6 ms·

This article completely fails to address the main issue: conflating identity and authentication. If credit reports required some sort of attestation of secret k

This article completely fails to address the main issue: conflating identity and authentication. If credit reports required some sort of attestation of secret knowledge in order to apply for things the issue would be dramatically lessened. A social security number should be no more damaging to know than someone's email address.

semi-extrinsic 9y ago
What you really need is a standardised login portal for government and private services that deal with personal information. Then you can have multiple service providers for the actual login, e.g. your bank's proper 2FA login, YubiKeys etc. We've had this for years in my country (with ~2% of the population of the US) and it's working great. Typically the SS number is used for identification, and you have password + one-time code on top of that.
- tylersmith 9y ago
  I disagree. Centralizing the data and the access control would only create more issues. If somebody got into your account they'd have the keys to your life. We need to embrace decentralizing data and access control along with healthy security habits like proper secret generation and frequent rotation.
  - will_hughes 9y ago
    > along with healthy security habits like proper secret generation and frequent rotation. While having the populace in general be security aware would be a great thing, it's barely possible to get them to do even basic shit like not putting credit card numbers and other secret information into an email and sending it to anyone who asks nicely. Educating people on why 'healthy security habits' and 'key rotation' doesn't mean locking the front door and hanging their housekeys differently is pretty much a non-starter.
    - tylersmith 9y ago
      As people continue to get their money stolen they'll slowly come around to utilizing good security.
      - groby_b 9y ago
        No, they won't. They'll stop using tech as much as they can. That's basic UX. If you make the experience shitty, people will avoid it. No amount of experts waving their hands wildly will help that. If you can't wrap up your healthy habits and your key rotation in a simple device/card/whatnot that people can carry around and use just like a key, your security measures have already failed. "Because I said so" doesn't work on kids, it sure as heck doesn't work on adults.
        tylersmith 9y ago
        > No, they won't. They'll stop using tech as much as they can. That's doubtful, especially as technology becomes increasingly ubiquitous. For systems like SS force users to use it so opting out isn't currently even an option. > If you can't wrap up your healthy habits and your key rotation in a simple device/card/whatnot that people can carry around and use just like a key, your security measures have already failed. Who said we won't? Seat belts were also avoided for a long time but eventually people have realized they're a good idea.
        groby_b 9y ago
        > Seat belts were also avoided for a long time but eventually people have realized they're a good idea. I take it, then, you were not around in the 80s :) People did not "realize" seatbelts are a good idea. We made people wear seatbelts, using quite draconian laws and relentless PR. > Who said we won't? [... wrap security habits into a handy device] You'll have to explain to me how that jives with your idea of decentralizing data and access control. A key/security device will need to be manufactured - and there are only a few commercial entitites that can and/or will do that. And if you think they won't centralize key management, I admire your optimism.
  - hvidgaard 9y ago
    NemId, as it is called in Denmark, is a paper card with many one time keys, or a dongle that creates a new key every so often. Every time you login, or perform a transaction in the online banking, you need a new and different key. If they get access to your keys, which would probably be because you did something stupid like taking a picture of the card, you can revoke access, and there is a paper trail of every single time the adversary impersonated you. How is that worse?
    - tylersmith 9y ago
      I'm not familiar with the system but centralizing critical data is strictly less ideal than decentralizing it. If your key seed or the central server are compromised everything is compromised. Revoking keys is great but doesn't help after they've given full access.
      - jon_richards 9y ago
        >Revoking keys is great but doesn't help after they've given full access. That's true in a lot of infosec, but in identification, you can revoke everything and wait for meat-space verification to start again.
        tylersmith 9y ago
        Only once you've noticed it. Automated systems could be used but there's always the potential for large impacts before automated systems recognize the issue. And if the keys are ID related you can easily revoke it. You can't revoke a SSN, fingerprint, DNA, or a face scan.
        jon_richards 9y ago
        >Typically the SS number is used for identification, and you have password + one-time code on top of that. Isn't that what this was addressing? The attacker has to get both your password and one-time codes before you change either. All the ID related stuff is used like usernames, not keys. If an attacker does get both, you presumably go in to a government office, have your fingerprints taken, choose a new password, and get given a new set of codes.
  - zo1 9y ago
    This is essentially a new form of luddism. The world is moving forward, with systems evolving by consolidating, grouping and analyzing every aspect of us, our world, and the things we do. Centralization is the answer to so many of our world's ills. Everything from crime, to poverty, to inequality, to disaster-relief. You name it, they can all benefit from a centralized store of all of humanity's knowledge. That is the entire point of the web: connected and cross-referenced knowledge. Fighting that is fighting progress due to fear. And blanketly decrying "centralization" of data because of the fear that it may get lost doesn't address the problems. We should move our society forward, but we should do it while solving the individual security concerns piecemeal and as they happen.
    - deleted 9y ago
      [deleted]
  - Spivak 9y ago
    In just the same way that if someone compromises your email they can probably take control of all of your online accounts. If you have to have many accounts to access government services people are just going to use the same password for all of them and never rotate them. A single authentication service used by all gov't services would be a huge gain for security.
screature2 9y ago
absolutely agree. SSN started life as a unique identifier, that's how it should have remained. It's a pretty terrible super secret password.
- tylersmith 9y ago
  It's unfortunate that asymmetric cryptography wasn't around when the SSN system was built.
trapperkeeper74 9y ago
Basically, the US needs a national ID "card" with PKI system... not to rob people of their privacy but to free them from the tyranny of marketplace anarchy which resulted in the absence of global unique person identifier de-facto globbing onto a number meant for pensioner and disabled benefits. Basically, it should be illegal to use SSNs for anything but Social Security. Taxes should have a tax ID for taxes alone. Instead, secure public key systems to authorize or refuse requests with authenication and nonrepudiation, using a public identifier that can be shared widely but isn't also a magic access authorization detail. As it happens, IIRC, circa 2000, US schools and universities had to change their databases and systems to not use SSN's as student IDs because of identity theft problems extending from this very core problem. The US through law must deleverage SSNs and make them public-safe, and promote/mandate a real PKI non-profit system for authentication and authorization for the greater good.
- groby_b 9y ago
  Good luck. There's a significant part of the US that gets their panties in a bunch whenever you mention something close to a national ID - which this would be. So, instead we have an extremely crappy national ID in form of SSN cards, but I'm fairly certain that same crowd would also be happy to end social security - so at least they're consistent.
  - tylersmith 9y ago
    Would there be a point to a national ID outside taxation? Is that the only reason a State would need to have identifiers for its citizens? Credit can be managed without centralized identities so what is the nessecity of a State ID?
    - dummyfunnytoo 9y ago
      I didn't really grasp this until I moved to the US... They don't fucking care what makes sense around some issues like this. I've asked seemingly rational colleagues, who work as professional developers, about SSN and national IDs. They've all been completely opposed. Even if they otherwise offer solid opinions on security. Something something, Nazis, something, Hitler would've been even more successful if the Germans had national IDs. Can't trust the federal government to do it. But then they tell me to keep my SSN secret, forever, except that I need to give it to people all the time, and they use the last four digits of it as verification all the time. So you've got a shitty defacto system with zero integrity, basically mandatory use, and that can't be changed. They even print it on paper cards to discourage its use as an id. There is a US national ID. It just sucks and they won't admit how they use it in practice. Sigh..

semi-extrinsic 9y ago

What you really need is a standardised login portal for government and private services that deal with personal information. Then you can have multiple service providers for the actual login, e.g. your bank's proper 2FA login, YubiKeys etc. We've had this for years in my country (with ~2% of the population of the US) and it's working great. Typically the SS number is used for identification, and you have password + one-time code on top of that.

tylersmith 9y ago
I disagree. Centralizing the data and the access control would only create more issues. If somebody got into your account they'd have the keys to your life. We need to embrace decentralizing data and access control along with healthy security habits like proper secret generation and frequent rotation.
- will_hughes 9y ago
  > along with healthy security habits like proper secret generation and frequent rotation. While having the populace in general be security aware would be a great thing, it's barely possible to get them to do even basic shit like not putting credit card numbers and other secret information into an email and sending it to anyone who asks nicely. Educating people on why 'healthy security habits' and 'key rotation' doesn't mean locking the front door and hanging their housekeys differently is pretty much a non-starter.
  - tylersmith 9y ago
    As people continue to get their money stolen they'll slowly come around to utilizing good security.
    - groby_b 9y ago
      No, they won't. They'll stop using tech as much as they can. That's basic UX. If you make the experience shitty, people will avoid it. No amount of experts waving their hands wildly will help that. If you can't wrap up your healthy habits and your key rotation in a simple device/card/whatnot that people can carry around and use just like a key, your security measures have already failed. "Because I said so" doesn't work on kids, it sure as heck doesn't work on adults.
      - tylersmith 9y ago
        > No, they won't. They'll stop using tech as much as they can. That's doubtful, especially as technology becomes increasingly ubiquitous. For systems like SS force users to use it so opting out isn't currently even an option. > If you can't wrap up your healthy habits and your key rotation in a simple device/card/whatnot that people can carry around and use just like a key, your security measures have already failed. Who said we won't? Seat belts were also avoided for a long time but eventually people have realized they're a good idea.
        groby_b 9y ago
        > Seat belts were also avoided for a long time but eventually people have realized they're a good idea. I take it, then, you were not around in the 80s :) People did not "realize" seatbelts are a good idea. We made people wear seatbelts, using quite draconian laws and relentless PR. > Who said we won't? [... wrap security habits into a handy device] You'll have to explain to me how that jives with your idea of decentralizing data and access control. A key/security device will need to be manufactured - and there are only a few commercial entitites that can and/or will do that. And if you think they won't centralize key management, I admire your optimism.
- hvidgaard 9y ago
  NemId, as it is called in Denmark, is a paper card with many one time keys, or a dongle that creates a new key every so often. Every time you login, or perform a transaction in the online banking, you need a new and different key. If they get access to your keys, which would probably be because you did something stupid like taking a picture of the card, you can revoke access, and there is a paper trail of every single time the adversary impersonated you. How is that worse?
  - tylersmith 9y ago
    I'm not familiar with the system but centralizing critical data is strictly less ideal than decentralizing it. If your key seed or the central server are compromised everything is compromised. Revoking keys is great but doesn't help after they've given full access.
    - jon_richards 9y ago
      >Revoking keys is great but doesn't help after they've given full access. That's true in a lot of infosec, but in identification, you can revoke everything and wait for meat-space verification to start again.
      - tylersmith 9y ago
        Only once you've noticed it. Automated systems could be used but there's always the potential for large impacts before automated systems recognize the issue. And if the keys are ID related you can easily revoke it. You can't revoke a SSN, fingerprint, DNA, or a face scan.
        jon_richards 9y ago
        >Typically the SS number is used for identification, and you have password + one-time code on top of that. Isn't that what this was addressing? The attacker has to get both your password and one-time codes before you change either. All the ID related stuff is used like usernames, not keys. If an attacker does get both, you presumably go in to a government office, have your fingerprints taken, choose a new password, and get given a new set of codes.
- zo1 9y ago
  This is essentially a new form of luddism. The world is moving forward, with systems evolving by consolidating, grouping and analyzing every aspect of us, our world, and the things we do. Centralization is the answer to so many of our world's ills. Everything from crime, to poverty, to inequality, to disaster-relief. You name it, they can all benefit from a centralized store of all of humanity's knowledge. That is the entire point of the web: connected and cross-referenced knowledge. Fighting that is fighting progress due to fear. And blanketly decrying "centralization" of data because of the fear that it may get lost doesn't address the problems. We should move our society forward, but we should do it while solving the individual security concerns piecemeal and as they happen.
  - deleted 9y ago
    [deleted]
- Spivak 9y ago
  In just the same way that if someone compromises your email they can probably take control of all of your online accounts. If you have to have many accounts to access government services people are just going to use the same password for all of them and never rotate them. A single authentication service used by all gov't services would be a huge gain for security.

screature2 9y ago

absolutely agree. SSN started life as a unique identifier, that's how it should have remained. It's a pretty terrible super secret password.

tylersmith 9y ago
It's unfortunate that asymmetric cryptography wasn't around when the SSN system was built.

trapperkeeper74 9y ago

Basically, the US needs a national ID "card" with PKI system... not to rob people of their privacy but to free them from the tyranny of marketplace anarchy which resulted in the absence of global unique person identifier de-facto globbing onto a number meant for pensioner and disabled benefits. Basically, it should be illegal to use SSNs for anything but Social Security. Taxes should have a tax ID for taxes alone. Instead, secure public key systems to authorize or refuse requests with authenication and nonrepudiation, using a public identifier that can be shared widely but isn't also a magic access authorization detail. As it happens, IIRC, circa 2000, US schools and universities had to change their databases and systems to not use SSN's as student IDs because of identity theft problems extending from this very core problem. The US through law must deleverage SSNs and make them public-safe, and promote/mandate a real PKI non-profit system for authentication and authorization for the greater good.

groby_b 9y ago
Good luck. There's a significant part of the US that gets their panties in a bunch whenever you mention something close to a national ID - which this would be. So, instead we have an extremely crappy national ID in form of SSN cards, but I'm fairly certain that same crowd would also be happy to end social security - so at least they're consistent.
- tylersmith 9y ago
  Would there be a point to a national ID outside taxation? Is that the only reason a State would need to have identifiers for its citizens? Credit can be managed without centralized identities so what is the nessecity of a State ID?
  - dummyfunnytoo 9y ago
    I didn't really grasp this until I moved to the US... They don't fucking care what makes sense around some issues like this. I've asked seemingly rational colleagues, who work as professional developers, about SSN and national IDs. They've all been completely opposed. Even if they otherwise offer solid opinions on security. Something something, Nazis, something, Hitler would've been even more successful if the Germans had national IDs. Can't trust the federal government to do it. But then they tell me to keep my SSN secret, forever, except that I need to give it to people all the time, and they use the last four digits of it as verification all the time. So you've got a shitty defacto system with zero integrity, basically mandatory use, and that can't be changed. They even print it on paper cards to discourage its use as an id. There is a US national ID. It just sucks and they won't admit how they use it in practice. Sigh..