5 ms·

> Another concept that I don't understand is that USA's social security number has to be kept secret or otherwise your identity can be stolen. How that is even

> Another concept that I don't understand is that USA's social security number has to be kept secret or otherwise your identity can be stolen. How that is even possible? Doesn't your employer needs it? I think adopting this framing is what makes it really bad. Your identity cannot be stolen. The whole concept of "identity theft" is bullshit intented to shift blame. It only so happens that some entities are incompetent at verifying people's identity. That shouldn't even be your problem, as you have no influence whatsoever on how others check the identity of people, so you should not in any way be responsible for dealing with the consequences if someone thinks that you owe them something just because they believed someone else's claim that they were you.

superuser2 10y ago
> some entities are incompetent at verifying people's identity Some entities are incompetent at verifying identity because some people are very loud about making sure a a modern ID verification system doesn't get built, because the ability to commit fraud is a civil right or something. We need .gov smartcards. Or at least a .gov OAuth provider. Instead we are in the dark ages of shared-secret numbers (SSN, credit card, etc) and scans/faxes of easily photoshopped printed cards. There is an argument this should be a private responsibility. For interactions on an existing account, this makes some sense - banks should be shipping hardware tokens, for example. The big issue with identity theft is criminals opening new accounts under other people's identities, and this is a serious problem because the government will enforce that debt against people who didn't actually incur it. IMO it is government's responsibility to demand better proof of authenticity before signing up to enforce it.
- zAy0LfpBZLC8mAC 10y ago
  > We need .gov smartcards. Or at least a .gov OAuth provider. That's not really a good solution either, though, because that requires trust in an essentially unverifiable system and the entity producing it. > banks should be shipping hardware tokens, for example. No, they absolutely should not. That's like saying banks should send out staff to take care of signing stuff for their customers, and then insisting that the government should enforce whatever their staff signed against the customer. That's a completely broken security model.
  - superuser2 10y ago
    What do you propose?
    - zAy0LfpBZLC8mAC 10y ago
      I'm not sure I really propose anything, it's a hard problem. Maybe a more decentralized web-of-trust like identity system would be a good long-term goal? As for authenticating orders to your bank: You should be able to use any compatible product/software you like to sign orders to your bank with your private key. The bank should not have the ability to fake orders to themselves (see also the Wells-Fargo fiasco).
      - agentdrtran 10y ago
        > You should be able to use any compatible product/software you like to sign orders to your bank with your private key. If a .gov smartcards are a pipe dream, this is a pipedream^10. Private companies will throw a fit if they can't lock people in.
      - superuser2 10y ago
        >web-of-trust like identity system The most important thing about a government-level identity system is extreme difficulty of obtaining any identity other than the one you were born with. It seems inevitable in a web of trust that fraud rings would emerge to manufacture identities for those looking to escape debts, criminal convictions, etc by some combination of tricking and bribing people to sign authentications. >You should be able to use any compatible product/software you like to sign orders to your bank with your private key I'm not sure you should be able to use, say, a poorly written IE extension on your unpatched Windows XP machine. Something federated would be great, where any manufacturer can technically make something compatible, but it has to meet a FIPS standard or something. Keys could be generated onboard, and then you upload your public key or something. We're getting way ahead of ourselves - banks are extremely hesitant to use anything better than secret numbers. I'd rather a shitty 2FA implementation than that.
        10y ago

superuser2 10y ago

> some entities are incompetent at verifying people's identity Some entities are incompetent at verifying identity because some people are very loud about making sure a a modern ID verification system doesn't get built, because the ability to commit fraud is a civil right or something. We need .gov smartcards. Or at least a .gov OAuth provider. Instead we are in the dark ages of shared-secret numbers (SSN, credit card, etc) and scans/faxes of easily photoshopped printed cards. There is an argument this should be a private responsibility. For interactions on an existing account, this makes some sense - banks should be shipping hardware tokens, for example. The big issue with identity theft is criminals opening new accounts under other people's identities, and this is a serious problem because the government will enforce that debt against people who didn't actually incur it. IMO it is government's responsibility to demand better proof of authenticity before signing up to enforce it.

zAy0LfpBZLC8mAC 10y ago
> We need .gov smartcards. Or at least a .gov OAuth provider. That's not really a good solution either, though, because that requires trust in an essentially unverifiable system and the entity producing it. > banks should be shipping hardware tokens, for example. No, they absolutely should not. That's like saying banks should send out staff to take care of signing stuff for their customers, and then insisting that the government should enforce whatever their staff signed against the customer. That's a completely broken security model.
- superuser2 10y ago
  What do you propose?
  - zAy0LfpBZLC8mAC 10y ago
    I'm not sure I really propose anything, it's a hard problem. Maybe a more decentralized web-of-trust like identity system would be a good long-term goal? As for authenticating orders to your bank: You should be able to use any compatible product/software you like to sign orders to your bank with your private key. The bank should not have the ability to fake orders to themselves (see also the Wells-Fargo fiasco).
    - agentdrtran 10y ago
      > You should be able to use any compatible product/software you like to sign orders to your bank with your private key. If a .gov smartcards are a pipe dream, this is a pipedream^10. Private companies will throw a fit if they can't lock people in.
    - superuser2 10y ago
      >web-of-trust like identity system The most important thing about a government-level identity system is extreme difficulty of obtaining any identity other than the one you were born with. It seems inevitable in a web of trust that fraud rings would emerge to manufacture identities for those looking to escape debts, criminal convictions, etc by some combination of tricking and bribing people to sign authentications. >You should be able to use any compatible product/software you like to sign orders to your bank with your private key I'm not sure you should be able to use, say, a poorly written IE extension on your unpatched Windows XP machine. Something federated would be great, where any manufacturer can technically make something compatible, but it has to meet a FIPS standard or something. Keys could be generated onboard, and then you upload your public key or something. We're getting way ahead of ourselves - banks are extremely hesitant to use anything better than secret numbers. I'd rather a shitty 2FA implementation than that.
      - 10y ago