I saw this tiktok where this guy was talking about how he’d get his hands on real social security numbers… this was a clip from a whole story he told about some criminal shit, I was too distracted by my thoughts on how to fix the exploits he used.
Block chains and cryptographic signatures would solve basically every one of his exploits. But regardless of the myriad of reasons as to why we won’t adopt cryptography into American laws and bureaucracy, imagine if we did do everything involving government and policy in a cryptographically secure environment.
Imagine if everyone who is born gets assigned a gpg secret key signed by the government and that is your government ID for everything from opening a bank account to paying your taxes to claiming benefits. IMPO I think this is a perfect solution (iif you ignore the human element).
So my question is why wouldn’t it be perfect, and what kind of exploits could bad actors use in a cryptographic bureaucracy?
Firstly blockchain will do nothing in this situation so let’s ignore that.
as for gpg the problem is in order to decrypt the data you need to share the private key which is the exact same problem we currently have. You need to share your SSN for checks to be done and the orgs you share your SSN with are terrible at keeping them secure.
While it is a nice thought experiment you aren’t doing anything new just replacing a SSN with a gpg all the same technical problems are there.
That’s kinda backwards, isn’t it? If I want to verify my identity to a company, they would send me something that only I could decrypt. Some government agency provides all the public keys of all citizens, the company takes my public key, encrypts some secret with it, sends it to me, and asks me to decrypt and return it. If I’m able to do so, I must be who I say I am otherwise I would not be able to decrypt the secret.
In an ideal world, the company (or, even better, the employee) would have a similar certificate that I could use to encrypt my response with.
True, but you know orgs are going to want your private key anyway. Remember ssn is not suppose to be an identification system, it was never designed to be and yet it is used as such.
If they are doing shit wrong with a SSN what makes you think they will do shit right with gpg?
In this theoretical system, ideally it’s illegal for anyone other than the person who’s supposed to have the private key to have it - excepting some subset of legal reasons (e.g. parents for their children). So, the only business that would be asking for people’s private keys are the kind that are already operating outside of the law.