5 ms·

those companies gathered tons of information without even asking people first. and why would this service require the sensitive information to be stored at all,

those companies gathered tons of information without even asking people first. and why would this service require the sensitive information to be stored at all, let alone in plain text?

ben_w 9y ago
Ask Equifax, they “didn’t need” to store as much as they did, let alone in plain text. Perhaps it’s useful for, oh, making sure two people aren’t signing up with the same information. Other problems include: * Social security numbers are explicitly not ID numbers * Not all Americans have social security numbers * Even if they did, Americans are about 5% of world population * Not everyone on the internet gets post (say hi to Nairobi, where addresses of relatively rich locals may be “$Name, third on the left behind the petrol station on the highway”, while poorer people have homes that don’t officially exist on roads that don’t officially exist. Some of these people rely on mobile phones for payments, as banks don’t care. * Not everyone has an ID certificate or card or passport or driving license to provide, and if they did, why not just skip the middle man and ask for that directly like AirBnB (and every international airline I’ve used) does? Or your bank account, like PayPal does — after all, a bank will certify your ID* (* they probably don’t all, and even if they did, not all people have bank accounts) Basically, ID is not a perfectly certifiable thing, so you need to design systems to accommodate failure — even if we actually solved it in theory, all it takes is one criminal finding one implementation flaw and a system that assumed perfection would allow grand exploitation.
- wheresmyusern 9y ago
  im talking about storing information. to be sure that someone is real, collect tons of info and then get rid of most of it and tag their account with a validation stamp. store just enough info so that two people having identical sets of that info is almost impossible. and im not saying ssn or any other peice of info is the best solution -- obviously it would be anything and everything tailored for whatever systems the persons country of residence currently maintains. as for exploitation, i think it would be simple to make exploitation rare as long as good id systems are implemented by the government or other entities. it would certainly be better than having an internet where its impossible to verify if someone is a human or a robot...
  - ben_w 9y ago
    “Almost impossible“ isn’t good enough. “Almost impossible” is why two women in Floria have the same SSN: born the same day, same state, almost the same name (Joanna and Joannie Rivera), and why they were not even the example I had in mind when I googled for a similar story I’d heard a decade earlier. And if your goal is just “is this a human or a machine?”, well, let me introduce you to the idea of identity theft, and why people stole all that data from Equifax. The only way to tell humans and bots apart is some form of automated Turing test, hence Completely Automated Public Turing test to tell Computers and Humans Apart.
    - wheresmyusern 9y ago
      in fact turing tests will be useless at some point, which is the whole basis of my speculation about alternatives to it as i originally stated. dont you agree that captchas will become obsolete at some point? what then?
      - ben_w 9y ago
        If Turing tests become obsolete, we will have human level AI and the bots will be granted personhood. That’s the point of the test.
        wheresmyusern 9y ago
        captchas are turing tests. their purpose is not to grant personhood to robots. captcha will be totally broken well before machines become sentient.
        ben_w 9y ago
        Turing tests are, by definition, the thing which if a computer passes all of then they are a person.

those companies gathered tons of information without even asking people first. and why would this service require the sensitive information to be stored at all, let alone in plain text?

ben_w 9y ago

Ask Equifax, they “didn’t need” to store as much as they did, let alone in plain text. Perhaps it’s useful for, oh, making sure two people aren’t signing up with the same information. Other problems include: * Social security numbers are explicitly not ID numbers * Not all Americans have social security numbers * Even if they did, Americans are about 5% of world population * Not everyone on the internet gets post (say hi to Nairobi, where addresses of relatively rich locals may be “$Name, third on the left behind the petrol station on the highway”, while poorer people have homes that don’t officially exist on roads that don’t officially exist. Some of these people rely on mobile phones for payments, as banks don’t care. * Not everyone has an ID certificate or card or passport or driving license to provide, and if they did, why not just skip the middle man and ask for that directly like AirBnB (and every international airline I’ve used) does? Or your bank account, like PayPal does — after all, a bank will certify your ID* (* they probably don’t all, and even if they did, not all people have bank accounts) Basically, ID is not a perfectly certifiable thing, so you need to design systems to accommodate failure — even if we actually solved it in theory, all it takes is one criminal finding one implementation flaw and a system that assumed perfection would allow grand exploitation.

wheresmyusern 9y ago
im talking about storing information. to be sure that someone is real, collect tons of info and then get rid of most of it and tag their account with a validation stamp. store just enough info so that two people having identical sets of that info is almost impossible. and im not saying ssn or any other peice of info is the best solution -- obviously it would be anything and everything tailored for whatever systems the persons country of residence currently maintains. as for exploitation, i think it would be simple to make exploitation rare as long as good id systems are implemented by the government or other entities. it would certainly be better than having an internet where its impossible to verify if someone is a human or a robot...
- ben_w 9y ago
  “Almost impossible“ isn’t good enough. “Almost impossible” is why two women in Floria have the same SSN: born the same day, same state, almost the same name (Joanna and Joannie Rivera), and why they were not even the example I had in mind when I googled for a similar story I’d heard a decade earlier. And if your goal is just “is this a human or a machine?”, well, let me introduce you to the idea of identity theft, and why people stole all that data from Equifax. The only way to tell humans and bots apart is some form of automated Turing test, hence Completely Automated Public Turing test to tell Computers and Humans Apart.
  - wheresmyusern 9y ago
    in fact turing tests will be useless at some point, which is the whole basis of my speculation about alternatives to it as i originally stated. dont you agree that captchas will become obsolete at some point? what then?
    - ben_w 9y ago
      If Turing tests become obsolete, we will have human level AI and the bots will be granted personhood. That’s the point of the test.
      - wheresmyusern 9y ago
        captchas are turing tests. their purpose is not to grant personhood to robots. captcha will be totally broken well before machines become sentient.
        ben_w 9y ago
        Turing tests are, by definition, the thing which if a computer passes all of then they are a person.