Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

California DMV Digital ID Pilot Program

dmv.ca.gov

Post reply on HN
Print view View original

81–90 of 95 posts

Re: California DMV Digital ID Pilot Program

#81

Post by lostmsu »

mdaniel wrote: post #79
azinman2 wrote: post #36

Earlier quoted context omitted.

Now imagine they are under obligation to accept it, and you can get to the point where you can leave your wallet at home. With car keys being Bluetooth, I now don’t carry keys in my pocket. To not carry a wallet to drive to the grocery store either would be a joy. I like a physical lightness.

> With car keys being Bluetooth https://francozappa.github.io/post/2023/bluffs-ccs23/ and a related but slightly different threat: https://news.ycombinator.com/item?id=38661182 are why I have no interest in that end of the convenience---security spectrum. For clarity, I'm not yucking your yum, just hoping the future is not made up entirely of c libraries written by.. security insensitive.. developers protecting my ho…

The first is not an issue if the transmitted data is time-sensitive.

Re: California DMV Digital ID Pilot Program

#82

Post by kornhole »

vore wrote: post #77
kornhole wrote: post #75

Earlier quoted context omitted.

It is not speculation. I assume every app is hostile and trying to grab information until it can be proved that it does not. Until the app is open sourced and/or people do network analysis on it, this is the safest default assumption.

It absolutely is speculation if you haven't done the legwork and just want to throw out quick and easy takes like this.

I hope for the best but plan for the worst. The government has a high bar to meet to earn my trust. Government has lied to me too many times. They need to find some way to prove this app is safe for my freedom. Until then, I will endure the sexual abuse of TSA groping my junk when I got through the airport.

Re: California DMV Digital ID Pilot Program

#83

Post by anonuser123456 »

bkishan wrote: post #39
localghost3000 wrote: post #22

Earlier quoted context omitted.

This is the thing I think most people aren’t thinking about. I promise you the police either have or are cooking up a way as we speak to image the entire contents of your phone when you hand it to them. Until we get some laws in place around this stuff, no way.

Not from the US, so help me understand here, why would a traffic cop looking to verify a license want to image the entire contents of your phone?

Some fraction of people are authoritarian by nature. Most cops have no interest. But the fraction that do, will use any tool they can to find a crime.

Given the amount of deference courts give to cops, that they are allowed to lie without consequence, you don’t need/want to give them any more tools.

Re: California DMV Digital ID Pilot Program

#84

Post by kornhole »

bkishan wrote: post #39
localghost3000 wrote: post #22

Earlier quoted context omitted.

This is the thing I think most people aren’t thinking about. I promise you the police either have or are cooking up a way as we speak to image the entire contents of your phone when you hand it to them. Until we get some laws in place around this stuff, no way.

Not from the US, so help me understand here, why would a traffic cop looking to verify a license want to image the entire contents of your phone?

We live in a police state. We have the highest incarceration rate of any country. Many of the people in prison are political prisoners. Our national security apparatus is powerful and unaccountable. Congress just reauthorized 702 which allows warrantless surveillance. Police and security apparatus is constantly looking for more ways to watch and incriminate anybody who resists their power.

Re: California DMV Digital ID Pilot Program

#85

Post by eesmith »

intrasight wrote: post #67
bri3d wrote: post #64

Earlier quoted context omitted.

Yes, this idea would be interesting if acceptance were mandated, but I'm not aware of any movement in that direction in any state. Mandating this kind of system would be massively fraught with political and legal peril in the US and is likely impossible. With the way the US works, there needs to be an incentive for businesses to use these systems, and I haven't seen an implementation with this focus yet. Bars would p…

> Mandating this kind of system The US mandated the acceptance of fiat money. That too was controversial at first.

Yes, fiat money was controversial at first, with political and legal peril when the US started printing greenbacks during the Civil War. https://en.wikipedia.org/wiki/United_States_Note#Politics_an...

But after the US switched back to specie (thanks to the large silver strikes and government policy which meant silver coins were priced by government fiat, not commodity value) it took nearly a century before the US fully embraced fiat money. It likely helped that the legal issues related to fiat money were resolved in the 1870s, https://en.wikipedia.org/wiki/Legal_Tender_Cases .

I suspect bri3d was thinking of a timescale in the decade or two range, not 100 years.

The Real ID Act of 2005 still isn't in fully in force, having been extended most recently to May 7, 2025. That should give an idea the likely timescale involved.

Re: California DMV Digital ID Pilot Program

#86

Post by eesmith »

paxys wrote: post #52
bri3d wrote: post #30

The Estonian e-ID system and Qualified Electronic Signature in the EU are good ideas. The government issues you a signed identity. You can use that signed identity to counter-sign challenges in places you'd otherwise (in the US) need to use a Social Security Number and a convoluted private market identity-verification system (for example, the stupid "were you associated with this address 4.5 years ago" things). Like…

Stuff like this is rarely worth the cost or effort to implement in the US because like 1% of the population will ever end up using it. We are talking about a country where 1 in 5 households still don't have (and don't want) internet.

While 1 in 5 households do not have internet, and 58% expressed no interest or need to be online, at least roughly a quarter of them do want internet.

18% of those who do not have internet say the reason is they can’t afford home internet service, and another 4% lack internet availability in their area, says https://www.ntia.gov/blog/2022/switched-why-are-one-five-us-... .

I don't know about the other 20%.

Re: California DMV Digital ID Pilot Program

#87

Post by vlovich123 »

bri3d wrote: post #71
vlovich123 wrote: post #54

Earlier quoted context omitted.

This says mDL. The QR code is at most a cryptographically signed attestation of relevant attributes (eg age, name, etc). Not sure if this made it in, but originally the ISO group had been talking about also signing >18/>21 of sharing the actual birthday for things like restricted sales. I don’t recall discussing QR codes as it was supposed to be NFC but maybe that changed (don’t see a mention of QR codes on the site)…

This implementation is QR code based, which ruins a lot of the value in terms of low-battery use and makes standardization and acceptance difficult. Anyway, for anything to work in the US, there needs to be an incentive for businesses to use this system, and right now, there isn't one for point-of-sale driver's license use, in my opinion. It's technology (perceived as unreliable, slow, expensive) that can break, vs.…

I think that’s because the standard (iso 18013-5) allows for NFC & QR codes which makes sense and because they couldn’t do it over NFC for the iOS app so they likely just chose something they could provide a consistent experience for. It wouldn’t surprise me if the app is even built largely starting with the sample reference code[1].

BTW likely the reason QR codes were part of the standard in the first place was because at the time Apple wasn’t involved and their APIs were (& remain?) locked down so that a third party wouldn’t be able to implement the standard. Apple did join later & have integrated support for the standard into their wallet so I imagine California will be added to their list of states sooner rather than later. Many countries in Europe have a strong federal motor vehicle authority so rolling out these IDs is faster nationally whereas in the US & Canada it’s a patchwork of states/provinces that cooperate under AAMVA & rollouts happen piecemeal on each state’s timeline (to be fair, US & Canada are quite large and historically each state develops their own infrastructure which means you have to replicate updating the infrastructure & it’s usually done by contractors under very lucrative contracts).

Keep in mind there are US states that already integrate with Apple wallet via NFC and whatnot and MDL is a shorthand name for the standard & nobody is going to implement anything other than the standard (that’s why AAMVA, RDW, DVLA & other relevant government bodies had representatives involved with and engaged with the standard / running the standard body)

[1] IIRC the sample app was built by the folks at the UDL as a PoC for the ISO group. Funded by the good folks at RDW which also allowed it to be open-sourced and shared freely. The Netherlands government’s approach to tech is a hidden gem into how to structure policy around tech (I think Estonia is also well regarded because of their adoption of cryptographic ID cards so early).

Re: California DMV Digital ID Pilot Program

#88

Post by nocoiner »

bri3d wrote: post #64
azinman2 wrote: post #36

Earlier quoted context omitted.

Now imagine they are under obligation to accept it, and you can get to the point where you can leave your wallet at home. With car keys being Bluetooth, I now don’t carry keys in my pocket. To not carry a wallet to drive to the grocery store either would be a joy. I like a physical lightness.

Yes, this idea would be interesting if acceptance were mandated, but I'm not aware of any movement in that direction in any state. Mandating this kind of system would be massively fraught with political and legal peril in the US and is likely impossible. With the way the US works, there needs to be an incentive for businesses to use these systems, and I haven't seen an implementation with this focus yet. Bars would p…

I’m thoroughly confused by your first paragraph. It seems like it would be basically trivial to mandate acceptance of a digital ID system, at least within one of our 50 laboratories of democracy.

Step 1: State adopts digital ID system and mandates that subdivisions and political units of the state are required to accept it for identification purposes in their interactions with the public. Step 2: Step 1 is extended to private actors.

What am I missing? I realize I’m completely handwaving away the details of implementation, as well as assuming that there’s at least one state that would make the political choice to accept a slightly higher baseline of ID misuse compared to a system that verifies that the instrument matches the bearer 99.99999% of the time, but conceptually it seems pretty straightforward. At the bottom of the digital ID, just put 8 pt letters reading “This digital ID constitutes legal identification of the person to which it has been issued for all purposes, public and private.” Boom, done.

I also don’t think there necessarily needs to be an incentive for businesses to invest in expensive card reader systems that phone home to a database and authenticate the QR displayed on the device. Instead, just change the law against selling liquor to kids saying that a good faith effort to validate the authenticity of state issued digital ID is a defense to prosecution under that law. In my state, at least, this is basically how it works now with physical ID cards.

Now, if you’re talking about an ID system operating at the federal and state level simultaneously or across state lines, another poster mentioned the still-not-fully-implemented 2005 Real ID Act and is a fair comment on the difficulties that would exist in coming up with a framework that would work on a many-to-many basis for every purpose for which each type of state ID documents is used.

Or if you’re unwilling to accept the shortcomings of the existing ID card regime (older siblings? doppelgängers?), then sure, you can come up with system requirements that try to eliminate every edge case that exists, and you can have an expensive and administratively burdensome physical AND digital ID system.

But otherwise, I think it would be conceptually pretty simple for a state to create a widely used digital ID ecosystem within that state.

Re: California DMV Digital ID Pilot Program

#89

Post by azinman2 »

mdaniel wrote: post #79
azinman2 wrote: post #36

Earlier quoted context omitted.

Now imagine they are under obligation to accept it, and you can get to the point where you can leave your wallet at home. With car keys being Bluetooth, I now don’t carry keys in my pocket. To not carry a wallet to drive to the grocery store either would be a joy. I like a physical lightness.

> With car keys being Bluetooth https://francozappa.github.io/post/2023/bluffs-ccs23/ and a related but slightly different threat: https://news.ycombinator.com/item?id=38661182 are why I have no interest in that end of the convenience---security spectrum. For clarity, I'm not yucking your yum, just hoping the future is not made up entirely of c libraries written by.. security insensitive.. developers protecting my ho…

There are car key amplification attacks where people leverage the remotes in peoples homes to break into cars. In the past there have been car brands that only had so many physical key skeletons that thieves would just acquire them all. Homes often have windows that are smashable and very pickable locks.

Perfect security doesn’t exist, especially as the consumer level. I have more faith in software updates.

Re: California DMV Digital ID Pilot Program

#90

Post by azinman2 »

bri3d wrote: post #64
azinman2 wrote: post #36

Earlier quoted context omitted.

Now imagine they are under obligation to accept it, and you can get to the point where you can leave your wallet at home. With car keys being Bluetooth, I now don’t carry keys in my pocket. To not carry a wallet to drive to the grocery store either would be a joy. I like a physical lightness.

Yes, this idea would be interesting if acceptance were mandated, but I'm not aware of any movement in that direction in any state. Mandating this kind of system would be massively fraught with political and legal peril in the US and is likely impossible. With the way the US works, there needs to be an incentive for businesses to use these systems, and I haven't seen an implementation with this focus yet. Bars would p…

It’s only year 1. Sooner than later it’ll feel silly not to accept it.
Post reply on HN