3 ms·

As far as I know, the USA doesn't have identity cards. That's probably why the SSN is often used as an identifier there: it's the closest thing to a "unique ide

by cesarb 11y ago

As far as I know, the USA doesn't have identity cards. That's probably why the SSN is often used as an identifier there: it's the closest thing to a "unique identifier" they have. (Of course, treating it like a password is madness: as an identifier, it should be public.)

WorldMaker 11y ago
A good majority of Americans have a state-issued driver's license (or equivalent for non-drivers) with a unique identifier on it. I am absolutely surprised we don't use these identifiers more often, especially given that unlike SSNs, driver's licenses in most states don't have "Please don't use for other identification purposes" written on them like SSN cards do. Also yes, IDs are not passwords and should never be used for authentication purposes. This is never "two-factor", it is always a "wish it were two-factor" kludge.
- WorldMaker 11y ago
  Of course, the issue with driver's license numbers is they do change when people move. People like SSNs because they are handed out "at birth" and mostly don't change in a person's lifetime. [] [] I love the mostly clause here, because they can, in fact, change, and it's sad how much software and credit reporting breaks because of that in-built assumption that person will ever have one SSN.
- baconner 11y ago
  Drivers license is an even bigger can of worms - see any voter identification law discussion.
- sbierwagen 11y ago
  unlike SSNs, driver's licenses in most states don't have "Please don't use for other identification purposes" written on them like SSN cards do. SSN cards haven't had that printed on them since 1972.
baconner 11y ago
I think the problem is basically that it presents some (albeit weak and messy) solutions for companies and they're not stopped by law from this risky behavior. Since national IDs are politically untenable in the US no pkey alternative is forthcoming - at least none that appeal to lazy companies who want aa low effort solution. We are long overdue for some federal legislation about how ssn can be used and how it cannot along with other basics to protect people from I'd theft. It should be illegal to use it as any kind of identity verification for instance, but its not.
pjc50 11y ago
The UK doesn't have identity cards either, but the corresponding system (national insurance number) is rarely asked for outside of tax-related reasons.
ajdlinux 11y ago
Australia doesn't have a national identity card, and we don't have anything that's used like the SSN. Indeed, the Tax File Number (which identifies one's tax record, similarly to how the IRS uses the SSN) is legally protected such that it's a criminal offence for anyone other than the Tax Office, an employer, a financial institution or an accountant to even ask you to provide it. Centrelink Customer Reference Numbers (which are used for our equivalent of the Social Security program) aren't legally protected (as far as I know), but since only half the population even has one, the only reason a private sector organisation will ask you for it is to check that you're receiving social security benefits. You do see driver's licence and passport numbers being used, but it's far from the de facto standard that the SSN is, and thus far less of a data security nightmare.

by cesarb 11y ago

WorldMaker 11y ago

A good majority of Americans have a state-issued driver's license (or equivalent for non-drivers) with a unique identifier on it. I am absolutely surprised we don't use these identifiers more often, especially given that unlike SSNs, driver's licenses in most states don't have "Please don't use for other identification purposes" written on them like SSN cards do. Also yes, IDs are not passwords and should never be used for authentication purposes. This is never "two-factor", it is always a "wish it were two-factor" kludge.

WorldMaker 11y ago
Of course, the issue with driver's license numbers is they do change when people move. People like SSNs because they are handed out "at birth" and mostly don't change in a person's lifetime. [] [] I love the mostly clause here, because they can, in fact, change, and it's sad how much software and credit reporting breaks because of that in-built assumption that person will ever have one SSN.
baconner 11y ago
Drivers license is an even bigger can of worms - see any voter identification law discussion.
sbierwagen 11y ago
unlike SSNs, driver's licenses in most states don't have "Please don't use for other identification purposes" written on them like SSN cards do. SSN cards haven't had that printed on them since 1972.

baconner 11y ago

I think the problem is basically that it presents some (albeit weak and messy) solutions for companies and they're not stopped by law from this risky behavior. Since national IDs are politically untenable in the US no pkey alternative is forthcoming - at least none that appeal to lazy companies who want aa low effort solution. We are long overdue for some federal legislation about how ssn can be used and how it cannot along with other basics to protect people from I'd theft. It should be illegal to use it as any kind of identity verification for instance, but its not.

pjc50 11y ago

The UK doesn't have identity cards either, but the corresponding system (national insurance number) is rarely asked for outside of tax-related reasons.

ajdlinux 11y ago

Australia doesn't have a national identity card, and we don't have anything that's used like the SSN. Indeed, the Tax File Number (which identifies one's tax record, similarly to how the IRS uses the SSN) is legally protected such that it's a criminal offence for anyone other than the Tax Office, an employer, a financial institution or an accountant to even ask you to provide it. Centrelink Customer Reference Numbers (which are used for our equivalent of the Social Security program) aren't legally protected (as far as I know), but since only half the population even has one, the only reason a private sector organisation will ask you for it is to check that you're receiving social security benefits. You do see driver's licence and passport numbers being used, but it's far from the de facto standard that the SSN is, and thus far less of a data security nightmare.