3 ms·

Right, this is the challenge. The biggest problem is that SSN were used like a password and not a username. If we simply replace it with a different "secret" nu

Right, this is the challenge. The biggest problem is that SSN were used like a password and not a username. If we simply replace it with a different "secret" number, we don't change much. It is also possible we make it worse temporarily as all the attack vectors are exposed. Give people a private key on a card and they'll just put it into their wallet/purse. Stealing the wallet gives someone an un-refutable ability to become you. There would also be far less hacking to get SSNs if we had a reasonable credit system where our credit is always frozen and only unfrozen for a short window (24 hours?) at our request and this request is verified via a MFA approach of our choosing. As long as you can get $5K credit at the register in 5 minutes, you are going to have a hard time stopping identity theft. Too many people want easy credit. It will always be a balance of security and convenience. Most consumers want convenience and will continue to do so as long as the cost of the fraud is hidden from them.

moosey 9y ago
Further, I think there should be notifications when our credit information changes. How this information is sent is a really good question, but instead of us having to search for modifications, it should just be pushed.
- mjevans 9y ago
  How about an active, closed loop, control solution? When someone wants to confirm your identity, or otherwise interact with your 'financials', you get sent an email with a quickly expiring link that you click on to view a page where you enter the name of the org or person you /think/ is checking your data, and if it matches things work.
  - dredmorbius 9y ago
    And that email information, and account, are managed where? By what authority? Protected and secured how? Beware Maginot defences.
- ballenf 9y ago
  Dun and Bradstreet is the business equivalent for credit scores. Businesses can easily sign up for a free service to get instant notification of creditworthiness changes. It's free as a marketing tool to buy their very expensive other services, but works well and is very easy to challenge any adverse reports.
ballenf 9y ago
The other solution would be shifting the burden of proof for an adverse credit action off of the consumer where it currently resides. If you want to tell the world that I fucked off with your money, there should be a pretty high burden of proof since you bear virtually zero risk for getting my identity wrong while I will pay an enormous price for such a mistake. Isn't it kind of insane that a random entity can destroy your financial reputation with little more than a few bits of info about you? And without any notice before or after of it happening (you have to affirmatively ask about it to find out). It's so strange that you will get notified if you're rejected for credit due to your credit score, but not notified by the party who made the claim on which that decision was based?
- dredmorbius 9y ago
  It's not so much that the burden of proof is on the citizen, but that the burden of ongoing defence is. In most cases, if there's a case of fraud, you file a counter, and (modulo various bureaucratic foulups), you're clear. The merchant almost always eats the cost, and that really should be changed, at least balanced with the financial institution. The burden is more from the "death by a thousand cuts" variety of having to go through the re-assertion process again and again and again and .... I've been looking at attention and cognition mostly in the context of media, but the simple truth is that most of us are bombarded by all sorts of demands and claims, the dealing of with is an increasingly insurmountable burden. I liken this to point-and-click computer interfaces. It's simple to graphically delete a few files or folders or message notifications. It's a slight chore when that rises to 20 or 30. At the level of a hundred or so items, most people would give up. With more powerful tools, it's possible to manage hundreds, thousands, even millions of items with dispatch. (Of course, that may increase the likelihood that you'll have to do so.) Given the frequency of issues and the magnitude of them, presented through current financial and authentication mechanisms, even "easy" repudiation becomes untenable at scale.

moosey 9y ago

Further, I think there should be notifications when our credit information changes. How this information is sent is a really good question, but instead of us having to search for modifications, it should just be pushed.

mjevans 9y ago
How about an active, closed loop, control solution? When someone wants to confirm your identity, or otherwise interact with your 'financials', you get sent an email with a quickly expiring link that you click on to view a page where you enter the name of the org or person you /think/ is checking your data, and if it matches things work.
- dredmorbius 9y ago
  And that email information, and account, are managed where? By what authority? Protected and secured how? Beware Maginot defences.
ballenf 9y ago
Dun and Bradstreet is the business equivalent for credit scores. Businesses can easily sign up for a free service to get instant notification of creditworthiness changes. It's free as a marketing tool to buy their very expensive other services, but works well and is very easy to challenge any adverse reports.

ballenf 9y ago

The other solution would be shifting the burden of proof for an adverse credit action off of the consumer where it currently resides. If you want to tell the world that I fucked off with your money, there should be a pretty high burden of proof since you bear virtually zero risk for getting my identity wrong while I will pay an enormous price for such a mistake. Isn't it kind of insane that a random entity can destroy your financial reputation with little more than a few bits of info about you? And without any notice before or after of it happening (you have to affirmatively ask about it to find out). It's so strange that you will get notified if you're rejected for credit due to your credit score, but not notified by the party who made the claim on which that decision was based?

dredmorbius 9y ago
It's not so much that the burden of proof is on the citizen, but that the burden of ongoing defence is. In most cases, if there's a case of fraud, you file a counter, and (modulo various bureaucratic foulups), you're clear. The merchant almost always eats the cost, and that really should be changed, at least balanced with the financial institution. The burden is more from the "death by a thousand cuts" variety of having to go through the re-assertion process again and again and again and .... I've been looking at attention and cognition mostly in the context of media, but the simple truth is that most of us are bombarded by all sorts of demands and claims, the dealing of with is an increasingly insurmountable burden. I liken this to point-and-click computer interfaces. It's simple to graphically delete a few files or folders or message notifications. It's a slight chore when that rises to 20 or 30. At the level of a hundred or so items, most people would give up. With more powerful tools, it's possible to manage hundreds, thousands, even millions of items with dispatch. (Of course, that may increase the likelihood that you'll have to do so.) Given the frequency of issues and the magnitude of them, presented through current financial and authentication mechanisms, even "easy" repudiation becomes untenable at scale.