. Massive room for abuse as well.

indymike3• 5 years ago

A proper online identity framework is long due though.

Due by whom, and for what?

Aerroon2• 5 years ago

When this becomes widespread then you can expect to have to authenticate this way everywhere. Want to make a Twitter account? Please authenticate with your government ID. Facebook? Of course. Video games? You bet.

South Korea already has these retirements for (some of) their video games.

ostenning• 5 years ago

I guess that depends what you expect from society and government.

Do you expect that everything runs like an extremely powerful well oiled machine, where 100% interoperability likely means complete surveillance? A seemingly technocratic dystopian reality where every impulse is quantified and catalogued? I think its naive to believe that governments don't want more money, power and control over its citizens and government likely will be extracting more with every optimization the system makes.

Or would you rather an extremely powerful machine that is disjointed, highly flawed and laden with inconvenience in-so-that society doesn't really know who you are? Where the individual has more freedom and liberty, but as a result there is more crime and less "safety". A world where powerful anti-social forces are at play, such as disinformation campaigns, polarization of discourse, fringe movements and revolution.

The commonality is they are both driven by technology. We have built an extremely powerful machine and that has introduced enormous complexity into our society. This complexity equates to entropy and either we pull it together with draconian government policy, or the system unravels.

logifail3• 5 years ago

A proper online identity framework is long due though [..]

You're entitled to your opinion but for me, it's a firm "No, thanks".

I feel considerably more comfortable* carrying a paper document which proves my vaccination/negative test than I do using any kind of government-approved app on my phone.

* that's putting it mildly

kwhitefoot• 5 years ago

We use BankID for this in Norway (and elsewhere in Scandinavia I think).

raxxorrax8• 5 years ago

We spend trillions on e-commerce with "normal" user accounts that worked just fine. Some cases of thefts and other crimes that doesn't warrant any action in my opinion. Meanwhile we have a huge problem with governmental surveillance, which is a worse crime than theft depending on how you grade it.

emteycz3• 5 years ago

This EU effort to control is ongoing for many years now, how is it in any way unexpected?

furi2• 5 years ago

Perhaps I'm out of the loop, but the EU attempting to make it illegal to distribute web browsers that don't include certain features is unexpected (and deeply worrying) to me.

bogle• 5 years ago

I don't think QWACs are at all the same as state controlled root certificates. Browsers aren't going to show EV certificates.

sleevi8• 5 years ago

The proposed regulation requires that QWACs MUST be accepted and recognized as such, such as using the European List of Trusted Lists as part of the root store.

That is, if a QWAC is issued by a CA that is not part of the browser root store, it must not be rejected (as any other untrusted certificate would be).

theplumber2• 5 years ago

Anyone knows how this relates to webauthn and why they need a new way of doing online authentication?

chuckee2• 5 years ago

In a nutshell, the revised Article 45 would force browsers to suspend the ‘root store’ policies that are essential for maintaining trust and security online. [..] At the same time, the types of website certificates that browsers would be forced to accept, namely QWACs

Can someone explain where this 'force' comes from? I wasn't aware the EU had such authority to decide how programs on a users private computer must behave. Would e.g. making a fork of Firefox that does not comply with this digital identity framework be illegal? Or is this just hyperbole from Mozilla, and the browser would be merely non-compliant?

keddad• 5 years ago

Well, the original document states that "Web-browsers shall ensure support and interoperability with qualified certificates for website authentication referred to in paragraph 1...". I'm not sure, however, what punishment, if any, is there for the browsers that don't comply with that regulation.

raxxorrax8• 5 years ago

Not the browsers will be reprimanded. That would be webservices like Youtube that only allows browsers providing a certified ID to let users look at the more controversial cat pictures. It is an extremely transparent power grab.

Mindwipe• 5 years ago

I wasn't aware the EU had such authority to decide how programs on a users private computer must behave.

Why not? They publish directives that result in criminal law in member states all the time.

A directive is published, member states are obligated to turn that into domestic legislation, and yes, ultimately a state can criminalise lots of things if it wants to.

chuckee2• 5 years ago

such authority

Key word "such". Prescribing which certificates I am obligated to trust is many many steps beyond e.g. banning DRM circumvention (which is itself a step too far IMO).

thrower123• 5 years ago

The EU has exactly as much authority as we believe it to have, and as much as the member states are willing to enforce.

Those of us not within their bounds could just decide not to comply with their nonsense, and there isn't a great deal that they could actually do about it.

Instead we're letting Europe pull a California, to the detriment of the entire internet.

Jensson19• 5 years ago

Would e.g. making a fork of Firefox that does not comply with this digital identity framework be illegal?

No, this only applies to medium to large companies shipping browsers and they only have to follow it after operating for 5 years. If you fork a browser and edit it then that is working as intended, and if you fork it and distribute binaries that is also ok since you aren't a medium big company. Possibly the company label refers to CA or site, but the 5 year window gives you plenty of time to refork every 5 years in the worst case, and this only apply if you operate as a browser provider so you can use it yourself forever.

"Web-browsers shall ensure support and interoperability with qualified certificates for website authentication referred to in paragraph 1, with the exception of enterprises, considered to be microenterprises and small enterprises in accordance with Commission Recommendation 2003/361/EC in the first 5 years of operating as providers of web-browsing services"

xoa2• 5 years ago

This did get posted a few weeks ago at the time it was written but didn't get much traction at that point, yet seems like a reasonably important issue. The EU has done worthy things for issues like privacy, but whatever pluses and minuses of regulating personal and business policy I'm a lot more dubious about government sticking its hand directly into how specific software (like browsers) functions. That seems like a serious step beyond merely trying to ensure there is competition and choice in different products, full disclosure about them, level playing fields etc. Dictating implementation details even for open source feels like something with much, much more scope for serious negative side effects getting baked in particularly in fields where best practices move fast.

A negative security example that comes readily to mind are how bad government policies/standards helped cement for a long time the awful practice of complex password requirements including rapid change requirements, "security questions" and so on. These are actively negative for security, people in the field realized pretty fast (and of course many argued from the start) that the only reqs for passwords should be some minimum length, not using previously exposed ones, and having a sufficiently high maximum length that everyone is free to use more comfortable ones like diceware if they wished. While that has been getting revised at last bureaucracy still moves much too slowly there.

Of course this hasn't made it through the gauntlet and hopefully won't, but I'm glad to see it getting some attention.

dahfizz5• 5 years ago

I feel similarly about the EU forcing companies to use usb-C as a charging port. I love usb-C, and it is basically a requirement for any electronic I buy. But forcing everyone to use it until the end of time is ridiculous. Imagine if they had done this a few years ago, and the micro-B connector was mandated. We would never have gotten usb-C.

bjelkeman-again• 5 years ago

EU mandated GSM, which was a success, but we aren’t stuck with it still.

AnssiH• 5 years ago

For the record, the feedback period on the EU charging port directive proposal is still open until tomorrow: https://ec.europa.eu/info/law/better-regulation/have-your-sa...

I quickly glanced at a couple of the feedback documents they've got so far, and they seem to echo your concerns. We'll see if the parliament makes any changes.

phicoh4• 5 years ago

I don't understand the 'never gotten usb-C' part. Modern phones have more than enough space for two connectors. So usb-C next to a micro-B charging port is no problem.

After a while, almost all phone also have usb-C, most people like usb-C, so the industry can petition to replace micro-B with usb-C.

Are there any examples where the EU mandates legacy stuff that is no longer useful, but still has to be kept anyway?

jollybean• 5 years ago

USB-C is at least to some extent about standardization.

It's a less complicated issue, while nuanced, I think most of the details are manageable by a willing political actor.

It's also a known quantity.

This MOZ paper deals with much more complicated things.

I'm wary of involvement, I wonder if there are industry-led solutions that could be supported.

If MSFT, G, FB, AMZN could agree on something with the blessing of the EU and indirectly the US, I wonder if would happen very quickly.

input_sh4• 5 years ago

Imagine if they had done this a few years ago, and the micro-B connector was mandated. We would never have gotten usb-C.

They did, you don't have to imagine it.

In 2009 they've signed a memorandum of understanding with 14 phone companies, which is why micro-B was the standard before type C. Apple was within those that signed it, and used a loophole in the text to ship a lightning-to-micro-B adapter instead.

Around 2016 they've realised micro-B was outdated and notified the signatories that they should switch to type C.

https://www.macrumors.com/guide/eu-charging-standard-proposa...

frankfrankfrank• 5 years ago

On a slightly different angle, my frustration is that it's not done on a general standards or outcome based requirement. For example rather than dictating a specific thing or even standard like micro-USB, simply require, e.g., that 90% of all power cables must comply with an industry self-organized standard within 3 years of the final release and, e.g., that the largest firms must subsidize the compliance by the smallest firms in order to prevent gaming the system to drive the small companies out of business.

There is a rather significant and major issue that this change highlights; essentially all our politicians and bureaucrats see themselves as smart and wise enough to be central planners and masters of the universe … when the truth could not be farther from it.

Jensson19• 5 years ago

Imagine if they had done this a few years ago, and the micro-B connector was mandated. We would never have gotten usb-C.

But they didn't. These people aren't that dumb, they told companies to settle on a standard, and now that we have a good standard that basically everyone follows they want to make a law to ensure everybody follows it. Bringing up a scenario where they did the right thing and argue "just imagine if they didn't do the right thing here, that would be a problem!" isn't a strong argument.

mariusor• 5 years ago

What makes you believe it's until the end of time? They did do it with micro USB also. From what I can see the mandate changes with the times, so if everything evolves I would assume that they'll update their requirements.

diffeomorphism• 5 years ago

That is a really, really obvious problem, so why do you think you are the first person on the planet who ever thought of it? And that nobody addressed it?

But forcing everyone to use it until the end of time is ridiculous.

Correct, it is ridiculous you think anyone did that.

Imagine if they had done this a few years ago, and the micro-B connector was mandated. We would never have gotten usb-C.

They did. We do have usb-c.

raxxorrax8• 5 years ago

The EU has neither the authority nor the competency to lay out such identity frameworks and I would say they would decrease security in any case. This is again about surveillance and attempts to get control on information.

HTTPS basic auth is secure and should always be an option. There, perfect interop.

There is not enough trust and political currency to accept such measures in my opinion. Formalized ID systems seem to net more attack vectors than what we currently have.

phicoh4• 5 years ago

I wonder why QWACs are less secure than DV.

There is an argument why EV should be treated the same a DV I'm not buying that argument but for the moment let's accept it as true.

However, now Mozilla is arguing that EV is less secure than DV. That seems weird to me.

Currently, browsers have root certificates for lots of countries. I can imagine that for a country it becomes a huge problem if suddenly a major browser decides to reject certificates used by that country's government.

Of course, it would be nice if country certificates could be restricted to country specific resources. Maybe mozilla should push for that.

Jwarder5• 5 years ago

I see two issues at play.

Not all European CAs meet browsers' root programs requirements. Forcing everyone to accept those certs weakens all root programs (Mozilla's, Microsoft's, etc).

There is also the concern that special indicators displayed with a certificate can mislead users. A scummy company with an EV cert isn't any more trustworthy than if they had a DV cert, but browsers want to be careful not to imply a fancy logo makes the site any safer.

phicoh4• 5 years ago

I doubt there is any text that browsers have to enable those certs by default outside the EU.

It could weaken protection for people in the EU, but then the way forward is to make requirements for root certs mandatory in the EU.

Maybe I missed it, but did the document require special UI elements for EU certs?

Jensson19• 5 years ago

Not all European CAs meet browsers' root programs requirements.

That sounds like a huge problem, why should EU trust that USA handles trust certificates well? Of course they would want to regulate this instead of leaving that extremely large security hole open, letting USA alone decide what counts as secure or not is not in EU's interests.

kjetil3• 5 years ago

Are the TSP audit requirements less strict than what the browsers’ root programs require?

advisedwang• 5 years ago

They're not saying EVs or QWACs are themselves less secure than DV. Rather they are saying that they aren't more secure (because of difficulties interpreting them) and so leading users to place more trust in them can hurt the consumers.

phicoh4• 5 years ago

Most browser vendors do business in the EU. And governments in general have a right to set standards for products and services.

In some sense, Firefox could be an exception, because Mozilla doesn't seem to do a lot of advertising in the EU.

It is not like Apple, Google, or Microsoft can say: we don't really care about the EU, we just remove the browser from products we distribute (directly or through third parties) in the EU.

sleevi8• 5 years ago

One element that results in less security is that it becomes more difficult to replace.

For example, QWACs cannot legally be automated (e.g. via ACME), because of certain restrictions applied to needing to validate the natural or legal person making the certificate request. This actually was an issue for one CA (BuyPass) that tried to support ACME but ran afoul of the framework.

While originally QWACs were proposed as optional, regulation such as PSD2 attempts to make them mandatory for (financial services) servers to obtain. If one of those keys is compromised, then the server wishing you obtain a replacement certificate may have to wait weeks to obtain such a certificate, or make an in-person visit to the CA (e.g. the post office).

A considerable number of compromised or misissued certificates have failed to been revoked on the industry-agreed upon timelines (24 hours or 5 days, depending), because of challenges CAs have faced because their customers haven’t (or legally can’t) automate replacement, and because the additional information in the certificate requires manual validation, despite having no technical impact on the TLS connection.

kjetil3• 5 years ago

Not being able to automatically renew certificates seems like a rather minor point in the bigger picture.

I get QWAC goes against the trend of phasing out EV certs. But isn’t the real issue that the browsers don’t trust TSP audits carried out for EU member states?

denton-scratch7• 5 years ago

QWACS are untrustworthy because they can be issued by a CA that is not publicly audited.

But the way I understand it, a QWAC is an identity certificate, issued to users, not to websites. AIUI, websites are to be compelled to accept such user-certs in lieu of a password. Well, I don't see what that has to do with the contents of the root store - that controls the website identities that my browser will accept, not the user-identity that the website accepts.

I read the position paper, but not the regulation. I'd like to see a better explanation of the regulation.

kjetil3• 5 years ago

QWACs are for web sites, not users. CAs have to be audited as a TSP in order to issue them and be approved by the member state.

Shadonototra2• 5 years ago

Why is it ok for an american company to collude with foreign politics?

Can't they focus on their broken system first?

muricula• 5 years ago

This sort of thing is actually somewhere I think Mozilla can make a difference. As a major browser, they are listened to when they lobby standards bodies and political bodies about the web and internet security, and very often they are listened to.

I agree Firefox could be better, but time spent on effective lobbying which will help all browsers is well spent.

zoobab• 5 years ago

EU laws are written by foreign actors, just look at the lobbying going on on DSA/DMA, those foreign corporations are writing laws against the interests of European companies and citizens.

raxxorrax8• 5 years ago

As someone from Europe I am thankful for any resistance to such plans and many laws implemented by the EU are written by foreign companies. Companies like central administrations, far easier to lobby against compared to citizens that must carry themselves through countless more or less democratic institutions.

parasense• 5 years ago

I think the Browsers should swing the axe the other direction. Indicate the website is broken when EV certificates are present. Also, indicate all websites are broken if/or when the Root-CA-trust ever be forcefully extended to include EV CA authorities, in particular state backed authorities.

I'm not sure about the EU, but forcing browsers green-light weak security is a violation of the USA's 1st amendment freedom of speech. Regrettably I would not be surprised if EU took a more authoritarian stance.

pantulis• 5 years ago

"forcing browsers green-light weak security is a violation of the USA's 1st amendment freedom of speech."

I understand the issues mentioned in passing scammy actors as legitimate but, in which way your rights to speech would be vulnerated?

vhold• 5 years ago

It would be compelled speech if the law required the browsers to say that a connection is secure when its creators don't want it to.

https://en.wikipedia.org/wiki/Compelled_speech

Whether or not it would violate the 1st amendment would be up to the courts to decide.

deadbunny• 5 years ago

I'm not sure I follow. How are EV certificates weak? They use the same cyphers and just have extra validation on the owner/domain.

mikeiz404• 5 years ago

It appears to be more of a UI issue where the legal entity name is shown along side or sometimes in place of the URL which can be misleading.

To compound problems legal entity names are not required to be unique across states or countries so an EV certificate for a popular company name can be obtained in another geography and presented to the user on an attacker controlled domain.

https://www.bleepingcomputer.com/news/security/extended-vali...

sofixa• 5 years ago

I'm not sure about the EU, but forcing browsers green-light weak security is a violation of the USA's 1st amendment freedom of speech. Regrettably I would not be surprised if EU took a more authoritarian stance.

Care to expand on this? I have a hard time making any sort of connection.

malermeister• 5 years ago

I don't see how the USA's first amendment is at all applicable to the EU.

66fm472tjy7• 5 years ago

Is the draft of the revision available anywhere? I don't see a link anywhere in the position paper. Article 45 in the current regulation[0] says nothing about browsers. I am curious about the exact language that would force Firefox support the technology and include the TSPs in their root store.

[0] https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...

sleevi8• 5 years ago

https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=COM%3A20...

denton-scratch7• 5 years ago

It's ultimately my decision which certificates I will trust. I can choose to trust just one certificate, and ignore the Mozilla root store, or I can use Mozilla's root store, and modify it. These are my decisions, not Mozzilla's.

So this proposed regulation mandates that my browser must support QWAC, and include TSP roots? Does that mean that browsers MUST deprive me of the ability to control my root store? Would I be in violation if I modified my (open-source) browser so that it was no longer in compliance?

Supposing I published my patch on a website outside the EU (e.g. in the UK)?

To be clear, I don't want a root cert from any entity that is effectively controlled by a government, to be trusted by my browser. Some governments bother me more than others, (for example) a Turkish government-controlled CA was caught forging certificates. There's still a Turkish CA in there, I see; Debian have seen fit to remove it.

It's all fine, the sky won't fall. As long as I can still decide who I trust.

Jensson19• 5 years ago

This is all the initial recommendations says about browsers and certificates, there is nothing about preventing browsers from allowing the users to configure this, just to have them support it (and most of this is already supported by browsers, this is mostly just a recommendation to force all browsers to implement site security):

To that end, web-browsers should ensure support and interoperability with Qualified certificates for website authentication pursuant to Regulation (EU) No 910/2014. They should recognise and display Qualified certificates for website authentication to provide a high level of assurance, allowing website owners to assert their identity as owners of a website and users to identify the website owners with a high degree of certainty.

Edit: It also limits this to larger web browser providers in another part and only after 5 years. So people are free to run their own forks of browsers, so I doubt that it will be forbidden for browsers to just have a setting for specific sets of certs.

denton-scratch7• 5 years ago

Thanks.

raxxorrax8• 5 years ago

"It is just this" is something we hear very often when it is about user surveillance.

And then mandate sites use it for any age restricted content? Comes a year later. And everything against a backdrop that some EU members want encryption backdoors. Meanwhile we have safe e-commerce for years. No, thank you.

motohagiography2• 5 years ago

The use cases for digital identity are almost all pernicious. Sure, you can use it for nice things like public services, except we do that today quite expansively without one, and why do we need biometric level proofs for that?

A government digital identity means that every informal transaction in the economy that uses it relies on the state as an inline broker. We can see this today with vax passports, where just this month you have to check-in with the government before you can enter a restaurant. (only temporary, surely) It's designed to manage people like livestock, and we all know that some pigs are more equal than others. Even vax passports and so-called "mandates," have exploited loopholes in our high trust societies and assumed formlessness as to avoid being challenged legally. Digital identity regimes will use the same indirect methods. This is their strategy.

Why do you need to prove your identity unless you there is some intent to prosecute you? Most of the value in the economy is based on people taking on transaction risk on behalf of others, so replacing it with digital identity will destroy degrees of economic freedom and opportunity for your kids and grandkids. Identity does not create opportunity, it limits it.

Civilization doesn't survive malicious institutions that turn inward against the people they serve, and I hope other technologists think seriously about identity and consider the consequences of it falling into the hands of an enemy or evil institution, because having worked in identity, I guarantee it will.

Jensson19• 5 years ago

Why do you need to prove your identity unless you there is some intent to prosecute you? Most of the value in the economy is based on people taking on transaction risk on behalf of others, so replacing it with digital identity will destroy degrees of economic freedom and opportunity for your kids and grandkids. Identity does not create opportunity, it limits it.

I don't understand this argument at all. In what way does the economy require that people take on risks of identity theft when they trade with each other? I don't see a single instance of trade being limited even if all transactions were between established identities.

There are other issues of tight tracking of course, but I don't see this one.

dabbledash• 5 years ago

Unless the entity that vouches for the identity or oversees transactions wanted to limit the ability of some disfavored participants, for some reason.

throwaway41597• 5 years ago

With the rise of the internet I now consider my identity to be valuable. So I don't give it away for free.

I personally don't want my identity checked unless I'm asking someone to trust me. And I'd rather use a trust-minimizing system before going there. You don't need your id checked when going to the restaurant or the theater. You need to check someone's id when they take your money and promise you something in return (and even then, there may be a better way).

I don't see a single instance of trade being limited even if all transactions were between established identities.

Do you buy something if you need to send a copy of your id? Do you use a website if it requires Facebook connect?

The issues of tight tracking you mention would be amplified by widespread use of id checks so I think it's essential not to do them often.

the_greyd2• 5 years ago

You make a good point. In a state of pandemic, the population IS in some sense similar to livestock, bodies to be managed, since the virus has weaponized our bodies. Wouldn't you say?

tasogare• 5 years ago

The common method to deal with avian influenza is killing all the livestock when one case is detected. Your comparison is scary and uncanny, but well aligned with how violent the pandemic has been handled by various governments.

dwaite• 5 years ago

why do we need biometric level proofs for that?

There's generally two buckets of biometric auth:

1. Local biometric auth, with no metrics shared outside the local context, for convenience in authentication. This would be FaceID/TouchID/Windows Hello sorts of functions

2. Remote biometric auth to prevent certain types of 'friendly' impersonation, such as using a family member's identity for an age or background or credit check. This is say comparing a live camera capture against a previous photo.

You see #2 a lot in identity proofing, e.g. I presented an official document and it is legitimate, but how do they know it's actually the right person vs someone who did some lucky dumpster diving?

For digital identity credential systems which represent those documents, you have both cryptographic document verification and typically have a form of authentication by proof-of-possession of some key, but often people still feel the need for a remote biometric check. The reality is that they should be basing that on an actual need.

motohagiography2• 5 years ago

My point is there is no actual need, and all needs are contrived by policy for policy's sake, usually caused by security nerds (my people) whose rationale is identity because identity, and then we index on geeking out on writing security protocols without product use cases for the people subject to it.

The real problems in identity proofing are things like task delegation, substitute decision makers in elder care, parents doing things on behalf of their kids and kids asserting their parents permission, federation of user attributes with privacy, etc. These aren't difficult technical problems, except you need some way to transfer risk and accountability, which is an absolute quagmire. Universal digital identity (because let's face it, that's what it necessarily is) approaches these problems with a necessary component of a solution, but that's not what it's mainly going to be used for.

Maybe this yields a thought experiment where let's say I write an app for parents and kids where kids can use it to show they have their parents permission to be in a park after dark, walk to school by themselves, participation in a class trip, travel by themselves on a train or plane, get consent for emergency medical procedures, etc. Then that kid grows up and it switches from their parents to being a drivers license, age of majority card, school graduation certificates, their last STD test, list of employers and past salaries, speeding tickets, criminal records, lowest rated tweets, sexual partners etc. Sounds like it could be a real product right? Except that kid never wanted the stupid app that monitors them, the hovering parents who imposed it on them just use them as a source of narcisistic supply, and then their entire life is one of being subject to some proxy for these helicopter parents. The app is capitivity, or more accurately, entry into a panopticon that deprives them of their basic humanity. This is why digital identity is a terrible idea in pretty much every version I've seen so far. It's not chosen, it's imposed, and that's not a product, that's a mandate laundered through tech.

raxxorrax8• 5 years ago

The one application I would see is that government would be in control of biometric information. Today a lot of people share such markers with companies. But many also do not do that and they should also not be forced to do the same with government. That the EU enforced biometric passports without any benefit is bad enough.

Mozilla publishes position paper on the EU Digital Identity Framework

Related Stories