Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

maybe you are in Scandinavia, but many countries do not even have a centralised register of births, deaths, marriages... and so they do not have a centralised and canonical record of identity of all people in the country.


For example Czech republic has central register of all residents. The register is intentionally designed so that it does not provide any kind of identifier that is both long-term stable and globally meaningful (there is a number called RČ broadly equivalent to NIN in other countries, but it is not supposed to be used since 2010).

Conceptually there is ZIFO (Basic ID of natural person), that should be globally unique, but this is known only to a subcomponent of the central registry that is run by different govarnment entity than rest of the system. At same time the design of that subcomponent contains provisions for allocating new ID, mainly for handling the cases when that ID was allocated wrong (both multiple IDs for one person and multiple persons sharing same ID), so even that is not necessarily stable ID.

Users of that data refer to persons using AIFO, which is specific and meaningful only for particular database (called AIS) and if different databases need to identify particular person as having the same identity they have to call the central translation subcomponent (the API surfaces are designed such that the translation the calling system will not get the result of the translation, which is only sent to the destination system). Even that the AIFOs are meaningless, they are required to be not disclosed to anybody. Alternative IDs that can be used are broadly serial numbers of government issued identitty/travel documents, but these are necessarily both revocable and have limited time validity (the aforementioned technically deprecated RČ is essentially a special case of this).

I believe that this design comes from some pan-EU initiative related to GDPR. For example according to Wikipedia Austria uses broadly similar, but less fine-grained system.

This has interesting issue with regard to things like eIDAS as there is no sane ID that could be included in the qualified personal certificate. One Czech QCA (PostSignum) does not include any kind of personal ID in its personal certificates, second one (I.CA) can optionally include the serial number of identity document that was used for identification. Apparently you can get Swedish qualified certificate that includes Czech RČ in its CN form Zealid. You are supposed to register your certificate into the resident registry yourself, which creates the link between the certificate and your identity. The slight issue with that is that there is no sane way how a third party outside the architecture of these registers can validate that link (you can send them a signed PDF with your data from the resident register, which is apparently what you are supposed to do, but "sane" would look different).




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: