Comment Re:This is pretty well done (Score 1) 95
Do any of these strongly privacy preserving implementations come with any type of guarantees by the governments requiring them? For example, should the government as the issuer fail to secure their end so that they get hacked and now all past logged verifications can be tied to individuals, all those individuals get large budget covered by the government (or their insurance) to pay any fallout that might come from this (both compensation as well attorneys or other investigation or enforcement costs).
Such guarantee could be provided by an insurance company, who I'm sure would do a deep due diligence to ensure the security of the deployed system, which in turn would benefit the people using it (a third party inspection/validation, plus monetary payout to fix any problems caused by it).
Without any guarantees, the average user gets nothing but "trust us, this is bulletproof, but should we fail, the most you'll get from us is an apology" - kind of what happens in the US today whenever a company or government agency gets compromised, even if it's indisputably their fault, such as leaving internet exposed databases without passwords or with default passwords. This happened to me on more than one occasion, all I got was letters along the lines of "Oups, just to let you know we left your information open to the internet for who knows how long, we have no idea who accessed it. Sorry and good luck!" - at least two such letters were from a government agency. A private citizen can't even sue the government unless they agree to be sued, plus proving in court damages from their incompetence vs. another agency or some private company breach is near impossible.
Such guarantee could be provided by an insurance company, who I'm sure would do a deep due diligence to ensure the security of the deployed system, which in turn would benefit the people using it (a third party inspection/validation, plus monetary payout to fix any problems caused by it).
Without any guarantees, the average user gets nothing but "trust us, this is bulletproof, but should we fail, the most you'll get from us is an apology" - kind of what happens in the US today whenever a company or government agency gets compromised, even if it's indisputably their fault, such as leaving internet exposed databases without passwords or with default passwords. This happened to me on more than one occasion, all I got was letters along the lines of "Oups, just to let you know we left your information open to the internet for who knows how long, we have no idea who accessed it. Sorry and good luck!" - at least two such letters were from a government agency. A private citizen can't even sue the government unless they agree to be sued, plus proving in court damages from their incompetence vs. another agency or some private company breach is near impossible.