3 ms·

Homeless people have SSNs, too, and likely aren't carrying around wallets.

snuxoll 9y ago
Not to dismiss the point entirely, but this is still an edge case - and one that doesn't justify the continued use of an identifier as a password. People on HN make jabs at things like fingerprint / facial recognition as passwords all the time, but if you have something you need to keep private it's easy to forgo them and use a proper password instead (even if it's more inconvenient). Even if we replace SSN's with a 1024-character identifier leaks will still happen, because we continue to use the wrong tool for the job - leaving us no better off and just more inconvenienced. We need a national ID system, ID numbers need to be no more than identifiers, if you need to validate your identity proper two-factor authentication - possession of your national ID card with your private key, and a password only you know - is the only safe way to do so.
- BatFastard 9y ago
  I know that SS is not a national ID, but it effectively is. But its an ID with no password, someone thought this was a good idea?
  - s73ver_ 9y ago
    They thought, "Hey, we need an ID number for this national social insurance program." Then later, someone else thought, "Hey, I need an identifier to check this person's Identity. Oh, they have a taxpayer ID number. I'll use that." And it just kind of piled on and on and on.
- s73ver_ 9y ago
  Homeless people are not an edge case.
  - snuxoll 9y ago
    Going by a high estimate of 600,000 homeless Americans that means .1% of our population is homeless - sorry, but, yes, that is in fact an edge case. It’s one that needs to be addressed, but sacrificing security isn’t the way to go about it. The number one issue here will be verifying identity for welfare programs and employment, which is already problematic (if you can’t carry an ID card you probably aren’t carrying your social security card and birth certificate either).
    - s73ver_ 9y ago
      No, it's not an edge case. They are people. And nowhere did I suggest sacrificing security. I said you need to be able to use the system without computers.
      - snuxoll 9y ago
        “Without computers” is extremely vague. What needs to be done without them, considering the majority of use cases for our existing cases for SSN’s or state ID’s are electronic (even if it is just handing the card to someone so they can copy the details into a computer). A smart card handles everything pretty well, it acts as a normal physical ID but can also be used to electronically sign things as well (plug it into a terminal at the bank and enter a PIN to verify your identity when opening an account, or use a card reader at home).
        s73ver_ 9y ago
        We do also put the SSN on a form quite often.

Not to dismiss the point entirely, but this is still an edge case - and one that doesn't justify the continued use of an identifier as a password. People on HN make jabs at things like fingerprint / facial recognition as passwords all the time, but if you have something you need to keep private it's easy to forgo them and use a proper password instead (even if it's more inconvenient). Even if we replace SSN's with a 1024-character identifier leaks will still happen, because we continue to use the wrong tool for the job - leaving us no better off and just more inconvenienced. We need a national ID system, ID numbers need to be no more than identifiers, if you need to validate your identity proper two-factor authentication - possession of your national ID card with your private key, and a password only you know - is the only safe way to do so.

BatFastard 9y ago
I know that SS is not a national ID, but it effectively is. But its an ID with no password, someone thought this was a good idea?
- s73ver_ 9y ago
  They thought, "Hey, we need an ID number for this national social insurance program." Then later, someone else thought, "Hey, I need an identifier to check this person's Identity. Oh, they have a taxpayer ID number. I'll use that." And it just kind of piled on and on and on.
s73ver_ 9y ago
Homeless people are not an edge case.
- snuxoll 9y ago
  Going by a high estimate of 600,000 homeless Americans that means .1% of our population is homeless - sorry, but, yes, that is in fact an edge case. It’s one that needs to be addressed, but sacrificing security isn’t the way to go about it. The number one issue here will be verifying identity for welfare programs and employment, which is already problematic (if you can’t carry an ID card you probably aren’t carrying your social security card and birth certificate either).
  - s73ver_ 9y ago
    No, it's not an edge case. They are people. And nowhere did I suggest sacrificing security. I said you need to be able to use the system without computers.
    - snuxoll 9y ago
      “Without computers” is extremely vague. What needs to be done without them, considering the majority of use cases for our existing cases for SSN’s or state ID’s are electronic (even if it is just handing the card to someone so they can copy the details into a computer). A smart card handles everything pretty well, it acts as a normal physical ID but can also be used to electronically sign things as well (plug it into a terminal at the bank and enter a PIN to verify your identity when opening an account, or use a card reader at home).
      - s73ver_ 9y ago
        We do also put the SSN on a form quite often.