Back to Home11/12/2025, 4:40:17 PM

Digital ID, a new way to create and present an ID in Apple Wallet

171 points
245 comments

Mood

skeptical

Sentiment

mixed

Category

tech

Key topics

Digital ID

Apple Wallet

Privacy

Debate intensity80/100

Apple has introduced a new feature called Digital ID, allowing users to create and present IDs in Apple Wallet, sparking debate about its implications.

Snapshot generated from the HN discussion

Discussion Activity

Very active discussion

First comment

19m

Peak period

145

Day 1

Avg / period

53.3

Comment distribution160 data points

Based on 160 loaded comments

Key moments

  1. 01Story posted

    11/12/2025, 4:40:17 PM

    6d ago

    Step 01
  2. 02First comment

    11/12/2025, 4:59:02 PM

    19m after posting

    Step 02
  3. 03Peak activity

    145 comments in Day 1

    Hottest window of the conversation

    Step 03
  4. 04Latest activity

    11/17/2025, 5:10:00 AM

    2d ago

    Step 04

Generating AI Summary...

Analyzing up to 500 comments to identify key contributors and discussion patterns

Discussion (245 comments)
Showing 160 comments of 245
robin_reala
6d ago
1 reply
…in the US.
barbazoo
6d ago
2 replies
... for U.S. passports.
pkolaczk
6d ago
1 reply
We don’t need it in Poland. We’ve been using a similar but official government issued app with ID, driving license, car documents for years now. Works both on Android and iPhone. Can be also used for logging into government web apps like taxes, for document signing or for voting. And it reminds me whenever my car insurance expires or it needs the annual check. Pretty impressive IMHO.
barbazoo
6d ago
1 reply
I was thinking of US permanent residents that have an interest in this but no US passport.
atonse
6d ago
I can see them eventually doing this. Nothing on the tech side stopping them.

You gotta start somewhere. They started with Driver's Licenses.

withinboredom
6d ago
And if you live outside the US with a US passport, you can't use it.
willio58
6d ago
8 replies
I’m still waiting for the day where 100% of state drivers licenses are supported in wallet and anyone requesting ID are required to accept them. Quite literally the only reason I have a wallet these days is for the drivers license.
teeray
6d ago
1 reply
> and anyone requesting ID are required to accept them

This is the big one. I've seen a lot of states where digital drivers licenses are issued, but many retailers are like "lol no, we want the card." It needs to be legally enshrined as identical.

avs733
5d ago
I've had state government (including both cops and clerks) refuse to acknowledge my digital ID in my state.
astroflection
6d ago
3 replies
Nope. I will continue to have a DL card so I can choose to leave my phone at home. When we are required to have our IDs on our person at all times I can at least not be tracked everywhere I go.

Be watchful for legislation requiring: * us to have our ID on our person at all times. * IDs to be issued in digital format only.

crazygringo
5d ago
3 replies
> Be watchful for legislation requiring

This is the paranoia I don't get. These are not things that are going to happen in the US, precisely because so many people (like yourself) are against it, and it's a democracy and people vote. So putting your drivers license on your iPhone isn't some slippery slope.

the_other
5d ago
2 replies
> These are not things that are going to happen in the US.

Citation needed.

crazygringo
5d ago
I already said why. But to go deeper: the US has, and has always had, a strong libertarian and anti-government streak among a very large proportion of its citizens. And it's not going away. That's why the US doesn't have a national ID, the way so many other countries do. That's why adults are not required to carry ID's with them, the way it is in many other countries.

These political values are a strong part of American culture. The distrust of central government and authority has been around since the founding of the country. They belong to the most durable of American values.

If the US still doesn't have a national ID, or require citizens to carry ID's, and there's literally no political movement towards that, what on earth makes you think this will change?

Being able to put a driver's license on your phone is state-level. It's a form of ID we're OK with. It can't be mandatory because not everyone can drive. There's zero slippery slope here. I just want to carry the card I already have to carry when driving or flying, on my phone instead of physically. There's zero downside here.

Is that enough citation for you?

6510
5d ago
> it's a democracy and people vote

But they never get what they wanted nor what they voted for.

coin
5d ago
> This is the paranoia I don't get. These are not things that are going to happen in the US

Many brown looking citizens carry their passport so as to not be excessively detained by ICE.

pcdoodle
5d ago
>So putting your drivers license on your iPhone isn't some slippery slope.

Yes it is. And participating is accepting it.

EGreg
6d ago
Very much, This! Up voted
willio58
6d ago
To be clear I don’t want either of those laws to be passed, but I’d like the option to have it on my phone and require police to respect it
mystifyingpoi
6d ago
2 replies
Geniuine question, why can't you just have your license in your car at all times?
tzs
6d ago
1 reply
In the US if you need a state ID card and a driver's license those are generally combined into a single card. They usually only need its driver's license functionality when they are driving but often need its ID card functionality when they are away from the car and so it generally goes with them.
mystifyingpoi
6d ago
1 reply
Ah, that's why, ok. Didn't know they are combined.
vel0city
5d ago
1 reply
I mean, they don't have to be. You can often get a state ID card and a driver's license, but that's essentially redundant. More fees, more time, more paperwork. Things that require an ID just require some state or federally issued photo ID, so you can use a DL, a state ID, a passport, etc. When the extreme majority of adults are already needing a DL to get groceries why bother with another ID.
voxic11
5d ago
1 reply
I wasn't able to find any states where this is the case. They all appear to have rules that say you can only be issued a state ID or a state drivers license but not both at the same time. Additionally federal REAL ID rules have the same requirement for REAL ID compliant identification.

https://legalclarity.org/can-you-have-a-non-driver-id-and-a-...

https://www.ecfr.gov/current/title-6/chapter-I/part-37/subpa...

So I think the only way to have a government ID card and a separate drivers license is to get a passport card and a state drivers license.

vel0city
5d ago
Huh, interesting. It was legal here in my state until 2015, I didn't know that had changed.
willio58
6d ago
Yeah but I need it when I buy a drink too.
dzhiurgis
6d ago
1 reply
I've been stopped by cops maybe once per 10 year. In that case I'm happy to pay $50 fine for failing to present license which they can check on their database anyway.
pcdoodle
5d ago
This is the way
tzs
6d ago
1 reply
Unless your state issues wimpy driver's licenses that fall apart if not kept in a wallet why bother with the wallet?

I just carry my driver's license, a credit card, a health insurance card, and an Orca card [1] loose in a pants pocket.

[1] Stored value card for several transit agencies in the Puget Sound region of Washington.

ghaff
5d ago
I’d almost certainly lose one or more of them if I did that. I use a compact wallet containing no more than I need and it also gives me a place to stick the odd luggage check etc.
jiehong
6d ago
Most of the world isn’t even covered by this feature yet, like the EU digital id and driving licences.
risico
6d ago
Same, although most of the time, at least cops, accept a photo of the actual ID card/driver license where I live (Romania), at least it worked the last time I got pulled over.
beAbU
6d ago
I leave my wallet in my car, because the only reason I need it is for my driver license.

My bank, however, has one of those authenticator doohickies that I need to use when I make big transactions online. Pop my debit card in, enter the pin, and then do a little dance with codes back and forth on their internet banking to authenticate the transaction.

So I am in this annoying situation where my wallet is never where I needed it: either I'm making a payment and I need to go to my car to get my card, or I need my license and my wallet is on my desk where I forgot it last time.

Google Pay and digital wallets have literally freed up one of my jean pockets permanently.

phantom784
6d ago
2 replies
Google Wallet supports this as well, but not for passports, only select state drivers licenses.

https://support.google.com/wallet/answer/12436402?hl=en

I wonder if passports will come to Google soon as well - that'd open it up nationwide as long as you have a passport.

Clent
6d ago
2 replies
Apple also supports select state drivers license.

I would definitely expect Google to follow quickly.

FateOfNations
5d ago
Generally the hangup/timeline is with the state government, not Apple/Google.
pxeboot
6d ago
Google Wallet has supported passports for about a year now [1]. Works great at TSA. You scan it yourself. You never need to hand them your unlocked phone.

[1] https://support.google.com/wallet/answer/15284332?hl=en

xd1936
6d ago
3 replies
I am never handing my phone to a cop.
bitpush
6d ago
5 replies
I get what you're saying, but if you think of it what we're doing today - handing over the one and only official piece of document to a) cop b) club bouncer etc.

They can hold onto it, and never return it. They can deface it. All of that is a possibilty.

You could argue, a sufficiently locked down phone is a better alternative. If they do something, you'll only lose $$

barbazoo
6d ago
1 reply
> They can hold onto it, and never return it. They can deface it. All of that is a possibility.

But they can't potentially look at your banking app, read private notes, messages and emails, operate your home automation, look at your calendar, etc. if all they have is a plastic card.

magnetic
6d ago
2 replies
They can't do that either with Wallet items. That's kind of the point: you can hand over your phone with a wallet item "unlocked" and visible on the screen, and that's all they'll have access to.
barbazoo
6d ago
Sure but then you've already given them your phone after which you don't know what happens. Plus it's a lot of leverage for them to have it, e.g. "unlock or you won't get it back".
iamnothere
6d ago
Until they covertly plug it in to the Cellebrite unit back in the patrol car.
JoshTriplett
6d ago
2 replies
If I lose a piece of ID, I've lost a piece of paper/plastic. I'm inconvenienced, but can easily get a replacement and have the original invalidated.
0x457
6d ago
> have the original invalidated.

Only for it's "original" use case - traffic laws enforcement. I don't think any other entity can validate if this piece of plastic is invalidated or not. Also, it's not like information on lost ID gets erased when you get a new one: still has your address, DOB and other info that can be misused.

op00to
6d ago
> have the original invalidated.

I once had three valid drivers' licenses, because my wallet was stolen (later returned), and I left my ID at a bar. All three were valid for use at the same time despite being reported lost/stolen - they had identical barcodes, etc.

ayntkilove
6d ago
... and if they hold the document upside down they can see your browser history and with a UV flashlight they can quick scan your app list for intel.
runako
6d ago
Exactly this. If your only license is on your phone, and the police officer decides to confiscate your license, now you have a lot more problems beyond not being able to legally drive.
therein
6d ago
I feel exactly the opposite about what you said. The ID is just an ID, my phone is my phone with other stuff in it.
throw0101d
6d ago
3 replies
> I am never handing my phone to a cop.

The point is that you don't have to:

> To present a Digital ID in person, users can double-click the side button or Home button to access Apple Wallet and select Digital ID. From there, they can hold their iPhone or Apple Watch near an identity reader, review the specific information being requested, and use Face ID or Touch ID to authenticate.

"hold … near … review"

If you're (e.g.) buying alcohol, then the "specific information" would be your birthday, and that is all that would be sent over. With a regular ID, verifying your age would mean handing over your physical card which would have all sorts of other non-relevant information to the task at hand.

Further:

> Only the information needed for a transaction is presented, and the user has the opportunity to review and authorize the information being requested with Face ID or Touch ID before it is shared. Users do not need to unlock, show, or hand over their device to present their ID.

AIUI, cops would have a verifying device or app and the information requested—which you authorize—is sent over wirelessly. Kind of like how you no longer have to hand over your credit/debit cards to (possibly malicious) cashiers, and just keep it in your hand and tap. (Older people may remember the carbon copy 'ka-chunk' machines.)

With a physical ID you have to hand that over because that is the only way the information can be read off of it. With a digital ID you can send a copy of your ID without physical exchange / handover.

0x457
6d ago
3 replies
> If you're (e.g.) buying alcohol, then the "specific information" would be your birthday, and that is all that would be sent over.

Unless there is a very tight control over this - lol nope. Big stores will request as much as they can to target you with ads.

op00to
6d ago
2 replies
You could then decide not to buy the alcohol. Unless you are severely addicted, you will not die if you don't purchase alcohol.
0x457
6d ago
2 replies
Yes, but the point is that we already know (app permissions, cookie tracking consents) that "ask only what you need to function" isn't how sellers operate.

Also, you need an ID to buy some OTC medicine and to pick up some prescribed medicine. As well some other cases when ID needs to be presented, but those probably require more than just DOB anyway.

v3xro
6d ago
2 replies
Again, citing the UK here, if you go to your doctor and get a prescription, all you need to pick it up is your name + address (said verbally over the counter) - no ID needed. I do not have statistics for the false pickup rates but I very much doubt it is anything to worry about.
bradfa
5d ago
In the US lots of prescriptions work the same. But some prescriptions and some over the counter (OTC) medicine requires presenting a legal ID to purchase because of a variety of laws.

Blood pressure prescriptions, no ID lots of times. OTC meds which are ingredients to make meth, need an ID.

0x457
5d ago
> all you need to pick it up is your name + address (said verbally over the counter) - no ID needed.

Does it include controlled substances? Sure, I can pick up ibuprofen 800mg with just my name and DOB said verbally, but whatever is on schedule II (US term, but think Adderall) I required to show my ID.

op00to
6d ago
The irony is that most of the ID-to-buy-medicine rules people cite were created by the same GOP lawmakers who push voter ID. The Sudafed restrictions came from the Combat Methamphetamine Epidemic Act, introduced by a Republican sponsor and signed by a Republican president. If you are worried about creeping ID requirements, look at who actually writes these laws.
mrighele
6d ago
Following the same reasoning, one could decide not to open any website, their TV, their phone and even their fridge. None of these will kill you

While should companies tracking us to make more money affect our habits?

throw0101d
5d ago
1 reply
> Unless there is a very tight control over this - lol nope. Big stores will request as much as they can to target you with ads.

And you will now be informed about what is being asked for, as opposed to the current situation where if you are handing over your physical ID you may have no way of knowing what is being gleaned from it.

And being informed, you can choose to accept or decline. You can also question the need for it (the cashier won't be of much help, but inquiries can be done to head office).

0x457
5d ago
So assuming your goal is to buy something that requires you to show an ID (don't move the goalpost with "you can just not buy it"), my options will be:

1) show a digital ID where I can see that they are asking for much more

2) show my physical ID where they can see much more, they need

I mean, I'd pick #1 because at least it will be used just for marketing and not noting my address as I buy a lot of travel supplies.

mpeg
5d ago
If anything, digitalisation will make it easier.

Currently if you hand your id, the cashier could theoretically take a photo of it but it's an extra (and awkward) step, and then someone would have to figure out how to extract the data and make it usable.

raoulj
6d ago
1 reply
For buying alcohol, I wonder if faceID will also somehow be required to verify the holder of the phone corresponds to the digital id
FateOfNations
5d ago
Data point: Albertsons/Safeway/etc. is rolling out new card readers that have a camera in them. Software support likely isn't in place yet, but that's definitely something they are thinking about long term.
v3xro
6d ago
3 replies
When buying alcohol in a physical store, in the UK we have the "Challenge 21/25" schemes https://www.drinkaware.co.uk/facts/information-about-alcohol... such that yes if you look very young the cashier/automated checkout assistant will ask for your ID but in most cases, they will approve without checking anything. I do not see any positives to requiring identification for all transactions.
throw0101d
5d ago
> I do not see any positives to requiring identification for all transactions.

It is not about requiring ID for all transactions, it is about when ID is actually asked for (which may not be every time), the information can be provided in a more privacy-friendly way.

theshrike79
5d ago
The cashier wouldn't need to ask your ID at all?

Since the phone would authenticate your age as well as give the payment information.

WhyNotHugo
5d ago
The Netherlands is quite similar. You need to be 18 to buy alcohol, but only need to show an ID if you’re under 25.

It’s pointless to ask someone who’s clearly in their fourties for an ID in this case.

moralestapia
6d ago
1 reply
That is usually not something you choose.
dmix
6d ago
1 reply
Only if you're being arrested. If you're at a traffic stop or tons of other scenarios would never need to.
runako
6d ago
2 replies
It's normal for police at a traffic stop to take your license back to their car while they write a ticket or whatever. Until laws change, having your only license on your phone means handing your phone to an officer until they are satisfied they no longer need it.
tjohns
6d ago
2 replies
States that have implemented mobile drivers licenses are starting to issue handheld readers to police officers, precisely so what you describe doesn't happen.

The people building this know nobody wants to hand their phone over to the police.

runako
5d ago
1 reply
Police sometimes confiscate licenses (rightly or wrongly).

Having your license confiscated when it doubles as your wallet, MFA device for work, and primary communications device sounds like a disaster.

jlokier
5d ago
You make a good point.

In principle the police Wallet reader could have a function to virtually suspend the license, instead of physically confiscating your phone.

I wonder if they thought of that, and I wonder if police would use the option or confiscate the phone anyway.

Muromec
6d ago
Surely police would never say their reader is broken and never make it your problem
dmix
6d ago
Yeah that’s why OP said he wouldn’t hand his phone over. Implying he prefers a physical one.
chiph
6d ago
1 reply
> They will also be asked to use their iPhone to read the chip embedded on the back of their passport to ensure the data’s authenticity.

I installed an RFID app from the Apple app store (3rd party, not from Apple) and it couldn't read the chip in my passport. Perhaps Apple's firmware was filtering those out at the time?

chocolatkey
6d ago
I was able to use the (free) app “ReadID Me” to decode passport information months ago
sublimefire
6d ago
4 replies
There was a post from trailofbits blog recently about how passport crypto works. Kind of related here.

I wonder if this is some zero knowledge proofs here or what? Reading the passport and its chip implies some terminal authentication capabilities coming from Apple devices. Passport would not allow reading sensitive data from the chip unless the terminal is valid.

Another question is if Apple is allowed to read your biometric data?

internetter
6d ago
1 reply
> Reading the passport and its chip implies some terminal authentication capabilities coming from Apple devices

They’ve had some form of this for ages with Apple Pay

sublimefire
6d ago
1 reply
Sorry I was meaning to say "passport terminal" capabilities which would require a cert to be issued by a country whose passport chips you want to read. Well maybe they had this for a while but AFAIK you could not read passport details with an apple device before
frankus
6d ago
1 reply
From that article it looks like all you need to establish a secure connection with the passport is some data that is printed in plaintext on the photo page.

It seems (again, if I'm reading correctly) that you only really need a private key in order to issue a passport.

tjohns
6d ago
1 reply
Yes, that's correct. There have been apps on iOS and Android that can read your passport via NFC for ages. As you noted, all you need is the plaintext information printed on the photo page to generate the Basic Access Control key, which will let you connect to the passport's NFC chip.

Issuing a passport is a different issue entirely, since you need a country's document signing key.

vessenes
5d ago
quick note -- I believe you need a separate key to get biometric data out of the passports, but it's been a while since I looked at passport digital infrastructure.
dzhiurgis
6d ago
2 replies
I still find it bonkers reading passport doesn't validate it against it some centralised database. Like, $1 in your bank account and a credit card is more advanced than a passport.
tjohns
6d ago
1 reply
Passports are inherently decentralized, which is needed because not all countries cooperate with each other - or have the same budget for technology/security. It's really way something at global scale could work.

(There are national-level databases, but presumably not every country has access to every other country's database.)

dzhiurgis
6d ago
1 reply
I struggle to imagine international airport without a credit card reader. Maybe some borders in some countries could've struggled before cheap ubiquitous internet, but not anymore. And even then it's their problem.

Countries don't need access to database. They need to validate public key / hashsum is valid (or something along those lines).

Muromec
6d ago
Thats a thing actually
Muromec
6d ago
Passports have a signed data blob to ensure its authentic and usually a revocation lust too.
crowbahr
4d ago
> There was a post from trailofbits blog recently about how passport crypto works. Kind of related here. > > I wonder if this is some zero knowledge proofs here or what? Reading the passport and its chip implies some terminal authentication capabilities coming from Apple devices. Passport would not allow reading sensitive data from the chip unless the terminal is valid. > > Another question is if Apple is allowed to read your biometric data?

Passport chips aren't that complex, especially not American ones. You just need to transmit part of the MRZ to unlock them (Other ICAO compliant passports have slightly different requirements, still all easily doable for any smart phone with NFC transmit)

The Apple ID isn't a ZKP - IIRC they're doing a CBOR representation of the claims which is signed with their own cert.

sugarpimpdorsey
6d ago
2 replies
Can we use this for voter ID?
SV_BubbleTime
6d ago
2 replies
You have to show ID to vote in my country, I thought that was the normal thing.
pat2man
6d ago
1 reply
We don't have a national ID here in the US. Passports can be quite expensive. Local state ID cards don't prove citizenship.
0x457
6d ago
> Passports can be quite expensive.

It's $165 per 10 years if you don't lose it or $65 if you just need in place of national ID (i.e. no international travel). I think anyone can save up that much in 10 years, renewals a bit cheaper btw.

> Local state ID cards don't prove citizenship.

No, but to get a Real ID in any state you have to prove you're in the country legally, and in some states to get any form of ID you have to prove that.

hexis
6d ago
It is, many states in the US are abnormal in this way.
op00to
6d ago
1 reply
Americans do not need to provide ID to vote, so no?
saguntum
6d ago
1 reply
In some states you do need ID to vote. Texas, for example.
op00to
5d ago
Huh, thanks! I am a yankee so I have a bit of a limited view.
alberth
6d ago
2 replies
As an aside, I've been using TSA Touchless at select airports.

It's pretty slick.

No ID, nor Board Pass needed.

Just walk up to TSA, and only facial recognition is needed. It's extremely fast too.

https://www.tsa.gov/touchless-id

BriggyDwiggs42
6d ago
1 reply
Now that we’ve got ice walking around with an app that uses facial recognition to determine if you’re a citizen, fuck the facial recognition stuff. This tech should be out of government hands.
0x457
6d ago
2 replies
> Now that we’ve got ice walking around with an app that uses facial recognition to determine if you’re a citizen, fuck the facial recognition stuff. This tech should be out of government hands.

When I was in LAX last week, facial recognition on entry was only for US citizens anyway, and for it to work they need to take a photo of you when you're leaving. I don't see how it helps ICE in any way, plus it's handled by CBP.

Also, it didn't work on me, because I left clean shaved and returned with a beard.

Klonoar
6d ago
1 reply
> When I was in LAX last week, facial recognition on entry was only for US citizens anyway, and for it to work they need to take a photo of you when you're leaving.

I've definitely avoided photos on exit and used it coming back in, so I'm not sure this is accurate.

edot
5d ago
1 reply
Same here. I always refuse facial recognition when possible, but they had no problem using it on return from international travel. The systems aren’t linked (yet).
0x457
5d ago
2 replies
Why? They already have photos of you and your biometric data. All you're doing is slowing down the line for everyone else.
Klonoar
5d ago
1 reply
It doesn't slow down the line, they hold you at just about every crowded airport until the line for the luggage/body scanner are ready for the next person. Even if it did, though, I have the right to opt out, so you will wait until I've exercised my right. Deal with it. :)

I reject it because I don't believe in a world where rampant facial recognition should be the norm.

0x457
5d ago
1 reply
When I was in Haneda airport, a machine tells you which of 4 lines to go to and if you have forgotten there is a screen with live camera feed from screen POV and little boxes drawn on top kinda above you with your line.

I thought it was pretty neat, but felt super invasive.

CBP facial recognition is far less invasive. It's not an instance of "rampant facial recognition" in my opinion. There is really no downside, "they" already know you might be at the airport because you booked a ticket, since most US airports don't let to the air side without a ticket. You are already on bunch of cameras inside the airport, including right when:

1) your ID verified by human or by a kiosk

2) when you drop off your bags

3) when you board the plane

4) every other time you have to show your ID or boarding pass

You do you though.

Klonoar
2d ago
You say these points as if they're not day-one considerations of this discussion.

If they know that already, then they don't need to use facial recognition. It acts as a de-facto endorsement of the idea that it should be used everywhere else in society, which is what my issue is.

I also lived in Japan for a number of years and I'm familiar with their system at the airports. Japan is not America and I do not find it useful or interesting to compare the two approaches; when I lived there - and indeed, whenever I go back - I'm aware of and resigned to the aspect of that society not giving a shit about it all. I do not think America needs to be the same way.

edot
5d ago
Unused rights atrophy.
runako
6d ago
> I don't see how it helps ICE in any way, plus it's handled by CBP

ICE and CBP are both part of DHS. This data is going to be abused, if it is not already.

SV_BubbleTime
6d ago
Surely nothing nefarious has ever been promoted with the offer of convenience!
velomash
6d ago
2 replies
It’s inevitable that identification and payments continue to digitize. I’d prefer that physical ID / cash remain legally protected but that I can also go for a run with only my watch and buy a beer afterward
dmix
6d ago
Indeed, it needs some hard legal protections from abuse but it will come eventually.
varispeed
6d ago
It's a matter of time transaction will be denied because you didn't run the required distance set by the government, so beer allowance has not renewed.
stavros
6d ago
2 replies
I'm really wary of these initiatives, because perfect law enforcement is how society ossifies. Imagine if we could prosecute all homosexual tendencies when they happened, or all interracial relationships, or any other antiquated law. Society would never progress.

What happens if the government can now perfectly enforce that people under 18 can't do X or Y?

pat2man
6d ago
5 replies
How does this apply to a digital version of an official government ID? The government already has all this data.
stavros
6d ago
5 replies
I didn't say anything about the data the government has or doesn't have. I'm talking about perfect enforcement. Try faking a digital ID.
maratc
5d ago
1 reply
> Try faking a digital ID.

Since most of that "digital ID" manifestations are just pixels on a screen, these are not a problem to fake pixel-perfect.

I did some limited travel during the COVID era, including areas that did not want to recognise my country's digital vaccination certificate. I presented them with a pixel-perfect picture of their own country's digital vaccination certificate. It's easy to copy from a screen of a friend, and it's not complicated to create your own Apple Wallet pass that looks like the one you want.

stavros
5d ago
1 reply
How did you fake the cryptographic signature QR code?
maratc
5d ago
2 replies
I was showing a real QR code -- that was issued to a person who wasn't me. As soon as that produced a big green checkmark on anyone's QR scanner, I was in.
jamal-kumar
5d ago
1 reply
I know a guy who went to jail for that. He was in the news and everything. Banned from this country for life. Warned him that what he was doing was a stupid idea, he was even doing it for others who also got arrested...
maratc
5d ago
1 reply
I don't know what "that" was, and again, I had both the vaccination and the digital certificate to prove it; the system in place would not accept the real documents, so I fed it with other documents that it did accept.
jamal-kumar
5d ago
1 reply
Showing a QR code that belonged to someone else, like you know, the thing you said you did

Eventually in a system like that they may refine their procedures and then you get dinged essentially...

maratc
5d ago
The people who check your QR code with scanners on the entrance to a shopping mall (and refuse to let you in unless the scanner shows a green mark) are not the police nor the prosecution, and I have a good case to present to a judge in any case.

"The guy who went to jail" could be unvaccinated (or even infected) and presenting other people's certificates to enter an area for vaccinated people only (e.g. hospitals) where he might have endangered other people's lives; that's something that might be deserving jail time. I was vaccinated however, and by all means had the right to enter that shopping mall; I just wasn't able to prove it to the imperfect system that was there to check.

stavros
5d ago
1 reply
Then you're hoping they won't try to match the info on the screen with the info on the paper, which is very easy to foil (just don't skip the check).
maratc
5d ago
1 reply
If they need to match with the info on paper it's not clear what the case for "digital id" is? If one needs to present "digital id + paper id" one can simply present the paper id as they do today.
stavros
5d ago
1 reply
They won't. They'll just check the digital ID. I said you can't fake a digital ID, you said you've faked a physical ID, which isn't really relevant.

Digital IDs can't be faked. The only way to fake them would be to convert them to physical (what you did) and hope that the physical ID gets accepted.

maratc
5d ago
That's kinda theoretic discussion by now. As the whole COVID thing is behind us, we can probably look at all the money that were spent in the world to create vaccination certificates, sign them, create the distribution network, distribute the certificates, build the verifying scanners, purchase them en-masse and pay the thousands of people who were standing at the entrance of numerous shopping malls and using these scanners to check the QR codes, only to create a system that is trivially bypassed by using a jpeg file.
alwa
6d ago
And, specifically, frictionless perfect enforcement. Kind of like CCTV you can pull on request after a crime, vs proactive permanent ubiquitous surveillance (looking at you, Flock Safety).

It feels healthier for the enforcement apparatus to have a budget, in terms of material personnel or time, that requires some degree of priority-setting. That priority-setting is by its nature a politically responsive process. And it’s compatible with the kind of situation that allows Really Quite Good enforcement, but not of absolutely everything absolutely all the time.

Otherwise ossification feels like exactly the word, as you said, stavros: if it costs nothing for the system to enforce stuff that was important in the hazy past but is no longer relevant, nobody wants to be the one blamed for formally easing restrictions just in case something new bad happens; 20 years later you’re still taking off your shoes at the airport. (I know, I know, they finally quit that. Still took decades. And the part that was cost-free—imaging your genitalia—continues unabated.)

rpdillon
5d ago
Yeah, perfect enforcement is dystopian. I don't think most people understand this, but your point is very well taken.
watermelon0
6d ago
We have this issue already with biometric passports and ID cards.
dwaite
6d ago
This is based off of a biometric passport, which have been digitally signed for a very long time now.
godelski
6d ago
1 reply
At best a digital ID has an additional attack surface and is just more accessible.

You normally aren't carrying your passport with you, right? So even if lower security, the chance of that information being swiped is generally lower.

Phones are pretty high profile targets, this makes them more so.

I do like the idea and the convenience, but I'm definitely wary of these things too. Especially in the modern tech world where security is often being treated as a second thought as it is less impactful for sales. I'm pretty sure it is always cheaper to implement the security, but right now we're not great at playing long games and we like to gamble. Humans have always been pretty bad at opportunity costs. We see the dollars spent now and that seems to have far more value than what you save later.

On the other hand, currently US citizens are not legally required to walk around with their IDs on them. That's not true for non-citizens btw. You should have to just give the officer your name, but they can detain you while they "verify your identity." With an ID becoming frictionless and more commonly held on person, will this law change? Can we trust that it'll stay the same given our current environment of more frequent ID requests (I'm trying to stay a bit apolitical. Let's not completely open up that issue here?). I'd say at best it is "of concern." But we do live in a world run by surveillance capitalism.

There's a really good example I like of opportunity cost that shows the perverse nature of how we treat them. Look at the Y2K bug. Here on HN most of us know this was a real thing that would have cost tons of money had we not fixed it. But we did. The success was bittersweet though, as the lack of repercussions (the whole point of fixing the problem!) resulted in people believing the issue was overblown. Most people laugh at Y2K as if it was a failed doomsday prediction rather than a success story of how we avoided a "doomsday" (to be overly dramatic) situation. So we create a situation where you're damned if you do and damned if you don't. If you do fix a problem, people treat you as if you were exaggerating the problem. If you don't fix the problem you get lambasted for not having foreseen the issue, but you do tend to be forgiven for fixing it.

Just remember, CloudStrike's stock is doing great[0] ($546). Had you bought the dip ($218) you'd have made a 150% ROI. They didn't even drop to where they were a year previously, so had you bought in July of 2023 ($144) and sold in the dip you'd have still made a 50% profit in that year... (and 280% if you sold today).

Convince me we're good at playing the long game... Convince me we're not acting incredibly myopic... Convince me CloudStrike learned their lesson and the same issue won't happen again...

[0] https://seekingalpha.com/symbol/CRWD

GardenLetter27
5d ago
3 replies
You're ignoring the benefits though - it will help adapt more services to work online and reduce bureaucracy.

Look at Germany where they outright refuse to acknowledge emails as a legal notification / correspondence so everything still gets sent as letters and fax. It's extremely slow and cumbersome.

Also it will help for security as the central service can authenticate you, instead of every little hotel and bank branch, etc. keeping a copy of your passport.

pcdoodle
5d ago
Good. Send it in the mail. I don't want my inbox to require legal burden to read.
ghaff
5d ago
There are a ton of things in the US that require or at least almost universally use letters for notifications.
godelski
5d ago
Am I ignoring the benefits or am I just responding to the comment?
varispeed
6d ago
1 reply
Most people are missing the fact that your passport in the drawer doesn't know where you are.

Once everyone is mandated to carry digital ID, then possibilities to track population open up.

frankus
6d ago
1 reply
Isn't this just seeing a slippery slope and deciding to build a terrace[1], in that the existence of a digital ID doesn't automatically lead to mandate to carry one—any more than the existence of a physical ID card does?

[1] to paraphrase one many excellent John McCarthy-isms: http://jmc.stanford.edu/general/sayings.html

varispeed
5d ago
1 reply
physical ID doesn't report your location.
vel0city
5d ago
A physical ID can, depending on the validation process.

Digital ID doesn't have to report your location either, depending on the implementation. It's not like it's a given a digital ID system has to give your location.

An SSH key is a digital ID. Does it report your location when you use it? A GPG key can be a digital ID. Does it report your location when you sign something?

steve_taylor
6d ago
3 replies
Governments aren’t just rolling out Digital IDs. They’re rolling out the platform to enable them to require that you authenticate with a range of apps and websites, ostensibly to keep children safe, with the real purpose being to link your unique identifier to all your online activity. They can then easily build an overall picture of who you are from that ID. Potentially, all this data can be fed into a pre-crime AI.
sedatk
6d ago
2 replies
They’re already doing that without digital IDs. I don’t see how this affects the other.
mrtesthah
6d ago
2 replies
Why would you want to streamline that process for them even more?
sedatk
6d ago
Because anti-privacy laws can be fought, and the convenience, privacy, and reliability benefits of these applications can stay.

I’m against “let’s hold all progress because a few states can go backwards faster than they’ve been” perspective.

boxed
5d ago
You're streamlining it for the USER, not the government.
steve_taylor
5d ago
1 reply
Part of a Digital ID is an identity provider that implements protocols such as OAuth 2 and OIDC. Once this is in place, the government that owns the Digital ID system can mandate that platforms such as social networks, search engines, email providers, etc. link the users in its jurisdiction to its Digital ID via OAuth/OIDC. As this isn't as onerous as reviewing identity documents, governments can make this a requirement for a large range of platforms, even quite small ones.

Yes, I realise governments already have some powers to view private data, but they have to do a lot of legwork to link data to specific people. They'll always get false positives, false negatives, duplicates, etc. And they'll miss a number of platforms that have data on the person of interest. Digital ID combined with a mandatory identity platform and data retention requirements will make law enforcement far more efficient and give governments unprecedented power over what we see, hear and say online. The government will have a complete list of all the platforms on which you authenticated with their Digital ID.

We're already sleepwalking into this. In Australia, we have the under-16 social media ban taking effect next month. We're also in the process of rolling out our Digital ID, which has an OAuth/OIDC-based identity system. Numerous government departments have already integrated with it. It opens up to private sector integrations in December 2026, just in time for all involved in the under-16 social media ban to realise it's not working effectively and for Digital ID to save the day. The law states that Digital ID is a voluntary means of identification and other methods should always be offered, but the UX of OAuth 2 vs. uploading photos of your ID documents and a selfie, and waiting for it to be reviewed, will make Digital ID the de facto standard for Australians proving their age and, in the process, permanently linking their Digital ID Identifier to all their social media accounts. That includes "anonymous" ones like Reddit. And integrators can apply for an exemption to Digital ID being voluntary on their platform, making the case that the per-user cost of complying with the law without Digital ID is prohibitively expensive.

Once Australia rolls this out to social networks, it will keep expanding until virtually everything is captured.

sedatk
5d ago
> Once this is in place, the government that owns the Digital ID system can mandate that platforms such as social networks, search engines, email providers, etc. link the users in its jurisdiction to its Digital ID via OAuth/OIDC

Governments can do that today already. Digital IDs don't contribute anything to this. They just make our lives easier, not governments'.

> but they have to do a lot of legwork to link data to specific people. They'll always get false positives, false negatives, duplicates, etc.

Those false positives/negatives, duplicates affect real people too. That's just a case for digital IDs, not against.

> and, in the process, permanently linking their Digital ID Identifier to all their social media accounts

How do you reach to that conclusion? How are they permanently linked? It's perfectly possible to verify your age digitally without permanently linking your ID with your social accounts.

> Once Australia rolls this out to social networks, it will keep expanding until virtually everything is captured.

Again, that can be done without digital IDs. You're holding the wrong front here. Privacy invading laws should be fought, but the public shouldn't be kept away from the convenience and privacy gains of digital IDs. It makes no sense.

bootsmann
6d ago
> Governments aren’t just rolling out Digital IDs. They’re rolling out the platform to enable them to require that you authenticate with a range of apps and websites, ostensibly to keep children safe, with the real purpose being to link your unique identifier to all your online activity.

This is just straight up not true for the EUDI which is probably the most serious and advanced approach to digital ID. The wallets are decentralized and the government does not see the individual authentication transaction in any way.

jjgreen
5d ago
s/Potentially/Obviously/g
pat2man
6d ago
To set this up, you have to scan the chip on your passport. Its essentially the same data on both chips, one is just in my phone's enclave and the other is in an embedded NFC chip.
throwaway290
6d ago
2 replies
Also, if it's easy to check your ID, there will be more and more checks of your ID. And that's not great...
perihelions
6d ago
1 reply
It also normalizes in the public eye the notion that conventional ID's deserve suspicion, and pushes the Overton window, in the US context, further in the direction of accepting that LEO's can and should be jailing people solely on their personal suspicions about ID authenticity.

A person without an iPhone (or not utilizing it fully) does not deserve suspicion. It's not a crime to opt out of the mainstream iPhone sociology. It is not right to treat a person who is e.g. elderly, or for some other reason has "fallen" behind the digital divide, as an inferior person with fewer rights and privileges.

It's reliably in tech peoples' blind spot, when thinking about how to make things "efficient" for the common case, one that reflects their own experience, to not think or care about the less-common cases that don't affect them. See: digital-only payments[0]. But being banned from shopping in a few hipster stores is a small thing compared to being wrongly jailed!

[0] https://hn.algolia.com/?query=cashless

mathgeek
5d ago
1 reply
> It is not right to treat a person who is e.g. elderly, or for some other reason has "fallen" behind the digital divide, as an inferior person with fewer rights and privileges.

While it may not be moral, our entire world and society are set up to treat folks with more resources as superior people with more rights and privileges. Poorer folks fall behind the digital curve just as readily as they fall behind the professional, educational, etc. ones. Who you are born as and where that takes place is still one of the driving factors of your rights and privileges. It's certainly noble to fight that (just to be clear that I'm not arguing for digital IDs as somehow valid because the rest of the system is already unjust).

throwaway290
5d ago
1 reply
> While it may not be moral, our entire world and society are set up to treat folks with more resources as superior people with more rights and privileges.

I don't know about that. Ability to buy more != superiority and rights and privileges.

I know a bunch of people who disdain the ultra rich and see them as the opposite of superior if anything. And rights are the same for everyone...

mathgeek
5d ago
1 reply
While morality is a different discussion for sure, I was only referring to how society as an organism views people. The wealthy undeniably have more rights and privilege than the poor.
throwaway290
5d ago
privilege yes, but rights... maybe in some societies, but I wouldn't generalize
Muromec
6d ago
I live in one of the countries where id is mandatory to have and to carry.

Not counting times when id was exchanged for another id, I believe I was asked to show the physical card maybe twice (in six years), one of those was for voting, the was in healthcare. Guess how white I am, lol.

Digital thingy zo, that needs button pressing every time I log into whatever government or goverment-related things.

So you are kind of right

altairprime
6d ago
Honestly, hooray for dragging the U.S. into everyday people having a federal ID in their pocket. Having to check fifty different ID layouts times three revisions is a nightmare and no one uses passports domestically today outside of airports.
SilverElfin
6d ago
I feel uncomfortable with these changes. Between this, digital currencies, airlines not doing printed boarding passes, metros requiring smartphones, … it feels like we are going to lose control and privacy as consumers.
pookha
6d ago
Digital ID is a misnomer, it should be called "Digital Social Application". These are NOT ID"s. They're government dreamcasted app's for managing the lives of civilians.

85 more comments available on Hacker News

ID: 45902273Type: storyLast synced: 11/16/2025, 9:42:57 PM

Want the full context?

Jump to the original sources

Read the primary article or dive into the live Hacker News thread when you're ready.