4 ms·

Need a totally new way of verifying identity now. The old way was already broken, but now it's totally destroyed.

seanp2k2 8y ago
And yet we still use it with no end in sight. The only reason your identity isn't yet stolen and financial history ruined is likely literally that they haven't gotten to you yet. What incentives are there for Equifax, Experian, TransUnion, Innovis, etc who profit from this system existing to make it better? Who in the government will go after them, or even better, come up with something which will render them obsolete?
- tokyodude 8y ago
  And yet bring up any kind of negative incentive here on HN and you’ll br greeted with “that would stifle innovation” and “negative incentives will just make companies try to keep breaches secret” couldnt that logic be applied to all laws making bad behavior have negative consequences?
- Someone1234 8y ago
  They profit from this system and also profit from breaches. All of them have been making money hand over fist on this, thanks to their exclusive ability to monitor and lock/unlock their own credit reports. Even if you aren't paying these companies directly, you're paying a company paying them for credit reporting to watch for identity theft. Calling it a perverse incentive is an understatement. Only the US Government could have stepped in and made it unprofitable, but it appears as there will be no significant punishment for Equifax, and instead as a result of this the Congress made it harder to file a Class Action Lawsuit against companies like Equifax, so the next time you won't even have that option...
  - ams6110 8y ago
    Some states by law require that there be no charge for credit report locking/unlocking.
lotsofpulp 8y ago
Could require everyone to send a picture of themselves with a hand written note with date and time and a thumbs up.
ljm 8y ago
There is a pretty elegant solution in Europe: you're given an ID card (as a foreigner I paid €28 euro to get one of these in favour of a paper-based equivalent containing just the personal number/tax ID, not sure how it works as a citizen). It's also the same with the Estonian e-residence (and naturally the normal one too). Most services use public key crypto and your ID card doubles up as the thing you use to cryptographically sign any documents that require proof of ID. You can do this yourself for many official documents with a generic smart card reader, and most places that would require ID in general (like your bank) will use that same system too. The nature of the system means that while there's still likely to be a list of personal/tax numbers lying around, they are not the secret and there isn't a central database of everybody's private keys out there. If the root cert is compromised it can be renewed and card holders can refresh their card through some system or another (where I lived I had to take it to an office for them to do it for me). I enjoyed using that in favour of the UK method of telling somebody where I lived for three years and where I was born, along with various other details, in order for them to become convinced of who I am. All I had to do in Europe was plug in my ID and that was enough proof. Of course, implementing such a scheme in the US and UK seems to be politically toxic for various reasons that can be summarised as paranoia (whether that's warranted or not), where the potential for the government to abuse it in myriad dystopian, conspiratorial ways is still far, far worse than what the corporate megaliths are doing with all of that information already, for profit, as if the natural state of government is to be less trustworthy than a corporation despite reality showing otherwise time and time again.

And yet we still use it with no end in sight. The only reason your identity isn't yet stolen and financial history ruined is likely literally that they haven't gotten to you yet. What incentives are there for Equifax, Experian, TransUnion, Innovis, etc who profit from this system existing to make it better? Who in the government will go after them, or even better, come up with something which will render them obsolete?

tokyodude 8y ago
And yet bring up any kind of negative incentive here on HN and you’ll br greeted with “that would stifle innovation” and “negative incentives will just make companies try to keep breaches secret” couldnt that logic be applied to all laws making bad behavior have negative consequences?
Someone1234 8y ago
They profit from this system and also profit from breaches. All of them have been making money hand over fist on this, thanks to their exclusive ability to monitor and lock/unlock their own credit reports. Even if you aren't paying these companies directly, you're paying a company paying them for credit reporting to watch for identity theft. Calling it a perverse incentive is an understatement. Only the US Government could have stepped in and made it unprofitable, but it appears as there will be no significant punishment for Equifax, and instead as a result of this the Congress made it harder to file a Class Action Lawsuit against companies like Equifax, so the next time you won't even have that option...
- ams6110 8y ago
  Some states by law require that there be no charge for credit report locking/unlocking.

lotsofpulp 8y ago

Could require everyone to send a picture of themselves with a hand written note with date and time and a thumbs up.

ljm 8y ago

There is a pretty elegant solution in Europe: you're given an ID card (as a foreigner I paid €28 euro to get one of these in favour of a paper-based equivalent containing just the personal number/tax ID, not sure how it works as a citizen). It's also the same with the Estonian e-residence (and naturally the normal one too). Most services use public key crypto and your ID card doubles up as the thing you use to cryptographically sign any documents that require proof of ID. You can do this yourself for many official documents with a generic smart card reader, and most places that would require ID in general (like your bank) will use that same system too. The nature of the system means that while there's still likely to be a list of personal/tax numbers lying around, they are not the secret and there isn't a central database of everybody's private keys out there. If the root cert is compromised it can be renewed and card holders can refresh their card through some system or another (where I lived I had to take it to an office for them to do it for me). I enjoyed using that in favour of the UK method of telling somebody where I lived for three years and where I was born, along with various other details, in order for them to become convinced of who I am. All I had to do in Europe was plug in my ID and that was enough proof. Of course, implementing such a scheme in the US and UK seems to be politically toxic for various reasons that can be summarised as paranoia (whether that's warranted or not), where the potential for the government to abuse it in myriad dystopian, conspiratorial ways is still far, far worse than what the corporate megaliths are doing with all of that information already, for profit, as if the natural state of government is to be less trustworthy than a corporation despite reality showing otherwise time and time again.