Most active commenters
  • squidbeak(6)

←back to thread

525 points alex77456 | 11 comments | | HN request time: 0.001s | source | bottom
Show context
aftergibson ◴[] No.45385420[source]
A secure, optional digital ID could be useful. But not in today’s UK. Why? Because the state has already shown it can’t be trusted with our data.

- Snoopers’ Charter (Investigatory Powers Act 2016): ISPs must keep a year’s worth of records of which websites you visit. More than 40 agencies—from MI5 to the Welsh Ambulance Service—can request it. MI5 has already broken the rules and kept data it shouldn’t have.

- Encryption backdoors: Ministers can issue “Technical Capability Notices” to force tech firms to weaken or bypass end-to-end encryption.

- Online Safety Act: Expands content-scanning powers that experts warn could undermine privacy for everyone.

- Palantir deals: The government has given £1.5 billion+ in contracts to a US surveillance firm that builds predictive-policing tools and runs the NHS’s new Federated Data Platform. Many of those deals are secret.

- Wall-to-wall cameras: Millions of CCTV cameras already make the UK one of the most surveilled countries in the world.

A universal digital ID would plug straight into this ecosystem, creating an always-on, uniquely identified record of where you go and what you do. Even if paper or card options exist on paper, smartphone-based systems will dominate in practice, leaving those without phones excluded or coerced.

I’m not against digital identity in principle. But until the UK government proves it can protect basic privacy—by rolling back mass data retention, ending encryption backdoor demands, and enforcing genuine oversight—any national digital ID is a surveillance power-grab waiting to happen.

I'm certain it's worked well in other countries, but I have zero trust in the UK government to handle this responsibility.

replies(21): >>45385507 #>>45387492 #>>45389428 #>>45389950 #>>45390081 #>>45390083 #>>45390337 #>>45390348 #>>45390643 #>>45390732 #>>45391157 #>>45391185 #>>45391616 #>>45391657 #>>45392188 #>>45392686 #>>45394187 #>>45394216 #>>45397954 #>>45402490 #>>45403873 #
nostrademons ◴[] No.45390081[source]
I wonder if zkSTARKS could help here. Prove that the validity of a statement (like "I am a citizen that is authorized to receive benefits") without revealing your precise identity.

https://en.wikipedia.org/wiki/Non-interactive_zero-knowledge...

replies(5): >>45390159 #>>45390819 #>>45390833 #>>45390954 #>>45392312 #
1. squidbeak ◴[] No.45390954[source]
This is the proposal for the UK system right now. Zero Knowledge Proofs. The technical side hasn't been adequately explained to the public.
replies(2): >>45391349 #>>45393567 #
2. mr_toad ◴[] No.45391349[source]
> This is the proposal for the UK system right now.

Is it? Nobody knows if it’s going to be an app, or a virtual card, or a real card. So speculation and rumours are flying.

Whoever does comms for the government must be asleep.

replies(1): >>45394289 #
3. hardlianotion ◴[] No.45393567[source]
How do you know that?
replies(1): >>45394319 #
4. squidbeak ◴[] No.45394289[source]
You're not correct in saying nobody knows. This has been in discussion for several years, and the standard is outlined in detail on the government website [1], and also discussed in a blog [2].

But I fully agree if you mean it hasn't been adequately explained to the public [3].

[1] https://www.gov.uk/government/publications/uk-digital-identi...

[2] https://enablingdigitalidentity.blog.gov.uk/

[3] https://www.gov.uk/government/publications/digital-id-scheme...

replies(2): >>45394447 #>>45395300 #
5. squidbeak ◴[] No.45394319[source]
There's a full section of the government website dedicated to this subject, and also a recent act of parliament which in part prepared legislation for it, the Data Use and Access Act 2025 [1]. See my other answer in this thread for the links.

The Digital ID scheme isn't new. The only change is from it being optional to mandatory.

[1] https://www.legislation.gov.uk/ukpga/2025/18/enacted

replies(1): >>45398823 #
6. rcxdude ◴[] No.45394447{3}[source]
Can you spell it out further from that document? There's only one mention of zero-knowledge proofs in there, mentioning it as one thing that could be used in verification. The rest of the document is similarly simultaneously dense and vague, so it's really not obvious to me that the actual implementation will be cryptographically privacy-preserving.
replies(1): >>45438404 #
7. mr_toad ◴[] No.45395300{3}[source]
I couldn’t find anything in that document or the blog that answers the most basic question - is it going to be an app?

It literally contradicts itself at one point:

“It will also be stored directly on your own device - just like contactless payment cards or the NHS App today.”

An app has totally different capabilities from a card in a wallet.

replies(1): >>45437959 #
8. hardlianotion ◴[] No.45398823{3}[source]
Thanks for the link - I was aware the government was preparing voluntary ID. I meant the zero proof element specifically as this is the first time I have heard mention of it.
replies(1): >>45438303 #
9. squidbeak ◴[] No.45437959{4}[source]
Mr Toad, the wallet is an app. The naming choices are ripe for confusion.
10. squidbeak ◴[] No.45438303{4}[source]
These are referenced in the framework guidance (which is iterative) intended for DVSs. Here for instance:

https://www.gov.uk/government/publications/uk-digital-identi...

If you want a technical explanation of how they work, you will need to loose elsewhere.

11. squidbeak ◴[] No.45438404{4}[source]
I assume you mean the framework guidance. Bear in mind this is intended for Digital Verification Services. Cryptographic standards are referred to under 16.5. Zero Knowledge Proofs are a broader concept and better explained elsewhere, for instance

https://codethechange.stanford.edu/guides/guide_zk.html