3 ms·

> SSN are NOT an identity mechanism That's exactly what they are. I don't understand who you're trying to fool here. It's a number, for social security, that i

by jack9 9y ago

> SSN are NOT an identity mechanism That's exactly what they are. I don't understand who you're trying to fool here. It's a number, for social security, that is assigned to a person. It's poor as an identification method, so it's commonly used in fraud, but that's just hand waving to distract from the discussion about the purpose.

dec0dedab0de 9y ago
SSN are NOT an identity mechanism or infrastructure to facilitate business. > SSN are NOT an identity mechanism You purposely misquoted them to make your point. That's pretty lame.
- Dylan16807 9y ago
  It's a misquote if you parse the original statement as "NOT an ((identity mechanism or infrastructure) to facilitate business)" That would be removing important qualifiers. It's not a misquote if you parse the original statement as "NOT ((an identity mechanism) or (infrastructure to facilitate business))". It's perfectly fine to simplify "Not A or B" into "Not A" when your argument is "Yes A". In the context of godzilla82's wording, I think the latter interpretation is more likely, making it not a misquote. Even if that's mistaken, I doubt it was an intentional misquote.
chc 9y ago
How in the world does the fact that it is an ID number in the Social Security system mean that it's meant to be used as an identity mechanism by businesses?
- godzilla82 9y ago
  Is it only used by businesses? Don't you have to provide the SSN for your driver's license? If the government is using it as an ID across it's departments, then it is an ID.
- screature2 9y ago
  Those are two separate statements. 1. It's an ID number in the Social Security System. 2. It's also now used as an authentication mechanism by many businesses (because it's relatively ubiquitous and banks, gov, etc. assumed that the SSN owner would and could keep it secret) : a. accepting card payments on stripe (https://support.stripe.com/questions/why-do-you-need-my-date-of-birth-and-4-digits-of-my-social-security-number) b. driving with lyft (https://www.lyft.com/drive-with-lyft under "What are Lyft’s requirements?") c. also for bonus points take a look at what happens when you search google for "SSN for resetting" and marvel at all the banks that let you reset your password with your SSN. (update to try to fix formatting)
screature2 9y ago
Don't think parent poster was trying to mislead. Sounds more like poster is complaining that SSNs got overloaded beyond their original purpose (as guids for the SSA) to being used for business authentication more generally and that because they started being used for purposes they weren't originally intended or designed for, it ended up being a generally bad at it. I tend to agree. Best practices are that we shouldn't use guids as authentication/security mechanisms in software systems because 1. they aren't necessarily random so it's difficult to prevent fraud as a result of guessing and 2. you can't rectify authentication issues (e.g. via rotation of authentication or adding additional entropy) without compromising the identification function see (https://tools.ietf.org/html/rfc4122#section-6 https://tools.ietf.org/html/rfc4122#section-6). We should never have used them as authentication methods IRL.

by jack9 9y ago

dec0dedab0de 9y ago

SSN are NOT an identity mechanism or infrastructure to facilitate business. > SSN are NOT an identity mechanism You purposely misquoted them to make your point. That's pretty lame.

Dylan16807 9y ago
It's a misquote if you parse the original statement as "NOT an ((identity mechanism or infrastructure) to facilitate business)" That would be removing important qualifiers. It's not a misquote if you parse the original statement as "NOT ((an identity mechanism) or (infrastructure to facilitate business))". It's perfectly fine to simplify "Not A or B" into "Not A" when your argument is "Yes A". In the context of godzilla82's wording, I think the latter interpretation is more likely, making it not a misquote. Even if that's mistaken, I doubt it was an intentional misquote.

chc 9y ago

How in the world does the fact that it is an ID number in the Social Security system mean that it's meant to be used as an identity mechanism by businesses?

godzilla82 9y ago
Is it only used by businesses? Don't you have to provide the SSN for your driver's license? If the government is using it as an ID across it's departments, then it is an ID.
screature2 9y ago
Those are two separate statements. 1. It's an ID number in the Social Security System. 2. It's also now used as an authentication mechanism by many businesses (because it's relatively ubiquitous and banks, gov, etc. assumed that the SSN owner would and could keep it secret) : a. accepting card payments on stripe (https://support.stripe.com/questions/why-do-you-need-my-date-of-birth-and-4-digits-of-my-social-security-number) b. driving with lyft (https://www.lyft.com/drive-with-lyft under "What are Lyft’s requirements?") c. also for bonus points take a look at what happens when you search google for "SSN for resetting" and marvel at all the banks that let you reset your password with your SSN. (update to try to fix formatting)

screature2 9y ago

Don't think parent poster was trying to mislead. Sounds more like poster is complaining that SSNs got overloaded beyond their original purpose (as guids for the SSA) to being used for business authentication more generally and that because they started being used for purposes they weren't originally intended or designed for, it ended up being a generally bad at it. I tend to agree. Best practices are that we shouldn't use guids as authentication/security mechanisms in software systems because 1. they aren't necessarily random so it's difficult to prevent fraud as a result of guessing and 2. you can't rectify authentication issues (e.g. via rotation of authentication or adding additional entropy) without compromising the identification function see (https://tools.ietf.org/html/rfc4122#section-6 https://tools.ietf.org/html/rfc4122#section-6). We should never have used them as authentication methods IRL.