14 ms·

Our entire credit bureau system is broken

255 points by LopRabbit 9y ago

deleted 9y ago
[deleted]
colejohnson66 9y ago
The fact that your SSN is still used as a national ID in today’s age of tecgnology is what astounds me the most. Why is it my fault and my credit ruined when my identity gets stolen? All it takes sometimes to steal an identity is to convince a teller or whoever that you’re someone you’re not! If that happens, that’s the business’ fault, not mine. Here’s a scary fact: take your SSN and add 1 to it. That’s a valid SSN! There’s no checksums or any security features at all. If you were assigned a(n) SSN at birth, that new SSN has a high likelihood of even being someone born in the same hospital as you.
- letlambda 9y ago
  They said they were you! https://www.youtube.com/watch?v=CS9ptA3Ya9E https://www.youtube.com/watch?v=CS9ptA3Ya9E
- stephengillie 9y ago
  What LOE (Level of Effort) would it take to replace our current SSN with a public/private key system? More than just a massive bureaucratic shift and public reeducation movement? Could we have a memorizable public key and still have any meaningful level of security?
  - convolvatron 9y ago
    while we're throwing ideas around, how about just keeping a log of loans and payments rather than trusting some agency to come with with a composite 'score' based on...what exactly? that way, I can decide how much I care about your 2 missed car loan payments 5 years ago and your disputed dry cleaning bill myself when offering you terms.
    - kevin_thibedeau 9y ago
      They aggregate "events" reported by various creditors. Miss a utility bill and it goes to the centralized databases. That's why you so often need to provide SSN to activate services with post-paid debts.
    - pavel_lishin 9y ago
      > how about just keeping a log of loans and payments Why does my landlord need to know how much my student payments were ten years ago? Or what sort of car I drove then, and how long it took me to pay it off? Or that I once owed money to deplorable-sex-dungeon.com, or whatever other arbitrary thing they find offensive?
      - convolvatron 9y ago
        As someone who is always on the receiving side of this nonsense (I have no credit, never take on any debt and have always paid my bills), I'm completely with you. if I were* a creditor, I'd find it pretty valuable to know if a prospective lender was a deadbeat. just trying to find a middle ground here. my score is awful because I never borrow any money. i think that should be qualitatively different to a potential creditor than someone who doesn't pay their bills. for some number of years that meant traveling (car rentals, hotels) was a huge effort. getting leases on apartments was easier because of references. a mortgage was possible in the seedy 2000s, but not any longer.
      - PKop 9y ago
        Because it's a good proxy for knowing whether you will make your lease payments
      - Malician 9y ago
        A landlord is taking a tremendous risk by letting you rent. Things renters can and will do include not pay rent, incurring several months (or worse) while being evicted, trashing the house.. if they behave badly or just can't quite keep up with timely payments and you have to rollover to a new renter that is pretty expensive, too. This isn't to say credit scores are perfect, but they are so effective a predictor of conscientiousness, insurance companies rely on them to predict someone's likelihood of a car accident - on average, they work.
  - lathiat 9y ago
    If you want to consider this sort of thing I would suggest looking at something like Apple iMessage for inspiration (and iCloud in general) Apple is trying very had to do proper public-private key crypto, in a way where not even they have access to the keys, but that is also convenient for the user. There's a reason, for example (this is the best example) you have to approve new iCloud Keychain devices from an existing device. Because that device re-encrypts the database with the private key of the new device. Even that can cause problems as once someone forgets their password they may not be able to recover that keychain and by proxy other services. There are some trade-offs including an iCloud recovery key that is protected by HSMs that Apple Have with the complete inability to update their firmware - but that has other trade-offs such as they can't fix any bugs on those devices, etc. I won't fully detail further I would suggest doing your own reading. You may also wish to look at FIDO, in a sort of related unrelated way.
  - EvanAnderson 9y ago
    A friend of mine suggested that the US Postal Service is in a great place to "pivot" into offering digital "trust" services by leveraging their ability to offer a somewhat credible authentication of an individual based on ones ability to receive physical mail.
    - newman8r 9y ago
      interesting idea - and if you don't have a permanent residence you could just stop by a post office. Seems like they have the right infrastructure and are presently in need of a new business model.
    - kylecordes 9y ago
      Perhaps; but the Postal Service currently operates at a near zero level of security for residential mail. Both incoming and outgoing mails said outside in an unlocked box (for many of us) that can be easily accessed by any passerby. If (even) more of the contents of those boxes became valuable for easy impersonation and theft, the motivation for people to rummage would increase, and we would all likely pay a cost both in convenience and dollars for ordinary mail use.
      - cm2187 9y ago
        True. But that will still protect you from a kid in Russia.
      - mschuster91 9y ago
        > Both incoming and outgoing mails said outside in an unlocked box (for many of us) that can be easily accessed by any passerby. Yeah, but get caught messing with mail and you can get royally screwed. I don't know of any other country where the Postal Service has its own cops with arrest powers, seems to be a pretty powerful deterrent.
        stevekemp 9y ago
        There have been stories in the UK new recently, alleging postal delivery-workers were stealing and selling credit-cards from their deliveries. For example: http://www.birminghammail.co.uk/news/midlands-news/revealed-crooked-birmingham-postmen-being-13561626 http://www.birminghammail.co.uk/news/midlands-news/revealed-...
  - u801e 9y ago
    The signed public key could be included on the social security card and passport. The corresponding private key would need to be secured by a memorable passphrase and backups stored in a secure location under your control.
    - JorgeGT 9y ago
      This is what we do in Spain, but with the national ID card. Only detail is that there is no backup, if you forget the passphrase you go to the police station and use your fingerprint in a machine that will reset your pass.
  - mjevans 9y ago
    I'd like to extend the 'DMV' / existing government licencing system with a standard digital signature (PKI); which would be applied to the OpenPGP / X.509 / etc public key you provide asserting "I own this" in a standard key-party manor (send the signature encrypted so that only the private key can decode it). It would also be useful if you could provide multiple keys and associate them with one or more databases: 'full identity' (public listing with name) or key ages (probably 18, 21, and whatever social security/etc ages are). The latter thing would allow for sites that require 'adult' access without forcing them to request credit cards (not always of age) or personal ID. It might not even be part of the standard flow, but merely as part of establishing an adult is involved if there's a dispute. PS: 'adult' also implies 'able to sign contract' (such as accept Terms of Service). Financial sites would obviously require the full legal name key.
    - viraptor 9y ago
      To actually provide a system for everyone, you'd need more than DMV, or another specialised department. Not everyone needs a driving license and not everyone can get one. This is likely to apply to other agencies in a similar way.
      - tonyztan 9y ago
        State DMVs usually offer ID cards for those who don't or can't drive.
        viraptor 9y ago
        That's pretty cool. Didn't know that.
  - bdonlan 9y ago
    An elliptic curve key is probably memorizable (a 256-bit number essentially) but is not quantum-resistant. For quantum-resistant schemes you might be able to memorize a 256-bit seed for a key generation algorithm. You can look at bitcoin "brain wallets" as precedent - they basically translate these random seeds into a memorizable phrase. That being said, people are unlikely to bother memorizing a 256-bit key, and even if they do they'll just type it into a shady form in a phishing email anyway. Better to just put it on a smartcard chip - it's proven technology that's been rolled out in other nations already.
  - AnthonyMouse 9y ago
    > What LOE (Level of Effort) would it take to replace our current SSN with a public/private key system? More than just a massive bureaucratic shift and public reeducation movement? You are thinking about this from the wrong direction. The problem isn't that the government hasn't provided a PKI, the problem is that social security numbers are being used for identification. This was a serious fear when social security was originally created. For many years social security cards had the words "not for identification" printed on them. They contain no biometric data, not even a picture. Their purpose is not identification. So the solution is obvious. Actually prohibit social security numbers from being used for identification. Don't allow creditors to even ask for them. Then people will figure something else out on their own. Instead of a credit reporting agency existing at all, new credit applications could ask for your account numbers at existing creditors and then the new creditor can get your credit history directly from them. It would be straight forward to automate this -- and even require you to prove that you're the account holder by presenting your card from the other bank (or signing into its website if online). There is no need for a national identification system. Having a bad one was the original problem. Replacing it with some differently bad one is no better.
    - emodendroket 9y ago
      > This was a serious fear when social security was originally created. For many years social security cards had the words "not for identification" printed on them. They contain no biometric data, not even a picture. Their purpose is not identification. That's still printed on them. > Then people will figure something else out on their own. Instead of a credit reporting agency existing at all, new credit applications could ask for your account numbers at existing creditors and then the new creditor can get your credit history directly from them. It would be straight forward to automate this -- and even require you to prove that you're the account holder by presenting your card from the other bank (or signing into its website if online). > There is no need for a national identification system. This seems like wishful thinking to me.
      - AnthonyMouse 9y ago
        > This seems like wishful thinking to me. The correct answer is correct regardless of who wants it to be.
  - tmaly 9y ago
    How would this system work with people with say dementia who could not recall their key?
  - PeterisP 9y ago
    Having a public/private key system doesn't solve the key problems of identity, namely, a link between your public key and you, and ensuring that it's not easy to create new alternate identities. Having a digital signature by a private key is a decent way to ensure that you are linked to the public key, if the recipient knows the identity of the public key, and the private key is hard to copy (i.e. not memorizable, not something you type in to a bunch of potentially compromised computers). One way to do this is like Estonia's e-ID, which includes such a private key in the gov't issued photo ID; but having such an ID in the first place seems anathema in US.
  - andruby 9y ago
    We have something like this in Belgium with our eID cards. AFAIK the chip has a public/private key. I use a PIN code to unlock the private key and I can create signatures with it to prove my identity. Websites can actually use this for proper citizen authentication (and non-repudiation). The integration has UX bugs, but at the end of the day, I am very happy that we have something much more secure than a US SSN.
mindslight 9y ago
Erm, what do you mean "our"? This system cannot even be justified via the usual democratic collectivism - the commercial surveillance complex is a purely independent adversary that has formed on its own! It certainly has had help and encouragement from government mandates (SSN, drivers license/plate, monetary surveillance, etc), but even if those were eliminated it would continue just fine using its own primary keys. As such, it can't really be top-down reformed much [0] except for correctly assigning liability for the fallout from its negligence. For instance, having to repudiate an incorrect debt from a libelous bank or surveillance company should entitle one to easily claim reimbursement for the expenses occurred (including time) to do so. In the coming weeks we'll undoubtedly see calls to "reform" this system through the technical strengthening of the identifiers it assigns onto us. This is a recipe for rekindling belief in the authority of private surveillance as well as an invitation for it to invade even more aspects of our lives. This is not the direction we want to go! [0] Of course we can all work on solving the problem from the bottom up by cloaking ourselves. Spend cash when possible, rotate your grocery psuedonyms often, etc.
- duncan_bayne 9y ago
  > This is not the direction we want to go! Erm, what do you mean "we"? ;) While I agree with you on all other points you mentioned, it's pretty clear to me that the voting public are _perfectly_ okay with the authority of both private and public surveillance, so long as it satisfies one or more of the following criteria: * Reduces, or is thought to reduce, the cost of credit to the individual concerned. ("I'm okay with it, if it means I can trivially get access to credit because my credit score is good.") * Prevents, or is thought to prevent, the risk of terrorist action or harm to children. * Is limited to "others" (poor people, immigrants, other races, etc.).
yosito 9y ago
When the system begins causing big losses for creditors, they'll start to take notice and develop a better system. Until then, the best thing you can do is freeze your credit and only unfreeze it when you need it.
- anigbrowl 9y ago
  Thanks, 'free market.'
  - Faaak 9y ago
    Free market does not mean "no regulations".
    - anigbrowl 9y ago
      That's not what I'm suggesting. Rather, the feedback loop you identified sadly lends itself towards marketing or financial stratagem as or more easily than making substantive changes.
chaostheory 9y ago
> This is a terrible way to manage identity. From afar, a Social Security number looks kind of like a password. But you can change a password, and you shouldn’t use the same one with every service. Going on a tangent, Apple has made the same mistake with TouchID.
- grzm 9y ago
  > Apple has made the same mistake with TouchID. I think that's one of the motivations (if not the primary one) to add the feature to disable TouchID from the lock screen via Emergency SOS: https://www.macrumors.com/2017/08/17/ios-11-emergency-sos-disables-touch-id/ https://www.macrumors.com/2017/08/17/ios-11-emergency-sos-di...
- theshrike79 9y ago
  TouchID is better than no passcode, that's the purpose for it. Joe/Jill Public won't use a passcode on their phone, because it's too much hassle. But they WILL enable TouchID, thus rising the bar for random phone thieves/hackers.
  - swiley 9y ago
    People didn't start picking my phone up and trying to get into it until I set a pin. Back when I had an android there wasn't even a lock screen and no one ever touched it.
- epmaybe 9y ago
  I know very little about cybersecurity and cryptography, but wouldn't it make sense for each device have a different passcode associated with a touch id? For example, my iPhone has a passcode XXXXXX, with touch ID associated with it. At the same time, my Macbook has a passcode 0123456789 with a touch ID associated with it.
c3534l 9y ago
I was intrigued by the idea of using a blockchain to anonymize and secure lending, so I looked it up and a trial of such a thing was run a few months ago. I found this gem: > TransUnion and Equifax said they are always assessing new ways to secure consumer credit data, an area that is tightly regulated by governments around the world. https://www.reuters.com/article/us-canada-blockchain-credit/u-s-credit-agencies-test-canadian-blockchain-identity-network-idUSKBN1802OR https://www.reuters.com/article/us-canada-blockchain-credit/... The irony aside, it seems like the exact sort of thing a blockchain is good for: verifying transactions with a high degree of anonymity among parties that fundamentally do not trust each other. If I say I've had transactions that I say I have, I should be able to send you a code for you to verify it. There's no reason why I shouldn't have to consent for my private financial information to be disclosed to strangers in the first place.
- jacobsimon 9y ago
  Check out Cred - https://crednetwork.org https://crednetwork.org
- harryh 9y ago
  I don't see how using an anonymous blockchain is useful for storing credit data because it makes it trivial to walk away from a bad credit score and start over from zero. Also, FWIW you do have to consent for someone to run a credit check on you.
drawkbox 9y ago
Freezing credit needs to be free and one button until we have this fixed. Freezing and unfreezing needs to happen quickly. We also need to know every time our credit is accessed and updated, not monthly like current reports, realtime. This right should be in the digital Bill of Rights that need to happen as well that you should be able to protect yourself in the case of a breach at no cost to you. Blockchain seems like the direction, but with how slow we move in everything legislatively, we need something now that allows freezing to be free, fast and easy. The three credit bureaus, because they are in a fixed market and not truly in a competitive fair market with a privileged position, they got lazy just like the ratings agencies during housing crash. Lack of focus on their core missions due to no competitive threats.
- Groxx 9y ago
  Freezing I can see being fast and easy. At best you can troll someone by freezing their credit at an inopportune time - which might cause them to lose money, but less likely in general, surely. Unfreezing? The whole point is to delay access, it can't be fast or it defeats the purpose. "They" have everything they need to unfreeze (otherwise why would freezing be necessary), so the only real protection you have is to forcibly delay access until you can prevent it.
  - anarazel 9y ago
    It's not hard to come up with a scheme where it's fast to unfreeze when you have a key generated while freezing.
somberi 9y ago
https://washpost.bloomberg.com/Story?docId=1376-OV5NGV6JIJUQ01-6G4M3JT0SU7I3KID9LHOC0L246 https://washpost.bloomberg.com/Story?docId=1376-OV5NGV6JIJUQ...
perlgeek 9y ago
Some government agency should publish a list of all SSNs, thereby ultimately destroying the illusions that SSNs are secret. If anybody still uses SSNs for authentication afterwards, they are grossly negligent.
- swiley 9y ago
  They would need to publish it with names, I think everyone already knows their SSN isn't secret.
- dfox 9y ago
  This is the case in many european countries. European VAT IDs are usually recorded in some kind of publicly accessible registry and usually build by prefixing ID of tax payer with country code. For example in czech republic: - everyboby has "birth number", which is more or less equivalent of SSN except it in clearly encodes gender and for most people also DOB. - corporations and any entity that is licensed for trade (including sole proprietorships) have "ICO" (which somewhat funilly translates into "personal identification number"), in essence it is equivalent to US's EIN. - any entity which directly deals with tax office has DIC (tax identification number), which for natural persons is "CZ" + birth number and for other entities is "CZ" + ICO, same string is also an EU-wide VAT ID. Once you start a bussiness or even own part of non-tradeable public company (which includes things like homeowners association) all three of these numbers are readily available in various open access government registries, together with first and last name and usually with registered address and thus nobody uses knowledge of one of these numbers as serious authenticator (but from time to time it is used as kind of filter for who given bussiness is willing to deal with).
jonathankoren 9y ago
Not only this, but the entire banking system is fucked up. I have an account number and routing number, then I can do whatever I want to your account. That's bizarre.
gandutraveler 9y ago
I have friends who are twins and they both were issued same SSN number. Apparantly their primary key is first_name(first 6 chars)+last_name(first 6 chars)+DOB
- swiley 9y ago
  I don't think that's quite right, the city you're born in is included as well.
  - PeterisP 9y ago
    Twins most likely have been born in the same city, unless the birth happened e.g. on a high speed train and they decided to file different birth places depending on the closest station.
- clintonb 9y ago
  How old are your friends? Now that there is a central issuer, rather than regional, the probability of generating duplicate numbers is quite low.
fogetti 9y ago
Here we go again. A new great example how the neoliberal thinking and narrative just simply fails on humans. You want to give your data to corporate America and assume that they will be careful about protecting it? Than I am laughing hard at you. SMH The stupidity of free markets and the myth of self regulation. Ridiculous. That's why it's more important than ever that we support and implement new important initiatives like that of Tim Berner Lee's. He wants a platform that gives users control of their data. Very good idea IMO.
- noir_lord 9y ago
  Free market should mean regulated to create a level playing field not no regulations at all. Of course then you have regulatory capture to deal with but nothing is perfect
- ThomPete 9y ago
  I am pretty familiar with the idea and conceptually I am a proponent for it but the question becomes who pays for the hosting of your data, what's the incentives to get me to store it and for others to use only the data that I have? I am also sceptic with regards to corporations having the data but government owning it doesn't make it much better. In Denmark you mostly need to get access to one place in the system and you potentially have access to the data across the different verticals, Danish system is also SSN based. The biggest problem though is what is the alternative to a credit bureau system?
noir_lord 9y ago
We have an SSN equivalent in the UK called NIN (national insurance number). I've never been asked for it as an authenticator though.
- xioxox 9y ago
  Banks do need it when applying for some accounts in the UK, in particular ISAs because of the tax implications. I've also had it requested by a share broker. A list of places that use it is here: https://www.gov.uk/national-insurance/your-national-insurance-number https://www.gov.uk/national-insurance/your-national-insuranc... Note the pages says: "To prevent identity fraud, keep your National Insurance number safe. Don’t share it with anyone who doesn’t need it." !
  - benaadams 9y ago
    You need it so they can report it to HMRC who use it as an identifiter for tax contributions
- LeifCarrotson 9y ago
  > I've never been asked for it as an authenticator though. What are you asked for as an authenticator? Do you have a drivers' license number, or a tax identification number, or a birth certificate number, or a passport number, or some other national identification item? A consistently formatted identifier that's unique to every person in the country just seems like it would be too tempting for businesses not to use.
  - DanBC 9y ago
    We're asked for a complex hodgepodge of government issued ID ("who I am") and utility bills, benefit letters, etc ("where I live"). Here's the Gov advice for online services: https://www.gov.uk/government/publications/identity-proofing-and-verification-of-an-individual https://www.gov.uk/government/publications/identity-proofing... Here's how they examine ID: https://www.gov.uk/government/publications/recognising-fraudulent-identity-documents https://www.gov.uk/government/publications/recognising-fraud...
rado 9y ago
Damn you Russia
beager 9y ago
> I’m sure Facebook, Google, and PayPal would all love to take over from the credit bureaus, and there are real reasons to be wary of that. Some people will tell you we should put it all on a blockchain, decentralizing the system and querying discrete pieces of information as needed. New solutions bring new problems, and there’s no perfect answer to any of it. This is what concerns me most as we move from this to implementing solutions. We now have a glut of technology companies, some large and trusted, and many that will be created specifically to address this, that will permute the risk factors an pitfalls of such a business infinitely. One hundred companies doing credit bureau things means 100 places you'll have to put your sensitive info, 100 places that will have some different vulnerability, and 100 more targets on your attack surface. Granted, one of these solutions may be sound, viable, secure, and advantageous to consumers. But the extant bureaus and any company that comes in to compete is a business, needs to make money, and will resist competition, will resist security over profit, and will never capitulate to a better competing solution until their last dollar is raised and spent.

255 points by LopRabbit 9y ago

deleted 9y ago

[deleted]

The fact that your SSN is still used as a national ID in today’s age of tecgnology is what astounds me the most. Why is it my fault and my credit ruined when my identity gets stolen? All it takes sometimes to steal an identity is to convince a teller or whoever that you’re someone you’re not! If that happens, that’s the business’ fault, not mine. Here’s a scary fact: take your SSN and add 1 to it. That’s a valid SSN! There’s no checksums or any security features at all. If you were assigned a(n) SSN at birth, that new SSN has a high likelihood of even being someone born in the same hospital as you.

letlambda 9y ago
They said they were you! https://www.youtube.com/watch?v=CS9ptA3Ya9E https://www.youtube.com/watch?v=CS9ptA3Ya9E
stephengillie 9y ago
What LOE (Level of Effort) would it take to replace our current SSN with a public/private key system? More than just a massive bureaucratic shift and public reeducation movement? Could we have a memorizable public key and still have any meaningful level of security?
- convolvatron 9y ago
  while we're throwing ideas around, how about just keeping a log of loans and payments rather than trusting some agency to come with with a composite 'score' based on...what exactly? that way, I can decide how much I care about your 2 missed car loan payments 5 years ago and your disputed dry cleaning bill myself when offering you terms.
  - kevin_thibedeau 9y ago
    They aggregate "events" reported by various creditors. Miss a utility bill and it goes to the centralized databases. That's why you so often need to provide SSN to activate services with post-paid debts.
  - pavel_lishin 9y ago
    > how about just keeping a log of loans and payments Why does my landlord need to know how much my student payments were ten years ago? Or what sort of car I drove then, and how long it took me to pay it off? Or that I once owed money to deplorable-sex-dungeon.com, or whatever other arbitrary thing they find offensive?
    - convolvatron 9y ago
      As someone who is always on the receiving side of this nonsense (I have no credit, never take on any debt and have always paid my bills), I'm completely with you. if I were* a creditor, I'd find it pretty valuable to know if a prospective lender was a deadbeat. just trying to find a middle ground here. my score is awful because I never borrow any money. i think that should be qualitatively different to a potential creditor than someone who doesn't pay their bills. for some number of years that meant traveling (car rentals, hotels) was a huge effort. getting leases on apartments was easier because of references. a mortgage was possible in the seedy 2000s, but not any longer.
    - PKop 9y ago
      Because it's a good proxy for knowing whether you will make your lease payments
    - Malician 9y ago
      A landlord is taking a tremendous risk by letting you rent. Things renters can and will do include not pay rent, incurring several months (or worse) while being evicted, trashing the house.. if they behave badly or just can't quite keep up with timely payments and you have to rollover to a new renter that is pretty expensive, too. This isn't to say credit scores are perfect, but they are so effective a predictor of conscientiousness, insurance companies rely on them to predict someone's likelihood of a car accident - on average, they work.
- lathiat 9y ago
  If you want to consider this sort of thing I would suggest looking at something like Apple iMessage for inspiration (and iCloud in general) Apple is trying very had to do proper public-private key crypto, in a way where not even they have access to the keys, but that is also convenient for the user. There's a reason, for example (this is the best example) you have to approve new iCloud Keychain devices from an existing device. Because that device re-encrypts the database with the private key of the new device. Even that can cause problems as once someone forgets their password they may not be able to recover that keychain and by proxy other services. There are some trade-offs including an iCloud recovery key that is protected by HSMs that Apple Have with the complete inability to update their firmware - but that has other trade-offs such as they can't fix any bugs on those devices, etc. I won't fully detail further I would suggest doing your own reading. You may also wish to look at FIDO, in a sort of related unrelated way.
- EvanAnderson 9y ago
  A friend of mine suggested that the US Postal Service is in a great place to "pivot" into offering digital "trust" services by leveraging their ability to offer a somewhat credible authentication of an individual based on ones ability to receive physical mail.
  - newman8r 9y ago
    interesting idea - and if you don't have a permanent residence you could just stop by a post office. Seems like they have the right infrastructure and are presently in need of a new business model.
  - kylecordes 9y ago
    Perhaps; but the Postal Service currently operates at a near zero level of security for residential mail. Both incoming and outgoing mails said outside in an unlocked box (for many of us) that can be easily accessed by any passerby. If (even) more of the contents of those boxes became valuable for easy impersonation and theft, the motivation for people to rummage would increase, and we would all likely pay a cost both in convenience and dollars for ordinary mail use.
    - cm2187 9y ago
      True. But that will still protect you from a kid in Russia.
    - mschuster91 9y ago
      > Both incoming and outgoing mails said outside in an unlocked box (for many of us) that can be easily accessed by any passerby. Yeah, but get caught messing with mail and you can get royally screwed. I don't know of any other country where the Postal Service has its own cops with arrest powers, seems to be a pretty powerful deterrent.
      - stevekemp 9y ago
        There have been stories in the UK new recently, alleging postal delivery-workers were stealing and selling credit-cards from their deliveries. For example: http://www.birminghammail.co.uk/news/midlands-news/revealed-crooked-birmingham-postmen-being-13561626 http://www.birminghammail.co.uk/news/midlands-news/revealed-...
- u801e 9y ago
  The signed public key could be included on the social security card and passport. The corresponding private key would need to be secured by a memorable passphrase and backups stored in a secure location under your control.
  - JorgeGT 9y ago
    This is what we do in Spain, but with the national ID card. Only detail is that there is no backup, if you forget the passphrase you go to the police station and use your fingerprint in a machine that will reset your pass.
- mjevans 9y ago
  I'd like to extend the 'DMV' / existing government licencing system with a standard digital signature (PKI); which would be applied to the OpenPGP / X.509 / etc public key you provide asserting "I own this" in a standard key-party manor (send the signature encrypted so that only the private key can decode it). It would also be useful if you could provide multiple keys and associate them with one or more databases: 'full identity' (public listing with name) or key ages (probably 18, 21, and whatever social security/etc ages are). The latter thing would allow for sites that require 'adult' access without forcing them to request credit cards (not always of age) or personal ID. It might not even be part of the standard flow, but merely as part of establishing an adult is involved if there's a dispute. PS: 'adult' also implies 'able to sign contract' (such as accept Terms of Service). Financial sites would obviously require the full legal name key.
  - viraptor 9y ago
    To actually provide a system for everyone, you'd need more than DMV, or another specialised department. Not everyone needs a driving license and not everyone can get one. This is likely to apply to other agencies in a similar way.
    - tonyztan 9y ago
      State DMVs usually offer ID cards for those who don't or can't drive.
      - viraptor 9y ago
        That's pretty cool. Didn't know that.
- bdonlan 9y ago
  An elliptic curve key is probably memorizable (a 256-bit number essentially) but is not quantum-resistant. For quantum-resistant schemes you might be able to memorize a 256-bit seed for a key generation algorithm. You can look at bitcoin "brain wallets" as precedent - they basically translate these random seeds into a memorizable phrase. That being said, people are unlikely to bother memorizing a 256-bit key, and even if they do they'll just type it into a shady form in a phishing email anyway. Better to just put it on a smartcard chip - it's proven technology that's been rolled out in other nations already.
- AnthonyMouse 9y ago
  > What LOE (Level of Effort) would it take to replace our current SSN with a public/private key system? More than just a massive bureaucratic shift and public reeducation movement? You are thinking about this from the wrong direction. The problem isn't that the government hasn't provided a PKI, the problem is that social security numbers are being used for identification. This was a serious fear when social security was originally created. For many years social security cards had the words "not for identification" printed on them. They contain no biometric data, not even a picture. Their purpose is not identification. So the solution is obvious. Actually prohibit social security numbers from being used for identification. Don't allow creditors to even ask for them. Then people will figure something else out on their own. Instead of a credit reporting agency existing at all, new credit applications could ask for your account numbers at existing creditors and then the new creditor can get your credit history directly from them. It would be straight forward to automate this -- and even require you to prove that you're the account holder by presenting your card from the other bank (or signing into its website if online). There is no need for a national identification system. Having a bad one was the original problem. Replacing it with some differently bad one is no better.
  - emodendroket 9y ago
    > This was a serious fear when social security was originally created. For many years social security cards had the words "not for identification" printed on them. They contain no biometric data, not even a picture. Their purpose is not identification. That's still printed on them. > Then people will figure something else out on their own. Instead of a credit reporting agency existing at all, new credit applications could ask for your account numbers at existing creditors and then the new creditor can get your credit history directly from them. It would be straight forward to automate this -- and even require you to prove that you're the account holder by presenting your card from the other bank (or signing into its website if online). > There is no need for a national identification system. This seems like wishful thinking to me.
    - AnthonyMouse 9y ago
      > This seems like wishful thinking to me. The correct answer is correct regardless of who wants it to be.
- tmaly 9y ago
  How would this system work with people with say dementia who could not recall their key?
- PeterisP 9y ago
  Having a public/private key system doesn't solve the key problems of identity, namely, a link between your public key and you, and ensuring that it's not easy to create new alternate identities. Having a digital signature by a private key is a decent way to ensure that you are linked to the public key, if the recipient knows the identity of the public key, and the private key is hard to copy (i.e. not memorizable, not something you type in to a bunch of potentially compromised computers). One way to do this is like Estonia's e-ID, which includes such a private key in the gov't issued photo ID; but having such an ID in the first place seems anathema in US.
- andruby 9y ago
  We have something like this in Belgium with our eID cards. AFAIK the chip has a public/private key. I use a PIN code to unlock the private key and I can create signatures with it to prove my identity. Websites can actually use this for proper citizen authentication (and non-repudiation). The integration has UX bugs, but at the end of the day, I am very happy that we have something much more secure than a US SSN.

mindslight 9y ago

Erm, what do you mean "our"? This system cannot even be justified via the usual democratic collectivism - the commercial surveillance complex is a purely independent adversary that has formed on its own! It certainly has had help and encouragement from government mandates (SSN, drivers license/plate, monetary surveillance, etc), but even if those were eliminated it would continue just fine using its own primary keys. As such, it can't really be top-down reformed much [0] except for correctly assigning liability for the fallout from its negligence. For instance, having to repudiate an incorrect debt from a libelous bank or surveillance company should entitle one to easily claim reimbursement for the expenses occurred (including time) to do so. In the coming weeks we'll undoubtedly see calls to "reform" this system through the technical strengthening of the identifiers it assigns onto us. This is a recipe for rekindling belief in the authority of private surveillance as well as an invitation for it to invade even more aspects of our lives. This is not the direction we want to go! [0] Of course we can all work on solving the problem from the bottom up by cloaking ourselves. Spend cash when possible, rotate your grocery psuedonyms often, etc.

duncan_bayne 9y ago
> This is not the direction we want to go! Erm, what do you mean "we"? ;) While I agree with you on all other points you mentioned, it's pretty clear to me that the voting public are _perfectly_ okay with the authority of both private and public surveillance, so long as it satisfies one or more of the following criteria: * Reduces, or is thought to reduce, the cost of credit to the individual concerned. ("I'm okay with it, if it means I can trivially get access to credit because my credit score is good.") * Prevents, or is thought to prevent, the risk of terrorist action or harm to children. * Is limited to "others" (poor people, immigrants, other races, etc.).

yosito 9y ago

When the system begins causing big losses for creditors, they'll start to take notice and develop a better system. Until then, the best thing you can do is freeze your credit and only unfreeze it when you need it.

anigbrowl 9y ago
Thanks, 'free market.'
- Faaak 9y ago
  Free market does not mean "no regulations".
  - anigbrowl 9y ago
    That's not what I'm suggesting. Rather, the feedback loop you identified sadly lends itself towards marketing or financial stratagem as or more easily than making substantive changes.

chaostheory 9y ago

> This is a terrible way to manage identity. From afar, a Social Security number looks kind of like a password. But you can change a password, and you shouldn’t use the same one with every service. Going on a tangent, Apple has made the same mistake with TouchID.

grzm 9y ago
> Apple has made the same mistake with TouchID. I think that's one of the motivations (if not the primary one) to add the feature to disable TouchID from the lock screen via Emergency SOS: https://www.macrumors.com/2017/08/17/ios-11-emergency-sos-disables-touch-id/ https://www.macrumors.com/2017/08/17/ios-11-emergency-sos-di...
theshrike79 9y ago
TouchID is better than no passcode, that's the purpose for it. Joe/Jill Public won't use a passcode on their phone, because it's too much hassle. But they WILL enable TouchID, thus rising the bar for random phone thieves/hackers.
- swiley 9y ago
  People didn't start picking my phone up and trying to get into it until I set a pin. Back when I had an android there wasn't even a lock screen and no one ever touched it.
epmaybe 9y ago
I know very little about cybersecurity and cryptography, but wouldn't it make sense for each device have a different passcode associated with a touch id? For example, my iPhone has a passcode XXXXXX, with touch ID associated with it. At the same time, my Macbook has a passcode 0123456789 with a touch ID associated with it.

c3534l 9y ago

I was intrigued by the idea of using a blockchain to anonymize and secure lending, so I looked it up and a trial of such a thing was run a few months ago. I found this gem: > TransUnion and Equifax said they are always assessing new ways to secure consumer credit data, an area that is tightly regulated by governments around the world. https://www.reuters.com/article/us-canada-blockchain-credit/u-s-credit-agencies-test-canadian-blockchain-identity-network-idUSKBN1802OR https://www.reuters.com/article/us-canada-blockchain-credit/... The irony aside, it seems like the exact sort of thing a blockchain is good for: verifying transactions with a high degree of anonymity among parties that fundamentally do not trust each other. If I say I've had transactions that I say I have, I should be able to send you a code for you to verify it. There's no reason why I shouldn't have to consent for my private financial information to be disclosed to strangers in the first place.

jacobsimon 9y ago
Check out Cred - https://crednetwork.org https://crednetwork.org
harryh 9y ago
I don't see how using an anonymous blockchain is useful for storing credit data because it makes it trivial to walk away from a bad credit score and start over from zero. Also, FWIW you do have to consent for someone to run a credit check on you.

drawkbox 9y ago

Freezing credit needs to be free and one button until we have this fixed. Freezing and unfreezing needs to happen quickly. We also need to know every time our credit is accessed and updated, not monthly like current reports, realtime. This right should be in the digital Bill of Rights that need to happen as well that you should be able to protect yourself in the case of a breach at no cost to you. Blockchain seems like the direction, but with how slow we move in everything legislatively, we need something now that allows freezing to be free, fast and easy. The three credit bureaus, because they are in a fixed market and not truly in a competitive fair market with a privileged position, they got lazy just like the ratings agencies during housing crash. Lack of focus on their core missions due to no competitive threats.

Groxx 9y ago
Freezing I can see being fast and easy. At best you can troll someone by freezing their credit at an inopportune time - which might cause them to lose money, but less likely in general, surely. Unfreezing? The whole point is to delay access, it can't be fast or it defeats the purpose. "They" have everything they need to unfreeze (otherwise why would freezing be necessary), so the only real protection you have is to forcibly delay access until you can prevent it.
- anarazel 9y ago
  It's not hard to come up with a scheme where it's fast to unfreeze when you have a key generated while freezing.

somberi 9y ago

https://washpost.bloomberg.com/Story?docId=1376-OV5NGV6JIJUQ01-6G4M3JT0SU7I3KID9LHOC0L246 https://washpost.bloomberg.com/Story?docId=1376-OV5NGV6JIJUQ...

perlgeek 9y ago

Some government agency should publish a list of all SSNs, thereby ultimately destroying the illusions that SSNs are secret. If anybody still uses SSNs for authentication afterwards, they are grossly negligent.

swiley 9y ago
They would need to publish it with names, I think everyone already knows their SSN isn't secret.
dfox 9y ago
This is the case in many european countries. European VAT IDs are usually recorded in some kind of publicly accessible registry and usually build by prefixing ID of tax payer with country code. For example in czech republic: - everyboby has "birth number", which is more or less equivalent of SSN except it in clearly encodes gender and for most people also DOB. - corporations and any entity that is licensed for trade (including sole proprietorships) have "ICO" (which somewhat funilly translates into "personal identification number"), in essence it is equivalent to US's EIN. - any entity which directly deals with tax office has DIC (tax identification number), which for natural persons is "CZ" + birth number and for other entities is "CZ" + ICO, same string is also an EU-wide VAT ID. Once you start a bussiness or even own part of non-tradeable public company (which includes things like homeowners association) all three of these numbers are readily available in various open access government registries, together with first and last name and usually with registered address and thus nobody uses knowledge of one of these numbers as serious authenticator (but from time to time it is used as kind of filter for who given bussiness is willing to deal with).

jonathankoren 9y ago

Not only this, but the entire banking system is fucked up. I have an account number and routing number, then I can do whatever I want to your account. That's bizarre.

gandutraveler 9y ago

I have friends who are twins and they both were issued same SSN number. Apparantly their primary key is first_name(first 6 chars)+last_name(first 6 chars)+DOB

swiley 9y ago
I don't think that's quite right, the city you're born in is included as well.
- PeterisP 9y ago
  Twins most likely have been born in the same city, unless the birth happened e.g. on a high speed train and they decided to file different birth places depending on the closest station.
clintonb 9y ago
How old are your friends? Now that there is a central issuer, rather than regional, the probability of generating duplicate numbers is quite low.

fogetti 9y ago

Here we go again. A new great example how the neoliberal thinking and narrative just simply fails on humans. You want to give your data to corporate America and assume that they will be careful about protecting it? Than I am laughing hard at you. SMH The stupidity of free markets and the myth of self regulation. Ridiculous. That's why it's more important than ever that we support and implement new important initiatives like that of Tim Berner Lee's. He wants a platform that gives users control of their data. Very good idea IMO.

noir_lord 9y ago
Free market should mean regulated to create a level playing field not no regulations at all. Of course then you have regulatory capture to deal with but nothing is perfect
ThomPete 9y ago
I am pretty familiar with the idea and conceptually I am a proponent for it but the question becomes who pays for the hosting of your data, what's the incentives to get me to store it and for others to use only the data that I have? I am also sceptic with regards to corporations having the data but government owning it doesn't make it much better. In Denmark you mostly need to get access to one place in the system and you potentially have access to the data across the different verticals, Danish system is also SSN based. The biggest problem though is what is the alternative to a credit bureau system?

noir_lord 9y ago

We have an SSN equivalent in the UK called NIN (national insurance number). I've never been asked for it as an authenticator though.

xioxox 9y ago
Banks do need it when applying for some accounts in the UK, in particular ISAs because of the tax implications. I've also had it requested by a share broker. A list of places that use it is here: https://www.gov.uk/national-insurance/your-national-insurance-number https://www.gov.uk/national-insurance/your-national-insuranc... Note the pages says: "To prevent identity fraud, keep your National Insurance number safe. Don’t share it with anyone who doesn’t need it." !
- benaadams 9y ago
  You need it so they can report it to HMRC who use it as an identifiter for tax contributions
LeifCarrotson 9y ago
> I've never been asked for it as an authenticator though. What are you asked for as an authenticator? Do you have a drivers' license number, or a tax identification number, or a birth certificate number, or a passport number, or some other national identification item? A consistently formatted identifier that's unique to every person in the country just seems like it would be too tempting for businesses not to use.
- DanBC 9y ago
  We're asked for a complex hodgepodge of government issued ID ("who I am") and utility bills, benefit letters, etc ("where I live"). Here's the Gov advice for online services: https://www.gov.uk/government/publications/identity-proofing-and-verification-of-an-individual https://www.gov.uk/government/publications/identity-proofing... Here's how they examine ID: https://www.gov.uk/government/publications/recognising-fraudulent-identity-documents https://www.gov.uk/government/publications/recognising-fraud...

rado 9y ago

Damn you Russia

beager 9y ago

> I’m sure Facebook, Google, and PayPal would all love to take over from the credit bureaus, and there are real reasons to be wary of that. Some people will tell you we should put it all on a blockchain, decentralizing the system and querying discrete pieces of information as needed. New solutions bring new problems, and there’s no perfect answer to any of it. This is what concerns me most as we move from this to implementing solutions. We now have a glut of technology companies, some large and trusted, and many that will be created specifically to address this, that will permute the risk factors an pitfalls of such a business infinitely. One hundred companies doing credit bureau things means 100 places you'll have to put your sensitive info, 100 places that will have some different vulnerability, and 100 more targets on your attack surface. Granted, one of these solutions may be sound, viable, secure, and advantageous to consumers. But the extant bureaus and any company that comes in to compete is a business, needs to make money, and will resist competition, will resist security over profit, and will never capitulate to a better competing solution until their last dollar is raised and spent.