6 ms·

Wow, this document is extremely short. The disaster is very palpable in this format. > names, Social Security numbers, birth dates, addresses and, in some ins

by jMyles 9y ago

Wow, this document is extremely short. The disaster is very palpable in this format. > names, Social Security numbers, birth dates, addresses and, in some instances, driver’s license numbers of 143 million U.S. consumers (since updated) OK, so who is going to be the grown-up in this situation? It's obvious now that these numbers can no longer be treated as secret or, in most cases, as identifying instruments. Who will lead the effort to deprecate them and migrate all of the documents and accounts which rely on them? Why is it so difficult to imagine a coherent, sober response from government and mega-corporate entities which have until now, been using SSNs as identifying data?

tomglynch 9y ago
Need a totally new way of verifying identity now. The old way was already broken, but now it's totally destroyed.
- seanp2k2 9y ago
  And yet we still use it with no end in sight. The only reason your identity isn't yet stolen and financial history ruined is likely literally that they haven't gotten to you yet. What incentives are there for Equifax, Experian, TransUnion, Innovis, etc who profit from this system existing to make it better? Who in the government will go after them, or even better, come up with something which will render them obsolete?
  - tokyodude 9y ago
    And yet bring up any kind of negative incentive here on HN and you’ll br greeted with “that would stifle innovation” and “negative incentives will just make companies try to keep breaches secret” couldnt that logic be applied to all laws making bad behavior have negative consequences?
  - Someone1234 9y ago
    They profit from this system and also profit from breaches. All of them have been making money hand over fist on this, thanks to their exclusive ability to monitor and lock/unlock their own credit reports. Even if you aren't paying these companies directly, you're paying a company paying them for credit reporting to watch for identity theft. Calling it a perverse incentive is an understatement. Only the US Government could have stepped in and made it unprofitable, but it appears as there will be no significant punishment for Equifax, and instead as a result of this the Congress made it harder to file a Class Action Lawsuit against companies like Equifax, so the next time you won't even have that option...
    - ams6110 9y ago
      Some states by law require that there be no charge for credit report locking/unlocking.
- lotsofpulp 9y ago
  Could require everyone to send a picture of themselves with a hand written note with date and time and a thumbs up.
- ljm 9y ago
  There is a pretty elegant solution in Europe: you're given an ID card (as a foreigner I paid €28 euro to get one of these in favour of a paper-based equivalent containing just the personal number/tax ID, not sure how it works as a citizen). It's also the same with the Estonian e-residence (and naturally the normal one too). Most services use public key crypto and your ID card doubles up as the thing you use to cryptographically sign any documents that require proof of ID. You can do this yourself for many official documents with a generic smart card reader, and most places that would require ID in general (like your bank) will use that same system too. The nature of the system means that while there's still likely to be a list of personal/tax numbers lying around, they are not the secret and there isn't a central database of everybody's private keys out there. If the root cert is compromised it can be renewed and card holders can refresh their card through some system or another (where I lived I had to take it to an office for them to do it for me). I enjoyed using that in favour of the UK method of telling somebody where I lived for three years and where I was born, along with various other details, in order for them to become convinced of who I am. All I had to do in Europe was plug in my ID and that was enough proof. Of course, implementing such a scheme in the US and UK seems to be politically toxic for various reasons that can be summarised as paranoia (whether that's warranted or not), where the potential for the government to abuse it in myriad dystopian, conspiratorial ways is still far, far worse than what the corporate megaliths are doing with all of that information already, for profit, as if the natural state of government is to be less trustworthy than a corporation despite reality showing otherwise time and time again.
jaggederest 9y ago
They're already trying to change "bank fraud" into "identity theft" and defer liability to the person whose info is being used, vice the old way of the bank being fully liable. Ironically, for a lot of industries they're better off just giving it the see-no-evil-hear-no-evil-speak-no-evil treatment and ignoring that those numbers can/will be stolen. It's a little bit like the opposite of the way everyone is doing facial recognition and biometrics these days - plausible identifiability, when it's to their interest not to notice that the person doesn't match the id.
- jMyles 9y ago
  > They're already trying to change "bank fraud" into "identity theft" Interesting - has anybody been vigilantly documenting this transition and its impact for consumers? Have a link handy? I've certainly noticed it in the common vernacular, but I haven't yet really considered what it means for bottom lines.
- bogomipz 9y ago
  >"They're already trying to change "bank fraud" into "identity theft" and defer liability to the person whose info is being used, vice the old way of the bank being fully liable" Do you some references or citations you could share about such a development? This is the first I have heard about this. Who is the "they" here? SEC? Banks? Lawmakers?
pc86 9y ago
I want to see us move away from SSNs and OLNs (driver license numbers) as identifying instruments. But this comment seems a little naive. There is massive infrastructure built entirely around the use of SSN as the sole and final arbiter of who is who. You can change your social, yes, but many many systems ignore that entirely because it's for the part rare and something that happens 0-1 times in a person's life. The government cannot just say "hey that whole SSN thing yeah we're not doing that anymore" without a decade or more of lead time. Companies like Equifax and other not-quite-as-dumpster-fire ones who rely on something like SSN can't just create their own and can't just use everything but. It needs to change but it will take years if not decades to fully extricate it from the system, and that's if the government decides today that it needs to be done, which itself isn't clear right now.
- 3JPLW 9y ago
  My driver license number is entirely predictable based upon my name phonetics, DOB, and sex.
  - pc86 9y ago
    Okay. That doesn't mean it isn't used as a unique identifier.
- PurpleBoxDragon 9y ago
  They can. It will be a dumpster fire and will cost businesses massive amounts of money, but I think that's a good thing. You took an easy path that makes things worse not just for your users, but for people who never consented to using your system or doing business with you to begin with. Just pass a law that has an incrementing cost associated with use of SSNs. It can be done. That rich people who don't want it to be done because they like our the current setup to nonconsensually shift risk oppose it doesn't mean it can't be done.
  - pc86 9y ago
    When I say "companies like Equifax" I don't mean credit monitoring services. I mean any company which has a regulatory or business requirement to verify you are the person you say you are. They all use SSNs, and most of them require your consent to operate.

by jMyles 9y ago

tomglynch 9y ago

Need a totally new way of verifying identity now. The old way was already broken, but now it's totally destroyed.

seanp2k2 9y ago
And yet we still use it with no end in sight. The only reason your identity isn't yet stolen and financial history ruined is likely literally that they haven't gotten to you yet. What incentives are there for Equifax, Experian, TransUnion, Innovis, etc who profit from this system existing to make it better? Who in the government will go after them, or even better, come up with something which will render them obsolete?
- tokyodude 9y ago
  And yet bring up any kind of negative incentive here on HN and you’ll br greeted with “that would stifle innovation” and “negative incentives will just make companies try to keep breaches secret” couldnt that logic be applied to all laws making bad behavior have negative consequences?
- Someone1234 9y ago
  They profit from this system and also profit from breaches. All of them have been making money hand over fist on this, thanks to their exclusive ability to monitor and lock/unlock their own credit reports. Even if you aren't paying these companies directly, you're paying a company paying them for credit reporting to watch for identity theft. Calling it a perverse incentive is an understatement. Only the US Government could have stepped in and made it unprofitable, but it appears as there will be no significant punishment for Equifax, and instead as a result of this the Congress made it harder to file a Class Action Lawsuit against companies like Equifax, so the next time you won't even have that option...
  - ams6110 9y ago
    Some states by law require that there be no charge for credit report locking/unlocking.
lotsofpulp 9y ago
Could require everyone to send a picture of themselves with a hand written note with date and time and a thumbs up.
ljm 9y ago
There is a pretty elegant solution in Europe: you're given an ID card (as a foreigner I paid €28 euro to get one of these in favour of a paper-based equivalent containing just the personal number/tax ID, not sure how it works as a citizen). It's also the same with the Estonian e-residence (and naturally the normal one too). Most services use public key crypto and your ID card doubles up as the thing you use to cryptographically sign any documents that require proof of ID. You can do this yourself for many official documents with a generic smart card reader, and most places that would require ID in general (like your bank) will use that same system too. The nature of the system means that while there's still likely to be a list of personal/tax numbers lying around, they are not the secret and there isn't a central database of everybody's private keys out there. If the root cert is compromised it can be renewed and card holders can refresh their card through some system or another (where I lived I had to take it to an office for them to do it for me). I enjoyed using that in favour of the UK method of telling somebody where I lived for three years and where I was born, along with various other details, in order for them to become convinced of who I am. All I had to do in Europe was plug in my ID and that was enough proof. Of course, implementing such a scheme in the US and UK seems to be politically toxic for various reasons that can be summarised as paranoia (whether that's warranted or not), where the potential for the government to abuse it in myriad dystopian, conspiratorial ways is still far, far worse than what the corporate megaliths are doing with all of that information already, for profit, as if the natural state of government is to be less trustworthy than a corporation despite reality showing otherwise time and time again.

jaggederest 9y ago

They're already trying to change "bank fraud" into "identity theft" and defer liability to the person whose info is being used, vice the old way of the bank being fully liable. Ironically, for a lot of industries they're better off just giving it the see-no-evil-hear-no-evil-speak-no-evil treatment and ignoring that those numbers can/will be stolen. It's a little bit like the opposite of the way everyone is doing facial recognition and biometrics these days - plausible identifiability, when it's to their interest not to notice that the person doesn't match the id.

jMyles 9y ago
> They're already trying to change "bank fraud" into "identity theft" Interesting - has anybody been vigilantly documenting this transition and its impact for consumers? Have a link handy? I've certainly noticed it in the common vernacular, but I haven't yet really considered what it means for bottom lines.
bogomipz 9y ago
>"They're already trying to change "bank fraud" into "identity theft" and defer liability to the person whose info is being used, vice the old way of the bank being fully liable" Do you some references or citations you could share about such a development? This is the first I have heard about this. Who is the "they" here? SEC? Banks? Lawmakers?

pc86 9y ago

I want to see us move away from SSNs and OLNs (driver license numbers) as identifying instruments. But this comment seems a little naive. There is massive infrastructure built entirely around the use of SSN as the sole and final arbiter of who is who. You can change your social, yes, but many many systems ignore that entirely because it's for the part rare and something that happens 0-1 times in a person's life. The government cannot just say "hey that whole SSN thing yeah we're not doing that anymore" without a decade or more of lead time. Companies like Equifax and other not-quite-as-dumpster-fire ones who rely on something like SSN can't just create their own and can't just use everything but. It needs to change but it will take years if not decades to fully extricate it from the system, and that's if the government decides today that it needs to be done, which itself isn't clear right now.

3JPLW 9y ago
My driver license number is entirely predictable based upon my name phonetics, DOB, and sex.
- pc86 9y ago
  Okay. That doesn't mean it isn't used as a unique identifier.
PurpleBoxDragon 9y ago
They can. It will be a dumpster fire and will cost businesses massive amounts of money, but I think that's a good thing. You took an easy path that makes things worse not just for your users, but for people who never consented to using your system or doing business with you to begin with. Just pass a law that has an incrementing cost associated with use of SSNs. It can be done. That rich people who don't want it to be done because they like our the current setup to nonconsensually shift risk oppose it doesn't mean it can't be done.
- pc86 9y ago
  When I say "companies like Equifax" I don't mean credit monitoring services. I mean any company which has a regulatory or business requirement to verify you are the person you say you are. They all use SSNs, and most of them require your consent to operate.