3 ms·

If the data you hold as a business is so valuable that the insurable risk of loss is too expensive for your business, then ask, "do we really need to hold that

If the data you hold as a business is so valuable that the insurable risk of loss is too expensive for your business, then ask, "do we really need to hold that data?" If your business needs to pass that on to consumers because you can't afford the hit to your margins, then consumers need to ask, "is [service/product] really worth that much to me?" The downside is that the most critical components of information which tie to identity itself, are the ones that businesses most commonly need to hold to verify identity. More challenging is that without a way to modify identity data (i.e. change your SSN), the insurable risk is huge because it needs to include a discounted cost of identity monitoring forever, and the cost of the individual losses that someone might encounter for the loss of that data. Then of course, if a person's identity is compromised more than once, how do you discount the responsibility across multiple careless parties? IMO it all comes down to never using immutable information (Name, DOB, etc) to firmly define identity online. That information should be for display purposes only. At the backend, we need an identity that is tolerant of change, and can easily be updated if it is ever lost. In reality this will probably mean that instead of an ID, we have ID probability, which would include photos, addresses, ID numbers, Credit card account access, and companies that needed to verify it would be able to evaluate how certain they were the identity was real, and to insure against mishandling of the individual components of information.

ashark 9y ago
> The downside is that the most critical components of information which tie to identity itself, are the ones that businesses most commonly need to hold to verify identity. More challenging is that without a way to modify identity data (i.e. change your SSN), the insurable risk is huge because it needs to include a discounted cost of identity monitoring forever, and the cost of the individual losses that someone might encounter for the loss of that data. Then of course, if a person's identity is compromised more than once, how do you discount the responsibility across multiple careless parties? If it gets expensive enough, maybe banks and CC companies and such will finally get off their asses and fix the whole "identity theft" issue. That's a feature, not a bug. I think the US is too allergic to anything with even a whiff of "secure national ID" for us to let the government fix it, so this is the next best (or, better, depending on your perspective) option. I frankly don't care how we do it, but it's really stupid this is still a thing people have to worry about, and making it cheaper for the banks to fix it than not to fix it seems like the most politically viable solution.
- abakker 9y ago
  Agree completely. Personally, I was hoping that Visa, MC, and Amex together could just create a new standard "financial ID number" or "Credit ID Number" that they could collectively agree on and we could all just kind of ignore the government. CC numbers themselves are almost good enough in the first place, they just need to get a little more self-referential. Hell, maybe they could even use a distributed ledger to do it and bring in the credit reporting agencies too.
  - gizmo686 9y ago
    >we could all just kind of ignore the government. You mean the government that spent 26 years printing "NOT FOR IDENTIFICATION" on the bottom of every social security card.
arca_vorago 9y ago
What you haven't addressed is the fact that so much of SV, yc included, is now based off a business model of selling that data to third parties such as but not limited to advertisers. The same applies to the tech around banking and credit, with data selling and sharing going on all over the place. This is the elephant in the room I don't see anyone addressing, but be warned, we can see the effect caving to this model had on the journalism industry. If tech doesn't free itself from this, it will likely have similar consequences.
- abakker 9y ago
  SV may mometoze the data, but Credit rating companies monetize identity and the protection of it. SV knows about you, but credit agencies can define who you are. Of course, identity theft is a mortal wound and is hard to ignore. Casual mometization of every private action is death by 1000 cuts.

ashark 9y ago

> The downside is that the most critical components of information which tie to identity itself, are the ones that businesses most commonly need to hold to verify identity. More challenging is that without a way to modify identity data (i.e. change your SSN), the insurable risk is huge because it needs to include a discounted cost of identity monitoring forever, and the cost of the individual losses that someone might encounter for the loss of that data. Then of course, if a person's identity is compromised more than once, how do you discount the responsibility across multiple careless parties? If it gets expensive enough, maybe banks and CC companies and such will finally get off their asses and fix the whole "identity theft" issue. That's a feature, not a bug. I think the US is too allergic to anything with even a whiff of "secure national ID" for us to let the government fix it, so this is the next best (or, better, depending on your perspective) option. I frankly don't care how we do it, but it's really stupid this is still a thing people have to worry about, and making it cheaper for the banks to fix it than not to fix it seems like the most politically viable solution.

abakker 9y ago
Agree completely. Personally, I was hoping that Visa, MC, and Amex together could just create a new standard "financial ID number" or "Credit ID Number" that they could collectively agree on and we could all just kind of ignore the government. CC numbers themselves are almost good enough in the first place, they just need to get a little more self-referential. Hell, maybe they could even use a distributed ledger to do it and bring in the credit reporting agencies too.
- gizmo686 9y ago
  >we could all just kind of ignore the government. You mean the government that spent 26 years printing "NOT FOR IDENTIFICATION" on the bottom of every social security card.

arca_vorago 9y ago

What you haven't addressed is the fact that so much of SV, yc included, is now based off a business model of selling that data to third parties such as but not limited to advertisers. The same applies to the tech around banking and credit, with data selling and sharing going on all over the place. This is the elephant in the room I don't see anyone addressing, but be warned, we can see the effect caving to this model had on the journalism industry. If tech doesn't free itself from this, it will likely have similar consequences.

abakker 9y ago
SV may mometoze the data, but Credit rating companies monetize identity and the protection of it. SV knows about you, but credit agencies can define who you are. Of course, identity theft is a mortal wound and is hard to ignore. Casual mometization of every private action is death by 1000 cuts.