2 ms·

All they need is an ssn you can change if it gets stolen. To change it all that's needed is to go into a government office and do a biometric scan in person.

All they need is an ssn you can change if it gets stolen. To change it all that's needed is to go into a government office and do a biometric scan in person. That would be so ridiculously easy. Of course the government will never let a good crisis go to waste. Instead, we will all get chips under our skin that can't be removed that will be passively scanned by the authorities everywhere we go.

pas 9y ago
SSN is a primary key, not a shared secret. The entire problem is that people started using SSN as a shared secret, but it was classic password reuse. Use the same secret every fucking where. No. If you want to establish trust, use a random secret for each new trust relationship. If you want to establish identity ask the identity providers what kind of anti-forgery guarantees they provide. Oh, nothing, you say!? Then don't use that provider. Banks are trying to use easy to forge things to make sure they won't lose money. Sounds like stupidity. So they limit their stupidity (hence you can't just register for a credit card online, otherwise bored Russian teenagers would have already bankrupted them).
- narrator 9y ago
  What if, when you replaced your SSN, banks could use a system that would return "invalid SSN" on any new credit application. The existing accounts would be suspended unless you called them and updated your SSN. It would be about as much as a hassle as updating all of one's autopays when a credit card number gets stolen.
  - pas 9y ago
    I don't want to call up all of my business address book because one of them fucked up and leaked something. They shouldn't even ask for it. Currently fraud is held back by law enforcement. Which is triggered by fraud detection. Which is triggered when the wrong person gets a call from a collections agency. And this chain of events is too long, but since there's no global (national) system to check if someone is a professional scam artist or a regular bloke, that's what banks are left with.
PeachPlum 9y ago
One irony is that for my US visa I had to have an interview, supply a photograph, have my fingerprints taken and submit to an eyeball scan. Making the US visa inside my UK passport more reliable an identifier than the passport itself.

pas 9y ago

SSN is a primary key, not a shared secret. The entire problem is that people started using SSN as a shared secret, but it was classic password reuse. Use the same secret every fucking where. No. If you want to establish trust, use a random secret for each new trust relationship. If you want to establish identity ask the identity providers what kind of anti-forgery guarantees they provide. Oh, nothing, you say!? Then don't use that provider. Banks are trying to use easy to forge things to make sure they won't lose money. Sounds like stupidity. So they limit their stupidity (hence you can't just register for a credit card online, otherwise bored Russian teenagers would have already bankrupted them).

narrator 9y ago
What if, when you replaced your SSN, banks could use a system that would return "invalid SSN" on any new credit application. The existing accounts would be suspended unless you called them and updated your SSN. It would be about as much as a hassle as updating all of one's autopays when a credit card number gets stolen.
- pas 9y ago
  I don't want to call up all of my business address book because one of them fucked up and leaked something. They shouldn't even ask for it. Currently fraud is held back by law enforcement. Which is triggered by fraud detection. Which is triggered when the wrong person gets a call from a collections agency. And this chain of events is too long, but since there's no global (national) system to check if someone is a professional scam artist or a regular bloke, that's what banks are left with.

PeachPlum 9y ago

One irony is that for my US visa I had to have an interview, supply a photograph, have my fingerprints taken and submit to an eyeball scan. Making the US visa inside my UK passport more reliable an identifier than the passport itself.