Hacker News new | past | comments | ask | show | jobs | submit login

I in general agree to a sort of governmental (or even inter-governmental) services for lightweight identity verification. Lightweight in a sense that these services do not give any new personally identifiable information to clients, they are only given cryptographic proofs. If implemented very well, it may be usable for a whole lot of applications other than just age verification.

However a partial or faulty implementation of the concept can be very dangerous. South Korean websites used to receive a Resident Registration Number (RRN, 주민등록번호) for all imaginable reasons, including just catching double registration. RRN was and remains crucial for identity verification and it is estimated that virtually every SK national has been subject to multiple accidents that exposed their RRNs before such practice is forbidden. After that the Accredited Certificate of Authentication (공인인증서, nowadays the Recognized Common Certificate 공동인증서) is in place, which was another travesty that is based on X.509 but with non-standard practices based on ActiveX. Nowadays age and identity verification is commonly done with mobile phones, and there are multiple such services mostly run by CICs and telcos. This did dramatically reduce the use of RRNs and is much more convenient for typical people, but if you do not own SK mobile phones (e.g. you are foreigners) you can't use them and there are frequently no fallbacks. Also I generally don't trust the security of those services.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: