Verify the identity of developers [LWN.net]

Verify the identity of developers

Posted Apr 5, 2024 14:36 UTC (Fri) by jem (subscriber, #24231)
In reply to: Verify the identity of developers by paulj
Parent article: A backdoor in xz

>Citizens (and possibly also residents) do not need ID to travel within the Schengen Area.

This is a common misconception. EU citizens are required to carry a government issued ID card or passport if they are traveling abroad, even if the travel is limited within the Schengen area. However, the ID is normally not checked at the border between two Schengen countries, but checks can be reinstated if circumstances require it.

In some countries within the Schengen area (*cough* Germany) citizens are required to be in possession of an ID card (or passport) even within their own country.

Verify the identity of developers

Posted Apr 5, 2024 18:36 UTC (Fri) by pizza (subscriber, #46) [Link] (21 responses)

My point was that as a EU citizen you don't need a *passport* to travel around the EU; your national ID card is sufficient. Only when traveling outside the EU would a passport come into play.

What makes passports semi-feasible for "identity verification" is that there is a true international standard for machine readability (and decoding) of their information. But passports are not a given, meaning you'd realistically need to accept various [sub-]national ID cards in all their infinite diversity, with potentially a separate reading/decoding/verification mechanism required for each issuing agency.

Verify the identity of developers

Posted Apr 6, 2024 21:31 UTC (Sat) by kleptog (subscriber, #1183) [Link] (20 responses)

It worth noting that from a technical aspect there's less difference between passports and ID cards than you might think. National ID cards in europe often have the same NFC chip as the passports and they work the same way. The only real reason you need a passport outside the EU is because many countries want to (a) put stamps in your passport, (b) add physical visas to them and (c) be able to look at your passport to see if you've visited any countries they don't like. That's why countries near the EU where there are no visa requirements will accept national ID cards at immigration. (The Dutch ID card is acceptable for travel to 42 countries.)

As digital visas become more common there will be more countries that will accept ID cards in lieu of passports.

It's possible to use all this infrastructure in positive ways. For example, it would allow Github to have proof you are over 18 and a resident of country X, without revealing any other information about you (zero-knowledge proofs). We're not there yet.

Of course the next step is to ditch the physical card altogether and have it all in your phone instead. Of course that gets trickier, because a passport/ID card provides offline unrecorded proof of validity, but it's not clear if a pure digital app based identity can work offline.

Verify the identity of developers

Posted Apr 6, 2024 22:05 UTC (Sat) by pizza (subscriber, #46) [Link] (19 responses)

>It's worth noting that from a technical aspect there's less difference between passports and ID cards than you might think. National ID cards in europe often have the same NFC chip as the passports and they work the same way.

...Well, that's great for Europeans, but what about the rest of the world?

(again, that's my point -- Passports have an international standard for machine readability and interoperability, but there are more standards for domestic identification than there are countries! I have a US passport, a second Federal-issued ID, and a state-issued ID. They are all machine-readable, but via different mechanisms, and the encoded information also differs. The passport establishes citizenship. The state ID establishes residency and permission to operate a motor vehicle on public roads)

Verify the identity of developers

Posted Apr 7, 2024 15:53 UTC (Sun) by kleptog (subscriber, #1183) [Link] (18 responses)

> They are all machine-readable, but via different mechanisms, and the encoded information also differs.

Ok, but this is a fabricated problem. The states of the US could surely get together and adopt a single standard to cover everything. Clearly it's not a big enough problem.

If your point is that requiring digital identification online for open-source projects would unfairly exclude much of the world, I agree with you. That's not something we can reasonably require at this point (perhaps ever).

Verify the identity of developers

Posted Apr 7, 2024 17:00 UTC (Sun) by pizza (subscriber, #46) [Link] (17 responses)

> Ok, but this is a fabricated problem. The states of the US could surely get together and adopt a single standard to cover everything. Clearly it's not a big enough problem.

There is a federal standard for state ID cards now (imposed by the "REAL ID Act" but twenty years later it's still not fully deployed, and IIRC that _still_ doesn't provide a standard mechanism for machine readability or verification.

It's "not a big enough problem" because these ID cards are only used physically, in person, using the mk-I eyeball to make sure the photo vaguely looks like the person holding it.

> If your point is that requiring digital identification online for open-source projects would unfairly exclude much of the world, I agree with you. That's not something we can reasonably require at this point (perhaps ever).

Yes, except it's not "much of the world" so much as "everyone that doesn't live in a jurisdiction that provides state-issued digital identification along with a low/zero-cost mechanism for arbitrary third parties (including those outside your jurisdiction) to validate said credentials." IIUC hardly anywhere qualifies in that respect.

Verify the identity of developers

Posted Apr 7, 2024 17:46 UTC (Sun) by pizza (subscriber, #46) [Link]

> and IIRC that _still_ doesn't provide a standard mechanism for machine readability or verification.

Whoops, I stand corrected. It wasn't part of the original law, but instead as regulations issued by the DHS after the fact. So, currently REAL-ID compliant cards must have a PDF417 2D bar code containing a minimum of 10 data elements [1]. Notably missing is a digital signature that one can use to _validate_ the data without some sort of query to the issuing authority, so absent that query, these ID cards are only useful for in-person stuff since you can photoshop anything you want onto the front (photo, text) and back (barcode) and nobody would be any the wiser.

(Nearly all of the REAL-ID provisions have to do with physical/anti-tamper security (eg watermarks, holograms) and a consistent minimum standard for documentation needed to issue said ID, and the information that needs to be shown..)

(Meanwhile, various federal agencies (including the military) have their own ID standards that use different machine readable mechanisms and encoded data..)

[1] legal name, gender, DOB, address of residence, etc. See https://www.law.cornell.edu/cfr/text/6/37.19

Verify the identity of developers

Posted Apr 7, 2024 20:51 UTC (Sun) by Wol (subscriber, #4433) [Link] (15 responses)

> Yes, except it's not "much of the world" so much as "everyone that doesn't live in a jurisdiction that provides state-issued digital identification along with a low/zero-cost mechanism for arbitrary third parties (including those outside your jurisdiction) to validate said credentials." IIUC hardly anywhere qualifies in that respect.

In the UK, it certainly isn't mandatory. The ONLY piece of ID that all British Nationals can be reasonably assumed to possess is a birth certificate. That's assuming their parents registered the birth. Anything beyond that is OPTIONAL, although living without it can be hard. If you haven't had to renew your driving licence for one reason or another, the old green paper version is still valid. There probably aren't that many left, though. My passport is not a proper biometric one (it's also no longer valid), but if anybody wants a passport for ID I would quite happily present it and say "if that's not good enough, it's the best I've got".

More and more, if people demand things off of me (mobile phone number especially), I just walk away ...

Cheers,
Wol

Verify the identity of developers

Posted Apr 8, 2024 21:31 UTC (Mon) by kleptog (subscriber, #1183) [Link] (14 responses)

> if anybody wants a passport for ID I would quite happily present it and say "if that's not good enough, it's the best I've got".

I hope it is for you too. The UK has a weird view on IDs. On the one hand they recognise the benefits, on the other hand whenever it's proposed they always talk about being required to carry them at all times. Which is basically insane and a way to sink the topic before it gets anywhere.

A national ID is physical proof you are allowed to be there and have certain rights. So if some government database has a glitch and suddenly decides you're an illegal immigrant (e.g. Windrush, EUSS, the current PCDP scandal at the Home Office) you have physical proof that the database is *wrong*. Good for preventing you getting deported. That such a card is useful in other contexts is bonus.

From a pure practical point, my bank can assert my nationality just as well as the government can. You don't necessarily need passports/ID cards for that.

Verify the identity of developers

Posted Apr 9, 2024 9:02 UTC (Tue) by farnz (subscriber, #17727) [Link] (13 responses)

One of the issues in the UK with national ID cards is that whenever the idea comes up, the intent is to fund the cards via other uses of the data contained therein. Being required to carry them at all times is just a consequence of the idea that national ID cards need to turn a profit for the government.

Verify the identity of developers

Posted Apr 9, 2024 9:53 UTC (Tue) by Wol (subscriber, #4433) [Link] (12 responses)

One of the other issues we have is that the UK is not a single nation - and it's dominated by the "little englanders".

Has anybody else noticed that - of the four nations - England is the only one without its own National Anthem?

Driven home when watching the Calcutta Cup - the Scots sing "Flower of Scotland", but the English sing "God Save the (Scottish) King" !!!

It's the same problem the Canadians and Mexicans have with North America / USA, and the English seem completely oblivious to it ...

Cheers,
Wol

Verify the identity of developers

Posted Apr 9, 2024 15:06 UTC (Tue) by rschroev (subscriber, #4164) [Link] (6 responses)

England is also the only one without its own parliament. It's almost as if England still feels the whole UK is theirs, with the other members subordinate instead of them all being on the same level.

Verify the identity of developers

Posted Apr 10, 2024 10:01 UTC (Wed) by paulj (subscriber, #341) [Link] (5 responses)

An artifact of how the UK avoids properly addressing its constitutional issues, instead sating discontent in the non-English parts by a series of more ad-hoc "devolution" of powers from Westminster to other parliaments, seeking to react to events with the minimum of change.

It started with Ireland, which got a devolved government and dominion status within the UK in 1922 with some powers reserved for Westminster and an "Executive Council" (similarish to the privy council), until 1931 when Ireland became a wholly autonomous dominion, and then to 1937 as "Eire" a self-declared independent state (dominion status ambiguous), and formally as the Republic of Ireland from 1948.

Scotland and Wales got their own devolution in 1999, both more proscribed than the original Irish Free State (which had taken armed insurrection), but each with continued representation via MPs in Westminster. I'm not sure about the differences in power between them. The Scottish parliament seems to me to have more "status" and power than the Welsh one, but that might just be my bias, having lived in Scotland - I don't know much about Welsh devolution and how it compares.

It seems to me Ireland has the healthier status of the 4 "home nations", as they were (ignoring the Troubles, arising from Elizabethan and Jacobean era United Kingdom politics, which due to historical quirks left a longer, stronger imprint in the north of Ireland than the rest of the UK). Ireland continues to have very strong bilateral links to the rest of the Celtic Isles - Irish and British citizens travel and settle freely between them, trade a little less so now thanks to BrExit though, there are bilateral institutions, etc. - while Ireland is ultimately able to decide its own fate.

I don't understand why Scotland, if not Wales, doesn't also seek a similar situation. Would be better for all in the end I think. (I did vote "Yes" in the IndyRef in Scotland. ;) ).

Verify the identity of developers

Posted Apr 10, 2024 11:23 UTC (Wed) by Wol (subscriber, #4433) [Link] (4 responses)

> Scotland and Wales got their own devolution in 1999, both more proscribed than the original Irish Free State (which had taken armed insurrection), but each with continued representation via MPs in Westminster. I'm not sure about the differences in power between them. The Scottish parliament seems to me to have more "status" and power than the Welsh one, but that might just be my bias, having lived in Scotland - I don't know much about Welsh devolution and how it compares.

Being interested in history, I think this goes back to the fact that England and Scotland were two separate nations (let's forget the Flower of Scotland Proud Edward's Army bit) until very recently. Until William's intervention in 1066, the assorted British nations were steadily coalescing of their own accord, take for example the agreement round about 900AD between - iirc - Mercia, Northumbria and Wessex that all three crowns would pass to whichever King survived longest.

Then William arrived and upset the applecart, setting out to unite the British Isles by force. Out of proto-England, Wales held out the longest which forged a separate nationality (quite possibly helped by the fact that the Anglo-Saxon nations fell rather more easily, the Welsh being Celtic so already feeling different). But Wales has always been part of "England" since the mid 1100s (and sort-of took over the English crown with Owain Tudor about 1500).

Scotland has always had a separate identity - again being Gaelic rather than Anglo-Saxon (although the Sassenachs are "Lowland Scots" aka Angles"). Again fuelled by constant conflict with the Normans to the south. And with their own monarchy (which Wales never had?) since pre-William - again going back to 900s and earlier - which left alone would probably have merged with England using a similar mechanism. But it wasn't to be.

So Scotland was either occupied, or completely independent, until the "Union of the Crowns" in 1603. It remained an independent (theoretically) country until about 1750 and the "Act of Union".

So basically, Scotland has more power and independence because Scotland is considered a nation/country. Wales is just a subordinate principality.

(And personally, I think Westminster has far too much power. A lot of it should be devolved to local government. But it's the standard ebb and flow of politics unfortunately - the centre grabs power, messes it up, and the regions grab it back. Rinse and repeat :-(

Cheers,
Wol

Verify the identity of developers

Posted Apr 10, 2024 12:59 UTC (Wed) by paulj (subscriber, #341) [Link] (3 responses)

Interesting... ;)

As an aside, I note your view of the history seems skewed towards the countries /currently/ part of the UK. You can't understand the history of these Celtic Isles without understanding the history of one of the larger chunks of it, and a kingdom of the king of England for longer than Scotland - Ireland. Some of the biggest battles relevant to the history of the kingdom of England (and to the history of Europe, to a certain extent) were fought in... Ireland (by soldiers from many nations).

Just saying, cause a lot of modern British seem to overlook it - just cause Ireland is no longer part of the UK.

Verify the identity of developers

Posted Apr 10, 2024 15:04 UTC (Wed) by Wol (subscriber, #4433) [Link] (1 responses)

Agreed I don't know an awful lot about Ireland. Bear in mind I consider myself European/Scottish although my wife insists I'm English, so that accounts for at least some of the bias.

I also know there's an awful lot of history roundabout the time of Cromwell and Cromwell :- ) that's Thomas Cromwell of Henry VIII fame for the first one :-) but I know very little about it, other than it was the age-old Catholic/Protestant mess. (And quite likely earlier, too.)

The other thing that often gets forgotten about medieval history is the "Joan of Arc vs the English" lie. Okay, Joan is a bit later than this, but King John (of Magna Carta fame, 1215) is probably the first true "King of England". Before that, and including his elder brother Richard, the title of Duke of Normandy actually ranked ABOVE the King of England. Richard's troubles in the Crusades basically brought about the downfall of the Norman Empire, and Joan drove the Normans out of Normandy (probably a gross mis-representation of what actually happened, but rather more accurate than folk history!)

Cheers,
Wol

Verify the identity of developers

Posted Apr 11, 2024 9:12 UTC (Thu) by paulj (subscriber, #341) [Link]

King John possibly succeeded - despite himself - in part thanks to having Ireland to draw wealth from. Without Ireland, he'd have had nothing early on ("John Lackland" - John no-land), and would have been less wealthy later. He might have struggled to hold the English crown against his nephew Arthur and Philip II of France.

Verify the identity of developers

Posted Apr 10, 2024 15:19 UTC (Wed) by Wol (subscriber, #4433) [Link]

Just to throw in another snippet, to help explain the Saxon / William thing - Saxon kings were elected. William's pretence for invasion was that he had been promised the crown, which was half true, but it was never in the gift of the promissors.

And that's how the treaty between the three kings worked - the ruling councils basically signed up that the only eligible candidates for any vacant monarchy would be the other monarchs. All helped by the fact that the crowns did NOT pass father to son, although the only real candidates were all close relatives of the late King.

Indeed, George II may have been the first King to inherit as of legal right, given the shenanigans in the aftermath of Henry VIII and Edward VI, and the similar shenanigans over James II, William and Mary, and Anne. Indeed, after the death of his wife, William III ruled alone despite not being of (British) Royal Blood at all! Using him as precedent, we should have had King Albert, and King Philip! (Although of course, Philip was of British Royal Blood, as also reputedly is Camilla.)

Cheers,
Wol

Verify the identity of developers

Posted Apr 9, 2024 15:39 UTC (Tue) by anselm (subscriber, #2796) [Link]

the Scots sing "Flower of Scotland"

So far that's just a patriotic song popular with Scottish sports fans which various Scottish sports bodies have provisionally adopted in the absence of an actual national anthem (which Scotland doesn't have, either).

Having said that, in spite of its obvious problems Flower of Scotland is apparently a strong contender to become the official national anthem once the Scottish parliament gets its act together. As far as the English are concerned, they should be bothered by the fact that they have no national parliament (or for that matter government) much more than by the formal absence of a national anthem.

Verify the identity of developers

Posted Apr 10, 2024 9:27 UTC (Wed) by paulj (subscriber, #341) [Link] (3 responses)

King Big Ears is German, not Scottish. ;)

Verify the identity of developers

Posted Apr 11, 2024 9:42 UTC (Thu) by Wol (subscriber, #4433) [Link] (2 responses)

Well, he is directly descended from the Scottish King James VI/I ...

(So he's as Scottish as most other people in Scotland :-) which is to say not really at all. Most residents of modern Scotland (a) do not live in the Land of the Scots, and (b) trace their ancestry to either the Picts or the Angles.

(Inasmuch as most people in the British Isles trace their ancestry back to the Anglo-Saxons - genetically we're nearly all Britons, but culturally we're Anglo-Saxon because we adopted the ruling class's language and culture. That's where the word "Welsh" came from - aka "not Anglo Saxon".)

Cheers,
Wol

Verify the identity of developers

Posted Apr 11, 2024 10:17 UTC (Thu) by paulj (subscriber, #341) [Link] (1 responses)

He's descended from the *German* George I and II from /both/ his mother and father :). George I's is also german on /both/ sides, even if his mother was a Stuart - "Sophia of Hanover". Her mother, Elizabeth Stuart was born in Scotland to James VI / I, but her mother was Danish.

It's a bit of a stretch to call Big Ears "Scottish" because, in between the plethora of German ancestors, you can find one couple who were Scottish and Danish a few hundred years ago. ;)

Verify the identity of developers

Posted Apr 11, 2024 11:12 UTC (Thu) by Wol (subscriber, #4433) [Link]

What about Lady Elizabeth Bowes-Lyon?

Cheers,
Wol

Verify the identity of developers

Posted Apr 5, 2024 19:38 UTC (Fri) by gioele (subscriber, #61675) [Link]

> In some countries within the Schengen area (*cough* Germany) citizens are required to be in possession of an ID card (or passport) even within their own country.

Formally, Germany requires you to "possess" an identity document ("verpflichtet, einen gültigen Ausweis zu besitzen" = to have applied for it and to have it somewhere, for example at home) once you are 16. It is not required that you "are in possession" of an identity document (~= to carry with you).

https://www.gesetze-im-internet.de/pauswg/BJNR134610009.h...
https://www.gesetze-im-internet.de/englisch_pauswg/englis...