Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Here's an idea that I thought of..

Suppose WebAuthn was the standard authentication scheme everywhere. People used a series of tokens (Yubikeys, phone apps, etc.) with private keys which they use to authenticate to services. The government runs a department where you present them proof of your identity and the public keys from your Yubikeys/whatever, and they would publish a cryptographically signed electronic message which read the equivalent of "the owner of the private keys associated with public keys a, b, and c is a real person"). Then, when you signed up for an account at Twitter, or wherever, they could quickly check that published list and know that you where a real person.

Advantages, you own your own private keys and completely manage your online identity. The government doesn't have any control over where you log in, or who you sign up for accounts with. Also, you can remain anonymous to the site you sign up to. They can check that you're a real person and only signed up once, without actually knowing your real name or other details.



This still doesn't allow for the case where you have multiple accounts for valid reasons like keeping personal and professional accounts but neither does a phone number so this is still an improvement.

I think the main thing blocking this is its a huge pain to go through this system when the average person doesn't care that facebook and twitter have their phone number


> huge pain

The current system is a huge pain too...

I have 700+ accounts recorded in my password manager. Organizing, managing, occasionally changing passwords on important ones, etc. etc. takes a non-trivial amount of time and dedication!

And it's way way harder for many people who never got a system down, something I'm reminded of every time I visit my grandparents.. :-) Their main email account used to be an old ISP one that they'd payed for for years, and for whatever reason (I couldn't figure out why) it stopped working with some sites. Without that email account they lost access to a bank account, several credit card accounts, and some other stuff, and I ended up walking them through setting up a gmail account and calling in to change the email associated with all those accounts. Well, I used their landline phone to help set up the gmail account, and this year they moved, no longer have that phone number, and lost access to that account. I tried to help recover it, but wasn't successful. Guess what... they had to repeat the process for the bank and all those credit cards.


This reminded me of something I recently learned of, SQRL, a 77 digit numerical identity for web service authentication.




Consider applying for YC's Fall 2025 batch! Applications are open till Aug 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: