> So, ask [the people who lost billions of accounts and SSNs] how to protect against data breaches? It's worse than that. These are the very people who profit

> So, ask [the people who lost billions of accounts and SSNs] how to protect against data breaches? It's worse than that. These are the very people who profit on trading in data linked to identity information. It's like asking the fox how to secure the henhouse, after he ate all the hens. Any new identity scheme has to be something that does not rely on security practices of any third parties. The public component of the identifier must be useless as an identifier without the private part held only by the individual.