[2/2]

> The solution is build a strong robust framework around which information is clearly in the domain of user-controlled identity/PII and that shall not be abused without consequence, and then enforce the law. How is that not clear?

That has two major problems.

1) There is no way to verify what they do with it. Once they have the information, what they do happens entirely within their own organization, which the user has no way of knowing. They'll lie about it, or secure it inappropriately and then have it leaked. The only real solution is for them never to have it to begin with, not laws on what they can do with it that nobody can verify.

2) Defining PII in this way is basically hopeless, because whether something is personally identifiable is context-specific.

You want to prevent a social media company from getting your PII, so you never give them your name or date of birth, all they have is your username with them. If the same company owns a retailer, you make a separate account with the retailer and the social media service still doesn't have a physical address for your social media account even if the retail service does.

Give that company a way to prevent you from having "two accounts" and now you have one account and your social media account is correlated with your name and physical address. But they get to claim they need the information because the retailer has a legitimate need for your shipping information. And the username goes from not identifying you to identifying you.

> We live in a blurry purgatory where nobody knows what exactly is an identifier and how it should be respected because we don't have strong digital identity.

How would "strong digital identity" change that? All it would do is create an additional form of PII. All of the others would still be there and be just as uniquely identifying, including the ones that weren't created to be or appear to be at first glance but are, or are in combination with some other variables they also know.

> The ad industry doesn't need a credential document to track you. They just tag you with their own UUID when they see you and your shitty browser (also built by ad-tech) does the rest.

It's not that hard to maintain multiple identities and keep them separate. The easiest way for laymen is to use separate devices; older devices are cheap and more than fast enough for basic internet use if you just want to read the news on a device that doesn't know where you work etc.

Forced single identity kind of throws that out the window as soon as they find any way to correlate accounts using the same ID, and do you really think they won't?

> It doesn't create a single new problem (or if it does it's strictly in the realm of unsophisticated doom and gloom tirade FUD).

Okay, here's a single, specific, new problem: If your government ID is digital rather than physical then things that used to require a criminal to be physically present in your jurisdiction can now happen over the internet from countries where they have no fear of prosecution.

> It makes a shitty system better for the vast majority of humans who'd aren't super fond of internet trolling, scalping, spam, bullying, and all manner of activities that our current system tacitly glorifies.

There are alternate ways to address these problems that don't involve massive centralization of authentication.

> Privacy is not one dimensional. If you're competent you understand that privacy isn't "nobody knows anything about me". Privacy is about only sharing sensitive information with people you trust.

That's kind of the point. You're already free to give truthful information to anyone you trust. Now what do you do if you don't trust someone but they demand your info anyway and you're not in a position to refuse?

> I want technology to augment and enhance human systems. I don't want to evolve into a trans-humanist hive mind type of civilization where we're all faceless interchangeable worker bees without any sort of reputation or identity.

There is a difference between faceless anonymity and having multiple identities. The latter is how human society has always operated. People behave differently in front of their parents and their friends. They wear different clothes to work and to play. They say things in confidence to people they trust that they wouldn't say to people they don't.

But now you're not just saying it to the people you trust, you're saying it to people you trust and a huge corporation who records it forever and often gets breached. Keeping a thick line between these different identities is something we need to support, not inhibit.

You're really looking for a rate limiter to prevent someone from creating a million accounts. You don't have to merge everyone's pseudonyms into a totalitarian centralized identity system for that. All you need is something that puts a price on account creation. A literal price would work fine. So would a dozen other things.

The real problem is that services don't want something that adds friction to account creation, but they do want to track everyone. And what I'm saying is that we should fight against making the tracking everyone thing frictionless.