7 ms·

I don’t really trust anyone to get PKI right. There’s enough mistakes in the www realm that pretty well prove bad actors will get through. The alternative is d

by grebc 12d ago

I don’t really trust anyone to get PKI right. There’s enough mistakes in the www realm that pretty well prove bad actors will get through. The alternative is do it offline.

lima 12d ago
eID PKIs have very little in common with the web PKI. There's a national root of trust with strong attestation. It's a very simple trust relationship. You already trust the respective government to issue IDs. Plenty of European countries have an eID CAs and it works fine. The PKI part is a solved problem. Doesn't even need ZKP, the CA can just issue an attestation.
- maratc 12d ago
  I've experienced this "solved problem" when visiting Germany during COVID. On every entrance to a mall there was somebody with a scanner device, and they only let you in if the scanner showed a green mark. I've been fully vaccinated (not EU) but my code didn't show a green mark on their scanner and I was promptly denied entry. The solution was to show them my German friend's code on my phone, this registered just fine, so I could enter anywhere. So the whole "eID/CAs/ZKP/PKI" mumbo jumbo can be easily fooled by a gif file.
  - pas 12d ago
    yes, just as age verification can be fooled by an older friend who gets the check mark.
    - maratc 12d ago
      Reminds me of If you think cryptography can solve your problem, you don’t understand your problem and you don’t understand cryptography. (Bruce Schneier dug into origins of this here: https://www.schneier.com/blog/archives/2026/05/laurie-anderson-is-quoting-me.html https://www.schneier.com/blog/archives/2026/05/laurie-anders...)
  - benregenspan 12d ago
    That part seems to qualify as an unsolved problem. But could anyone have taken the scanned data (or the GIF file) and used it to open a bank account in your friend's name? That seems like the main issue that is genuinely solved by correct implementation of this type of system.
    - maratc 12d ago
      Already today nobody can open a bank account in my name with just a picture of my passport, as the original would be required. My passport doesn't have any of the "eID/CAs/ZKP/PKI", so the question of "what exactly the addition of it solves" remains open. My national ID card supposedly has some of it, the 17-year olds who want to pass as 18-year olds usually show a doctored gif file of their ID card, with a year of birth one or two years before the actual one; this works in ~98% of the cases.
      - lbschenkel 11d ago
        Actually it does. Biometric passports (and IDs) have a chip which is read via NFC and the information the NFC provides is signed by a CA which is the government that issued the passport. ICAO compiles a database of public keys corresponding to each government (plus countries exchange their public keys via bilateral agreements). Unless somebody is doing purely visual inspection, any time a passport is scanned there's PKI involved to validate if the information is genuine.
        maratc 11d ago
        None of that applies to my (non-biometric) passport, and we were talking about banks that don't have the passport-reading equipment to begin with.
  - Nursie 12d ago
    That’s not what the new schemes are about, and they aren’t going to be based on a qr code you can just copy, no. If you’re genuinely interested, look into things like OpenID credentials systems, and similar standards like w3c verifiable credentials.
- grebc 12d ago
  You’re conflating the real life need of ID, with trust in the organisation. Sorry. Wrong.
- thayne 12d ago
  If the scan also included a picture, that was signed with your private key, then it would be harder to spoof.
  - fc417fc802 12d ago
    Not really, the attacker would just need a picture of you which he could then sign (since we're assuming here that he gained access to your key IIUC). That's a pretty low bar compared to the first step of gaining the key.
    - deleted 12d ago
      [deleted]
austin-cheney 12d ago
While that can certainly be true it is still generally safer than username/password for authentication.
martyfunkhouser 12d ago
The US Government is one of the reference implementations of PKI. Unfortunately, IDs are issued 50 different ways by the less competent states. Combine that with accusations that getting new IDs constitutes systematic racism (a widely held belief on HN), ignoring that the ruralest of India has been able to do this successfully, and you're not getting digital ID any time soon.
- abirch 12d ago
  The difficulty for the US is people seem to be against a Federal Government ID. India doesn't seem to have this stigma and hence rural India can solve this problem.
  - micromacrofoot 12d ago
    I don't think people are against it, we already have the social security identifiers as a government layer... it's just that no one in the government is willing to do it for free in a way that is accessible to everyone
    - abirch 12d ago
      I think this is the horse shoe theory where the far left and right are against it. https://www.aclu.org/press-releases/aclu-conservative-and-liberal-allies-denounce-national-id-card-plan-intelligence https://www.aclu.org/press-releases/aclu-conservative-and-li... I know people who don't have a social security number because their parents didn't want them to be tracked by the system.
      - what 12d ago
        Do they live in the woods? How do they work and pay taxes?
        abirch 11d ago
        Yes, very rural place or the woods. No idea about taxes, etc. I remember him explaining that you only need a SSN if you want to receive it and a diatribe about the mark of the beast. When the guy was trying to get a passport, he asked if anyone could show a picture of him from our high school yearbook.
HlessClaudesman 12d ago
or just not ask for it at all. The three times I've needed to provide a scan of my passport were: to enroll in a university course, to buy from an e-commerce site, and to become an app developer. None of those orgs really needed a scan of my passport, which can't be revoked like a cracked password, and will now sit unencrypted somewhere until the end of time or until they are hacked and subsequently shamed into handling their customers data more like radioactive waste.
- dolmen 12d ago
  The only times I had to provide a scan of my passport was to cross a border: - get a VISA to be allowed to cross the border - send to the airline for my flight that will cross the border - show the real passport at the border I have another ID for authentication inside my country, which by the way, is not a driving license (which is used only for car driving usage).
  - grebc 12d ago
    I sold a house recently, my lawyer/solicitor who’s physically known me for 6+ years had to scan my passport & licence to “verify” me according to new AML laws. KYC & AML is poison. Edit: to be clear, this lawyer also represented me when I bought said property.
- BobbyTables2 12d ago
  In my experience, hotels in other countries also take a copy of the passports of all guests. Also learned “know your customer” laws require US people to give passport + SSN to a foreign bank who then reports it back to the US. Given that such bank’s website involves disabling right-click for “security”, the only glimmer of hope is that the data is catastrophically lost due to stupidity before it can be compromised.

by grebc 12d ago

I don’t really trust anyone to get PKI right. There’s enough mistakes in the www realm that pretty well prove bad actors will get through. The alternative is do it offline.

lima 12d ago

eID PKIs have very little in common with the web PKI. There's a national root of trust with strong attestation. It's a very simple trust relationship. You already trust the respective government to issue IDs. Plenty of European countries have an eID CAs and it works fine. The PKI part is a solved problem. Doesn't even need ZKP, the CA can just issue an attestation.

maratc 12d ago
I've experienced this "solved problem" when visiting Germany during COVID. On every entrance to a mall there was somebody with a scanner device, and they only let you in if the scanner showed a green mark. I've been fully vaccinated (not EU) but my code didn't show a green mark on their scanner and I was promptly denied entry. The solution was to show them my German friend's code on my phone, this registered just fine, so I could enter anywhere. So the whole "eID/CAs/ZKP/PKI" mumbo jumbo can be easily fooled by a gif file.
- pas 12d ago
  yes, just as age verification can be fooled by an older friend who gets the check mark.
  - maratc 12d ago
    Reminds me of If you think cryptography can solve your problem, you don’t understand your problem and you don’t understand cryptography. (Bruce Schneier dug into origins of this here: https://www.schneier.com/blog/archives/2026/05/laurie-anderson-is-quoting-me.html https://www.schneier.com/blog/archives/2026/05/laurie-anders...)
- benregenspan 12d ago
  That part seems to qualify as an unsolved problem. But could anyone have taken the scanned data (or the GIF file) and used it to open a bank account in your friend's name? That seems like the main issue that is genuinely solved by correct implementation of this type of system.
  - maratc 12d ago
    Already today nobody can open a bank account in my name with just a picture of my passport, as the original would be required. My passport doesn't have any of the "eID/CAs/ZKP/PKI", so the question of "what exactly the addition of it solves" remains open. My national ID card supposedly has some of it, the 17-year olds who want to pass as 18-year olds usually show a doctored gif file of their ID card, with a year of birth one or two years before the actual one; this works in ~98% of the cases.
    - lbschenkel 11d ago
      Actually it does. Biometric passports (and IDs) have a chip which is read via NFC and the information the NFC provides is signed by a CA which is the government that issued the passport. ICAO compiles a database of public keys corresponding to each government (plus countries exchange their public keys via bilateral agreements). Unless somebody is doing purely visual inspection, any time a passport is scanned there's PKI involved to validate if the information is genuine.
      - maratc 11d ago
        None of that applies to my (non-biometric) passport, and we were talking about banks that don't have the passport-reading equipment to begin with.
- Nursie 12d ago
  That’s not what the new schemes are about, and they aren’t going to be based on a qr code you can just copy, no. If you’re genuinely interested, look into things like OpenID credentials systems, and similar standards like w3c verifiable credentials.
grebc 12d ago
You’re conflating the real life need of ID, with trust in the organisation. Sorry. Wrong.
thayne 12d ago
If the scan also included a picture, that was signed with your private key, then it would be harder to spoof.
- fc417fc802 12d ago
  Not really, the attacker would just need a picture of you which he could then sign (since we're assuming here that he gained access to your key IIUC). That's a pretty low bar compared to the first step of gaining the key.
  - deleted 12d ago
    [deleted]

austin-cheney 12d ago

While that can certainly be true it is still generally safer than username/password for authentication.

martyfunkhouser 12d ago

The US Government is one of the reference implementations of PKI. Unfortunately, IDs are issued 50 different ways by the less competent states. Combine that with accusations that getting new IDs constitutes systematic racism (a widely held belief on HN), ignoring that the ruralest of India has been able to do this successfully, and you're not getting digital ID any time soon.

abirch 12d ago
The difficulty for the US is people seem to be against a Federal Government ID. India doesn't seem to have this stigma and hence rural India can solve this problem.
- micromacrofoot 12d ago
  I don't think people are against it, we already have the social security identifiers as a government layer... it's just that no one in the government is willing to do it for free in a way that is accessible to everyone
  - abirch 12d ago
    I think this is the horse shoe theory where the far left and right are against it. https://www.aclu.org/press-releases/aclu-conservative-and-liberal-allies-denounce-national-id-card-plan-intelligence https://www.aclu.org/press-releases/aclu-conservative-and-li... I know people who don't have a social security number because their parents didn't want them to be tracked by the system.
    - what 12d ago
      Do they live in the woods? How do they work and pay taxes?
      - abirch 11d ago
        Yes, very rural place or the woods. No idea about taxes, etc. I remember him explaining that you only need a SSN if you want to receive it and a diatribe about the mark of the beast. When the guy was trying to get a passport, he asked if anyone could show a picture of him from our high school yearbook.

HlessClaudesman 12d ago

or just not ask for it at all. The three times I've needed to provide a scan of my passport were: to enroll in a university course, to buy from an e-commerce site, and to become an app developer. None of those orgs really needed a scan of my passport, which can't be revoked like a cracked password, and will now sit unencrypted somewhere until the end of time or until they are hacked and subsequently shamed into handling their customers data more like radioactive waste.

dolmen 12d ago
The only times I had to provide a scan of my passport was to cross a border: - get a VISA to be allowed to cross the border - send to the airline for my flight that will cross the border - show the real passport at the border I have another ID for authentication inside my country, which by the way, is not a driving license (which is used only for car driving usage).
- grebc 12d ago
  I sold a house recently, my lawyer/solicitor who’s physically known me for 6+ years had to scan my passport & licence to “verify” me according to new AML laws. KYC & AML is poison. Edit: to be clear, this lawyer also represented me when I bought said property.
BobbyTables2 12d ago
In my experience, hotels in other countries also take a copy of the passports of all guests. Also learned “know your customer” laws require US people to give passport + SSN to a foreign bank who then reports it back to the US. Given that such bank’s website involves disabling right-click for “security”, the only glimmer of hope is that the data is catastrophically lost due to stupidity before it can be compromised.