Thank you for watching!This is channel is run independently.If you would like to show your support - please like, share & feel free to leave comments.Subscri...
A pretty good system, the crucial implementation being a robust consent management system for data access, and Metadata tracking to make sure the account identifier isn’t being used behind the scenes as a de-facto tracker by the public sector.
To me the risk of Digital ID is two fold, one it gives the government a centralized means of tracking individual behavior and thereby crushing dissent (from a Social Credit System, to straight up Russian style gulagging the opposition). On the flip side it gives private sector actors a central immutable identifiers to associate behavior with that can’t be erased by deleting or abandoning an account.
Age Verification is the point where these two concerns are merging into one. Abolishing online anonymity is tantamount to universal surveillance by both the state and private actors, setting up a system of automated persecution tyrants have dreamed of for ages but hasn’t been possible until today with Machine Learning making mass data processing automation both viable and feasible.
Fascist population control and the “final solution” weren’t possible in the way they were implemented until IBM sold the Germans early tabulating machines / computers. ML is the next phase of that same arc of development.
Use of Digital ID to log internet activity is what makes individual data streams continuous, contiguous, and compileable by default.
The consequences are clear, the question is what we can do to prevent it from happening.
So I 100% agree with everything you’ve said, and to be clear, I’m not Estonian, have never been to Estonia, and have never seen the system in question, but:
gives the government a centralized means of tracking individual behavior
gives private sector actors a central immutable identifiers to associate behavior with that can’t be erased
I don’t believe that either scenario is possible in the Estonian system. At least, they’ve gone to great lengths to make those scenarios very hard to achieve at either end.
This is my (probably simplistic, and definitely not guaranteed accurate) understanding of the process using the example of age verification.
Porn Site A wants to verify User D’s age. D has previously registered their DOB in Govt. System B
A shows the request to D, which says: I would like to verify JUST that you are over 18. Not your exact DOB, and no ID’s, just enough to prove that you are authorized to view dem titties.
D then goes to intermediary system C and says: Please generate a 1 time use certificate that proves I’m older than 18.
C checks with B, and generates a “YES” token that it presents back to A.
A and B haven’t communicated with each other and B (the govt.) have no knowledge of the transaction, but A still has a valid method of authorizing D without identifying them.
The problem is C could be tracking the user. I believe in Estonia, this intermediary system is outside govt. control, but is regulated by them. They’re audited like banks. I believe this is supposed to be all local, and would just be a cryptographic wallet for your govt. issued certs, and requests should be between A and your device, not a 3rd party server.
Another problem is “This site uses cookies” style abuse, and users just agreeing without understanding what they’re agreeing to. They have authorities and laws in place to prevent that theoretically. No idea how effective they are
Anyway, I kind of went off a bit here. Point is, the Estonian system is pretty robust, and really cool
Yes, the idea of the physical ID card they discuss makes a lot of sense, however that has the problem of associating your device with your ID.
When it gets to cloud hosting the personal data and an intermediary validation service that’s where I get even more skeptical.
I have a vague idea about a system that uses a time and topology based encryption where a person’s private information is encrypted and can generate a public key pair that will only match within a set time frame so that the data is held on government servers fully encrypted and when the user issues a “consent” that consent enables validation of a check-sum when both the user and the website provide the public keys without directly querying the government database. So basically the website is issued a public key by the server that works for all citizens that are above an age limit, and the users are sent private keys from their government data store whenever new data is encrypted. If the user’s age is above the limit, the user’s key will validate the age check, and because the key changes rapidly over time it cant be used to correlate the individual across multiple validation checks.
Users can host a version of the data store locally, that can be validated as matching the government store using the query “is there a match to the shape of this encrypted data” rather than querying a specific citizen info store (this is blockchain tech, but can be centralized). This could be used to fight against identity theft, which is certain to be a crime that spikes with any digital ID system. Thats not the most clear but I think you’ll get the gist, no intermediaries necessary.
All this said, in the US there are private services that validate physical ID cards using the codes on the back or a scan of a photo of the ID, so clearly the information has already been made available to private industry from the government through some channel. So that might be even worse than proposed systems in other nations already, I dont know.
Absolutely, C is the weak link. There are ways to mitigate that, though. Like I said, there’s no need for a server. The intermediary can and should be all local.
As for cloud backups, there’s no reason to keep a log of requests, so there shouldn’t be anything to back up, other than the certs themselves. Even if there is though, that’s in the user’s sphere of influence. De-googling is becoming more and more popular, and there’s nothing preventing you from disabling cloud backups.
All this is just to take it back to my original point: The idea has some great benefits, but the implementation matters immensely
A pretty good system, the crucial implementation being a robust consent management system for data access, and Metadata tracking to make sure the account identifier isn’t being used behind the scenes as a de-facto tracker by the public sector.
To me the risk of Digital ID is two fold, one it gives the government a centralized means of tracking individual behavior and thereby crushing dissent (from a Social Credit System, to straight up Russian style gulagging the opposition). On the flip side it gives private sector actors a central immutable identifiers to associate behavior with that can’t be erased by deleting or abandoning an account.
Age Verification is the point where these two concerns are merging into one. Abolishing online anonymity is tantamount to universal surveillance by both the state and private actors, setting up a system of automated persecution tyrants have dreamed of for ages but hasn’t been possible until today with Machine Learning making mass data processing automation both viable and feasible.
Fascist population control and the “final solution” weren’t possible in the way they were implemented until IBM sold the Germans early tabulating machines / computers. ML is the next phase of that same arc of development.
Use of Digital ID to log internet activity is what makes individual data streams continuous, contiguous, and compileable by default.
The consequences are clear, the question is what we can do to prevent it from happening.
So I 100% agree with everything you’ve said, and to be clear, I’m not Estonian, have never been to Estonia, and have never seen the system in question, but:
I don’t believe that either scenario is possible in the Estonian system. At least, they’ve gone to great lengths to make those scenarios very hard to achieve at either end.
This is my (probably simplistic, and definitely not guaranteed accurate) understanding of the process using the example of age verification.
Porn Site
Awants to verify UserD’s age.Dhas previously registered their DOB in Govt. SystemBAshows the request toD, which says: I would like to verify JUST that you are over 18. Not your exact DOB, and no ID’s, just enough to prove that you are authorized to view dem titties.Dthen goes to intermediary systemCand says: Please generate a 1 time use certificate that proves I’m older than 18.Cchecks withB, and generates a “YES” token that it presents back toA.AandBhaven’t communicated with each other andB(the govt.) have no knowledge of the transaction, butAstill has a valid method of authorizingDwithout identifying them.The problem is
Ccould be tracking the user. I believe in Estonia, this intermediary system is outside govt. control, but is regulated by them. They’re audited like banks. I believe this is supposed to be all local, and would just be a cryptographic wallet for your govt. issued certs, and requests should be betweenAand your device, not a 3rd party server.Another problem is “This site uses cookies” style abuse, and users just agreeing without understanding what they’re agreeing to. They have authorities and laws in place to prevent that theoretically. No idea how effective they are
Anyway, I kind of went off a bit here. Point is, the Estonian system is pretty robust, and really cool
Yes, the idea of the physical ID card they discuss makes a lot of sense, however that has the problem of associating your device with your ID.
When it gets to cloud hosting the personal data and an intermediary validation service that’s where I get even more skeptical.
I have a vague idea about a system that uses a time and topology based encryption where a person’s private information is encrypted and can generate a public key pair that will only match within a set time frame so that the data is held on government servers fully encrypted and when the user issues a “consent” that consent enables validation of a check-sum when both the user and the website provide the public keys without directly querying the government database. So basically the website is issued a public key by the server that works for all citizens that are above an age limit, and the users are sent private keys from their government data store whenever new data is encrypted. If the user’s age is above the limit, the user’s key will validate the age check, and because the key changes rapidly over time it cant be used to correlate the individual across multiple validation checks.
Users can host a version of the data store locally, that can be validated as matching the government store using the query “is there a match to the shape of this encrypted data” rather than querying a specific citizen info store (this is blockchain tech, but can be centralized). This could be used to fight against identity theft, which is certain to be a crime that spikes with any digital ID system. Thats not the most clear but I think you’ll get the gist, no intermediaries necessary.
All this said, in the US there are private services that validate physical ID cards using the codes on the back or a scan of a photo of the ID, so clearly the information has already been made available to private industry from the government through some channel. So that might be even worse than proposed systems in other nations already, I dont know.
Absolutely, C is the weak link. There are ways to mitigate that, though. Like I said, there’s no need for a server. The intermediary can and should be all local.
As for cloud backups, there’s no reason to keep a log of requests, so there shouldn’t be anything to back up, other than the certs themselves. Even if there is though, that’s in the user’s sphere of influence. De-googling is becoming more and more popular, and there’s nothing preventing you from disabling cloud backups.
All this is just to take it back to my original point: The idea has some great benefits, but the implementation matters immensely