5 ms·

Exactly. In the UK we have a National Insurance number, but it's stated over and over again that: This is not proof of identity. Anywhere it is referenced it

by eterm 9y ago

Exactly. In the UK we have a National Insurance number, but it's stated over and over again that: This is not proof of identity. Anywhere it is referenced it is repeated that it should not be used as proof of identity and not given to anyone as such. SSNs should be treated the same way, but that would require a culture change. Perhaps having 150m of them 'leaked' will bring about that change. Such a change could also be brought about through legislation making it not legal to ask for SSN as proof of ID (i.e. can only ask for SSN when required for the purposes it is intended for), but legislating such things is likely even further from your culture.

noja 9y ago
> This is not proof of identity. What is it then? I've seen it used as a quasi-password by car hire companies to access driving license history.
- maxerickson 9y ago
  They can use it as a key to the database without treating it as proof of identity. (I don't know that they do, it's just that the one doesn't necessarily follow from the other)
- DINKDINK 9y ago
  >What is it then? It is the username you are issued by the government. It is solely used to identify you.
  - thephyber 9y ago
    > It is solely used to identify you. Not exactly. It's used to map your Social Security account to other records they have about you. It's not, by itself, identification.
  - emodendroket 9y ago
    In practice it is not solely used for that.
- nightcracker 9y ago
  Do you see that thing above your post? "noja"? That's your identity. Your SSN on Hacker News. What proves that it is you to Hacker News is what you type into the password field when you log in.
  - noja 9y ago
    My username isn't a semi-secret number that I have to guard.
CamperBob2 9y ago
Exactly. In the UK we have a National Insurance number, but it's stated over and over again that: This is not proof of identity. Here in the US, our Social Security Act said exactly the same thing. Guess what. It got used as a proof of identity.
- ensignavenger 9y ago
  Social Security cards used to say they weren't to be used as identification. They took that off because everyone ignored it and did what they wanted to anyway.
PeterisP 9y ago
The problem is that you need a replacement, something that can actually be used as a solid proof of identity. The countries that don't have comparable identity theft problems have done so mostly by using an ubiquitous government issued ID that's hard to forge and hard to obtain by someone claiming to be you. In USA there seems to be a strong opposition and a legal barrier for the government to make such an ID. Not much else can be done - a simple test of a decent identity system is to ask if my spouse, mother or brother would be able to impersonate me - it's clear that nothing that relies on "something you know" can ever be sufficient, it must be "something you are", possibly together with "something you have", i.e., biometrics or a trusted photo ID.
- wtmt 9y ago
  Can you expand on the systems that are "hard to obtain by someone claiming to be you" and biometrics? In my readings, I've found that biometrics is not unique across a large population, it changes over one's life span (which means you wouldn't know when it has changed enough to update the system that stores it), changes with one's profession (like physical labor) and health, and that the error rates across a huge population even for iris scans are quite high. For reference, India has a unique ID called Aadhaar that collects ten fingerprints and two iris scans to deduplicate across 1.3 billion people. It uses flawed technology (relying on a fingerprint for authentication or in very rare cases, an iris scan), insecure devices, and generally has a high failure rate due to poor infrastructure. Combined with poor technology, the privacy and security policies and measures are inadequate too. There have been plenty of personal information leaked in the last few years because of the government's obstinate stand that this ID be linked to everything - phone numbers, tax ID, bank accounts, and many more. I don't think there is any solution, including biometrics, that will work to uniquely and unambiguously identify individuals across large populations. I also see more dangers for the populace with such schemes because submitted biometrics, once compromised, cannot be revoked or reissued (this is how the Aadhaar system works - it stores the biometrics as-is).
  - PeterisP 9y ago
    Biometrics alone aren't sufficient, but they're a reliable way to prevent identity theft if you have a secure record linking the identity to the biometrics - there will be people with similar faces and may be fingerprint matches, but fraudsters aren't going to easily find a thief that happens to look similar to you, match your fingerprints, and forge a document just to get a small loan or some electronics on your credit. The point is that biometrics can't be treated as "something you know", and the system should be designed in a way that these biometrics getting compromised isn't a big problem; I mean, my EU ID card has a chip with my fingerprints on it, but getting a copy of my fingerprints won't really risk "my identity", all they're good for is to prevent someone else using my documents if they steal it even if their face looks similar. Getting such a secure record, though, generally requires a decent level of gov't infrastructure throughout all areas, and can't be built up quickly. Size alone isn't an issue - if it works for half a billion people in EU, then it'd work for a billion people elsewhere, but the infrastructure needs to be there. I.e., you need a population where all or nearly all births have been properly tracked and reliably registered for a long time, so you can't build it faster than decades if it wasn't the case; you need a general low corruption environment where mass issuing of fake IDs by corrupt officials won't happen (a limited number of fakes by organized crime might be inevitable, but they won't disrupt the system); you need an effective policing system where everyone, including the most poor, would report stolen wallets and documents to be revoked; you need effective infrastructure where it's trivial for everyone giving credit or goods "on lease" to verify online the validity of some documents. I'm not sure how it's in India, and I assume that some of these might be a problem, but for USA (as the original article) all these things are in place and such an ID would work if it was implemented.

by eterm 9y ago

noja 9y ago

> This is not proof of identity. What is it then? I've seen it used as a quasi-password by car hire companies to access driving license history.

maxerickson 9y ago
They can use it as a key to the database without treating it as proof of identity. (I don't know that they do, it's just that the one doesn't necessarily follow from the other)
DINKDINK 9y ago
>What is it then? It is the username you are issued by the government. It is solely used to identify you.
- thephyber 9y ago
  > It is solely used to identify you. Not exactly. It's used to map your Social Security account to other records they have about you. It's not, by itself, identification.
- emodendroket 9y ago
  In practice it is not solely used for that.
nightcracker 9y ago
Do you see that thing above your post? "noja"? That's your identity. Your SSN on Hacker News. What proves that it is you to Hacker News is what you type into the password field when you log in.
- noja 9y ago
  My username isn't a semi-secret number that I have to guard.

CamperBob2 9y ago

Exactly. In the UK we have a National Insurance number, but it's stated over and over again that: This is not proof of identity. Here in the US, our Social Security Act said exactly the same thing. Guess what. It got used as a proof of identity.

ensignavenger 9y ago
Social Security cards used to say they weren't to be used as identification. They took that off because everyone ignored it and did what they wanted to anyway.

PeterisP 9y ago

The problem is that you need a replacement, something that can actually be used as a solid proof of identity. The countries that don't have comparable identity theft problems have done so mostly by using an ubiquitous government issued ID that's hard to forge and hard to obtain by someone claiming to be you. In USA there seems to be a strong opposition and a legal barrier for the government to make such an ID. Not much else can be done - a simple test of a decent identity system is to ask if my spouse, mother or brother would be able to impersonate me - it's clear that nothing that relies on "something you know" can ever be sufficient, it must be "something you are", possibly together with "something you have", i.e., biometrics or a trusted photo ID.

wtmt 9y ago
Can you expand on the systems that are "hard to obtain by someone claiming to be you" and biometrics? In my readings, I've found that biometrics is not unique across a large population, it changes over one's life span (which means you wouldn't know when it has changed enough to update the system that stores it), changes with one's profession (like physical labor) and health, and that the error rates across a huge population even for iris scans are quite high. For reference, India has a unique ID called Aadhaar that collects ten fingerprints and two iris scans to deduplicate across 1.3 billion people. It uses flawed technology (relying on a fingerprint for authentication or in very rare cases, an iris scan), insecure devices, and generally has a high failure rate due to poor infrastructure. Combined with poor technology, the privacy and security policies and measures are inadequate too. There have been plenty of personal information leaked in the last few years because of the government's obstinate stand that this ID be linked to everything - phone numbers, tax ID, bank accounts, and many more. I don't think there is any solution, including biometrics, that will work to uniquely and unambiguously identify individuals across large populations. I also see more dangers for the populace with such schemes because submitted biometrics, once compromised, cannot be revoked or reissued (this is how the Aadhaar system works - it stores the biometrics as-is).
- PeterisP 9y ago
  Biometrics alone aren't sufficient, but they're a reliable way to prevent identity theft if you have a secure record linking the identity to the biometrics - there will be people with similar faces and may be fingerprint matches, but fraudsters aren't going to easily find a thief that happens to look similar to you, match your fingerprints, and forge a document just to get a small loan or some electronics on your credit. The point is that biometrics can't be treated as "something you know", and the system should be designed in a way that these biometrics getting compromised isn't a big problem; I mean, my EU ID card has a chip with my fingerprints on it, but getting a copy of my fingerprints won't really risk "my identity", all they're good for is to prevent someone else using my documents if they steal it even if their face looks similar. Getting such a secure record, though, generally requires a decent level of gov't infrastructure throughout all areas, and can't be built up quickly. Size alone isn't an issue - if it works for half a billion people in EU, then it'd work for a billion people elsewhere, but the infrastructure needs to be there. I.e., you need a population where all or nearly all births have been properly tracked and reliably registered for a long time, so you can't build it faster than decades if it wasn't the case; you need a general low corruption environment where mass issuing of fake IDs by corrupt officials won't happen (a limited number of fakes by organized crime might be inevitable, but they won't disrupt the system); you need an effective policing system where everyone, including the most poor, would report stolen wallets and documents to be revoked; you need effective infrastructure where it's trivial for everyone giving credit or goods "on lease" to verify online the validity of some documents. I'm not sure how it's in India, and I assume that some of these might be a problem, but for USA (as the original article) all these things are in place and such an ID would work if it was implemented.