5 ms·

Yes, because pieces of paper given out by men with guns are the font of all truth. ADD: Fuck this statist cesspool.

by ywyrd 13y ago

mirkules 13y ago
Would you be more comfortable giving your fingerprint or DNA sample to prove your identity? Side note: maybe there could be a way to irreversibly hash one's fingerprint or DNA sample into an electronic signature
- daveid 13y ago
  Any hashing function would do it, but you leave your fingerprints and DNA anywhere. Would be easy to get access to it and copy.
  - bobbydavid 13y ago
    that's fine, its a public key :)
    - daveid 13y ago
      I believe proving identity can only be done using a private key.
- growse 13y ago
  The problem with that, of course, is that someone's DNA or fingerprint isn't a secret. There's no reason why I couldn't take your fingerprint, embed it into a signature and claim to be you. And this is part of why authentication and identity are very difficult things to do right, mostly because very few people have thought about what it is they're verifying. If I publish a public key and say it belongs to me, 'Bob Smith', the only practical use that has is that you can verify that a future message signed by 'Bob Smith' was signed by someone with access to the same private key as the guy who originally published the public key. Any assumption about who 'Bob Smith' actually is, and who that corresponds to in the real world (what other identities do they assert), and also that 'Bob Smith' is a single entity, are simply assumptions. It's impossible to pin a human down to a single, guaranteed verifiable, non impersonatable and non revocable identity. 'Documents issued by men with guns' isn't foolproof, but we use it as a trust anchor mostly because everyone else does, and we don't have much alternative.
  - mirkules 13y ago
    The thing about a fingerprint or even a dna sample, in this use case is that you send your signature ahead of time and verify yourself phyisically at the party. Does your fingerprint hash match your fingerprint? That is more difficult (but not impossible) to spoof. At the end of the day, this discussion stems from notion that government ids are unreliable as a means of verification. Granted, but for what we are trying to achieve in practice is preservation of privacy and data. I was trying to point out that identification of a person - true identification - can be at conflict with our ultimate goal of privacy, since we have to give up a piece of data to prove we are who we say we are, and contemplated finding a way to technically make it happen (in practice) without sacrificing PII.
    - growse 13y ago
      I see what you mean - you could probably do something like publish your public key and then publish a signed copy of your fingerprint hash. Anyone else could do the same thing, but an imposter wouldn't be able to convincingly produce your fingerprint on demand when physically present. At least, not without a lot of funding and cleverness.
    - willvarfar 13y ago
      So you are tying the key to fingerprints or other biometric, but how do you tie that to an identity e.g. a name?
- jerf 13y ago
  Falsehoods programmers believe about DNA: 1. A person has only one genetic code in their body. 2. A person's genetic code never changes. etc. In the spirit of "falsehoods programmers believe about names" and "... about addresses".
  - im3w1l 13y ago
    Those are solvable problems though. Or are you saying 23andme doesn't work?
    - wavefunction 13y ago
      23andMe is not going to provide you with an "authoritative" DNA "fingerprint" because how would they tell that this genetic sequence in this chromosome from this cell is legit but this contradictory sequence in this other cell is different. Obviously noone has the capability to do this, so they present you instead with "most likely" results. Not the level of proof I'd be looking for in a court of law.
    - jerf 13y ago
      No, they aren't. I did not say "A person's tested genetic code never changes", I said exactly what I meant, which is that genetic codes can be changed. Retroviruses do it. Further, on a grand scale, chimeras [1] exist, with human chimeras often entirely unaware of it (while my priors would suggest I am not one, I can't even come close to proving that to you with the rather meagre medical tests I've had done on me), and on a smaller scale, small mutations in cells can easily propagate out into the body over time, even before we ignore the matter of cancer. Most of the time, this doesn't matter, but if we're talking about taking hashes for security, suddenly it does.
  - willvarfar 13y ago
    3. A person's DNA is unique I'm thinking identical twins. Got anything for #4?
krapp 13y ago
Odd. I don't recall anyone at the DMV forcing my license on me at gunpoint.
r0s 13y ago
I think you mean indifferent bureaucrats without guns.

Yes, because pieces of paper given out by men with guns are the font of all truth. ADD: Fuck this statist cesspool.

by ywyrd 13y ago

Yes, because pieces of paper given out by men with guns are the font of all truth. ADD: Fuck this statist cesspool.

Would you be more comfortable giving your fingerprint or DNA sample to prove your identity? Side note: maybe there could be a way to irreversibly hash one's fingerprint or DNA sample into an electronic signature

daveid 13y ago
Any hashing function would do it, but you leave your fingerprints and DNA anywhere. Would be easy to get access to it and copy.
- bobbydavid 13y ago
  that's fine, its a public key :)
  - daveid 13y ago
    I believe proving identity can only be done using a private key.
growse 13y ago
The problem with that, of course, is that someone's DNA or fingerprint isn't a secret. There's no reason why I couldn't take your fingerprint, embed it into a signature and claim to be you. And this is part of why authentication and identity are very difficult things to do right, mostly because very few people have thought about what it is they're verifying. If I publish a public key and say it belongs to me, 'Bob Smith', the only practical use that has is that you can verify that a future message signed by 'Bob Smith' was signed by someone with access to the same private key as the guy who originally published the public key. Any assumption about who 'Bob Smith' actually is, and who that corresponds to in the real world (what other identities do they assert), and also that 'Bob Smith' is a single entity, are simply assumptions. It's impossible to pin a human down to a single, guaranteed verifiable, non impersonatable and non revocable identity. 'Documents issued by men with guns' isn't foolproof, but we use it as a trust anchor mostly because everyone else does, and we don't have much alternative.
- mirkules 13y ago
  The thing about a fingerprint or even a dna sample, in this use case is that you send your signature ahead of time and verify yourself phyisically at the party. Does your fingerprint hash match your fingerprint? That is more difficult (but not impossible) to spoof. At the end of the day, this discussion stems from notion that government ids are unreliable as a means of verification. Granted, but for what we are trying to achieve in practice is preservation of privacy and data. I was trying to point out that identification of a person - true identification - can be at conflict with our ultimate goal of privacy, since we have to give up a piece of data to prove we are who we say we are, and contemplated finding a way to technically make it happen (in practice) without sacrificing PII.
  - growse 13y ago
    I see what you mean - you could probably do something like publish your public key and then publish a signed copy of your fingerprint hash. Anyone else could do the same thing, but an imposter wouldn't be able to convincingly produce your fingerprint on demand when physically present. At least, not without a lot of funding and cleverness.
  - willvarfar 13y ago
    So you are tying the key to fingerprints or other biometric, but how do you tie that to an identity e.g. a name?
jerf 13y ago
Falsehoods programmers believe about DNA: 1. A person has only one genetic code in their body. 2. A person's genetic code never changes. etc. In the spirit of "falsehoods programmers believe about names" and "... about addresses".
- im3w1l 13y ago
  Those are solvable problems though. Or are you saying 23andme doesn't work?
  - wavefunction 13y ago
    23andMe is not going to provide you with an "authoritative" DNA "fingerprint" because how would they tell that this genetic sequence in this chromosome from this cell is legit but this contradictory sequence in this other cell is different. Obviously noone has the capability to do this, so they present you instead with "most likely" results. Not the level of proof I'd be looking for in a court of law.
  - jerf 13y ago
    No, they aren't. I did not say "A person's tested genetic code never changes", I said exactly what I meant, which is that genetic codes can be changed. Retroviruses do it. Further, on a grand scale, chimeras [1] exist, with human chimeras often entirely unaware of it (while my priors would suggest I am not one, I can't even come close to proving that to you with the rather meagre medical tests I've had done on me), and on a smaller scale, small mutations in cells can easily propagate out into the body over time, even before we ignore the matter of cancer. Most of the time, this doesn't matter, but if we're talking about taking hashes for security, suddenly it does.
- willvarfar 13y ago
  3. A person's DNA is unique I'm thinking identical twins. Got anything for #4?

krapp 13y ago

Odd. I don't recall anyone at the DMV forcing my license on me at gunpoint.

r0s 13y ago

I think you mean indifferent bureaucrats without guns.