8 ms·
Is it time for a Federal Department of Verifying Whether People Are Who They Say They Are? Veryifying identity with SSN is broken. The right way is probably m
by ineptech 9y ago
Is it time for a Federal Department of Verifying Whether People Are Who They Say They Are?
Veryifying identity with SSN is broken. The right way is probably more or less how big webapps do it - MFA + a password that the user can reset by providing a bunch of info. The government has the necessary private info to do this in most cases (e.g. DL# plus your income from last year's taxes), and can fall back to "Show up at a police station/DMV/other office and talk to a human" in disputed cases.
I'm sure there are lots of private corporations that would love to be the One True Arbiter of who's who, but none of us would trust them, or want to pay the price. An open source solution (something like Keybase?) seems possible, but not without government backing.
- 3JPLW 9y agoUSPS is a good contender for identity validation, too.
- mmagin 9y agoUSPS is no longer really part of the federal government.
- chrismealy 9y agoYes it is, 100%.
- chrismealy 9y agoI love that I got downvotes for this. People are mad about the post office.
- burnte 9y agoThey should downvote it, it's entirely inaccurate. https://en.wikipedia.org/wiki/United_States_Postal_Service#Governance_and_organization https://en.wikipedia.org/wiki/United_States_Postal_Service#G...
- chrismealy 9y agoThe USPS is often mistaken for a government-owned corporation (e.g., Amtrak) because it operates much like a business. It is, however, an "establishment of the executive branch of the Government of the United States", (39 U.S.C. § 201) as it is controlled by Presidential appointees and the Postmaster General. As a government agency, it has many special privileges, including sovereign immunity, eminent domain powers, powers to negotiate postal treaties with foreign nations, and an exclusive legal right to deliver first-class and third-class mail. Indeed, in 2004, the U.S. Supreme Court ruled in a unanimous decision that the USPS was not a government-owned corporation, and therefore could not be sued under the Sherman Antitrust Act.[90]
- burnte 9y agoMy mistake, I misread you as stating it's 100% not government anymore. My bad!
- mmagin 9y agoThank you for correcting me.
- zbentley 9y agoWell . . . 85.7% (6/7). On Sundays, it's Amazon's: https://www.bloomberg.com/news/articles/2015-07-30/it-s-amazon-s-world-the-usps-just-delivers-in-it https://www.bloomberg.com/news/articles/2015-07-30/it-s-amaz...
- burnte 9y agoNo, it absolutely is not, it's a government entity but an independent one like dozens of other agencies.
- dragonwriter 9y ago“independent” agencies are actually part of the executive branch.
- burnte 9y agoYes, which is part of the government, as I mentioned. The important point was that it was gov't and not private as several people were claiming.
- ci5er 9y agoHow so? It is one of the very few constitutionally enumerated functions of the federal government, and I don't remember it being privatized?
- toomuchtodo 9y agoThis is actually brilliant considering USPS can process passports and does banking light services (money orders).
- andkenneth 9y agoThis is actually how it's done in New Zealand. We have something called realme https://www.realme.govt.nz/ https://www.realme.govt.nz/, which is made by New Zealand Post (our government post service, with the benefit of offices all over the country to do the initial ID verification for account setup) and the Department of Internal Affairs (they do things like births, deaths, marriages, passports, and citizenship, so they're used to dealing with identity) It's an awesome system that the US would be lucky to have. I say this as a dual citizen of both countries.
- girvo 9y agoI'm a kiwi citizen too, and for some reason I thought you had to renounce your NZ citizenship to receive a US one; kind of neat to hear the opposite!
- cesarb 9y agoThe parent poster might have dual citizenship by birth, which would be a different case than starting with only NZ citizenship and acquiring US citizenship later (or vice-versa).
- jordanthoms 9y agoDual Citizenship in the US isn't explicitly allowed, but it's not disallowed either and in practice isn't an issue. [1]. 1- http://immigration.findlaw.com/citizenship/dual-citizenship.html http://immigration.findlaw.com/citizenship/dual-citizenship....
- woogiewonka 9y agoI would not trust USPS with anything. I came by to pick up my mail and they gave me someone else's mail - a stack of 40 some letters / documents - all sorts of sensitive stuff that I could in theory open up and steal that person's identity. Please, think before you say USPS... this agency is broken as hell. The last thing we want to do is trust our identities to them.
- adrr 9y agoWon't work. Once companies start gathering private data stored in this DB, it can be compromised and government isn't that great at securing data either. MFA would required everyone having a smart phone or RSA key fobs. SMS/Phone based authentication isn't secure. Only real way to get true identity system is biometrics(Fingerprints,DNA, or Iris) taken at birth. But that will never happen for privacy reasons.
- RangerScience 9y agoThat's also problematic. If I can capture your data, then I can supply that data at a later point. Even if there are "secure" endpoints that collect that data for verification; I'd just need to compromise one of those. Identity is hard.
- stephenboyd 9y agoBiometric national identification is used in many countries, with India's Aadhaar system being the best example. Those systems are mostly used in developing countries that are leapfrogging their financial technology past the legacy systems that the 1st-world powers developed in the 20th century. 'Privacy reasons' is an American cultural anomaly, especially considering the lack of privacy we suffer from the system used by companies like Equifax.
- chimeracoder 9y ago> 'Privacy reasons' is an American cultural anomaly You can't say that immediately after citing Aadhaar as the "best example" of biometric national identification. There has been massive pushback against Aadhaar for privacy reasons specifically, which just resulted in the Supreme Court declaring privacy to be a fundamental right - something which, incidentally, goes far beyond the approach to privacy taken in the US and Europe.
- deleted 9y ago[deleted]
- closeparen 9y agoThe whole point would be to move off of shared secrets, so data breached from one company's DB wouldn't be usable to impersonate the victims elsewhere. The idea is to abandon the idea that any data (which ever leaves the consumers's hands) is private or needs to be protected to prevent ID theft. We have the technology, i.e. certificates, signatures, smart cards, identity federation like SAML.
- alkonaut 9y agoSSN is an identifier (username), not a verifier (password). Don't deal with anyone using a small number you can't change as an identity verifier. We got govt + all banks on board with a national digital id. Basically all systems that were considered safe enough such as the major banks online systems (with advanced 2fa) are allowed to issue digital IDs that can be used as logins to all authorities and any other place that needs verified id. This system probably paid for itself in a hurry.
- Ankaios 9y agoIs it time for a Federal Department of Verifying Whether People Are Who They Say They Are? After the colossal theft of employee information from the Office of Personnel Management, I have no faith that the feds would be able to keep the information secure.