4 ms·

At least the US, and probably other countries as well, have the issue of no reliable means of /authentication/. I feel like this won't be solved until a proper

At least the US, and probably other countries as well, have the issue of no reliable means of /authentication/. I feel like this won't be solved until a proper national ID replaces the thing that __everyone__ is forced to use as one even though it isn't supposed to be; 'social security' numbers. That method would need to be secure, reliable, and traceable. All contracts / inquiries that require use of the identity signature would also need to register that use; ideally the government would run an observation oracle that mirrors the publicly published signatures each agency hosts on their own (which would be a defacto place to check for use/abuse of the signatures). This would also oblivate the need for services like equifax to exist at all.

spydum 8y ago
Agree, too often we are using drivers licenses #s (which btw, are public record often), address, phone numbers, and worst case SSNs and foolish "security questions" in the US for identity. None of these are appropriate authenticators of a person, and almost all of this data has been leaked in the past. I think if there is anyone who is well suited to tackle this, it's.. banks. There are so many bank locations, most people have an existing relationship with a local bank. If we allow tellers in banks responsible for verifying identity of people (the same way a social security office or DMV office verifies a person: birth certs and records checking), they could be be paid to be the hands and feet of something like national ID system.
AnssiH 8y ago
I think the availability of digital authentication methods significantly varies by country. E.g. here in Finland TUPAS (https://en.wikipedia.org/wiki/TUPAS https://en.wikipedia.org/wiki/TUPAS) is used by both government sites and private companies. It relies on two-factor bank credentials that almost everyone here has. Two-factor has been standard since online banking became a thing in the 90s and all banks are part of the ~10 bank groups so there aren't any small unsupported banks that I'm aware of. Government sites also support ID cards but no-one uses that option. I believe some other countries have working, but different, digital authentication schemes as well. Maybe Estonia and Belgium? These don't work over the phone, though, and asking for address and your identity code (or some part thereof) remains a common over-the-phone "verification" method, at least here. So the identity code / social security number issue still exists, at least to some extent.
tonysdg 8y ago
> That method would need to be secure, reliable, and traceable. And that's why it will never happen. This is one of my biggest complaints about the Hacker News community: so many of us are engineers who see a problem and immediately think "here's a solution, technical or otherwise." We can't "solve" humanity -- it's pure hubris to think otherwise. Any national ID will run the same risks the befall SSNs, passports, licenses, passwords, or any other form of identification. Which, simply put, is that the weakest link is always the person behind them. All it takes is one screw-up -- your passport falls out of your bag on a busy street, a thief breaks into your home and steals the safe with your SSN card inside, someone accidentally makes a list of password hashes public -- and the "secure, reliable, traceable" goes out the window. I don't have a solution. But I think those of us who are engineers owe it to the general public to stop kidding ourselves into thinking we can come up with "solutions" -- technical or otherwise -- that aren't (1) flawed in some other fashion, (2) unacceptable due to societal norms, or (3) require the elimination of personal freedoms and liberties that at least we in the U.S./Canada/Europe seem to enjoy.
- iokanuon 8y ago
  In my opinion there is a much better solution. My European id card including its number used for authentication is valid for 10 years, and I can report is as lost or stolen. The same technique is already in use for debit and credit cards across the globe. Why not use it for identification in the United States?
- sydd 8y ago
  Yeah, but you can make it hard to fake someones identity. In the US you just need some Google skills and their SSN number. In the EU you need to fake a plastic card that has your photo, has holograms and whatnot. If its lost I get a new one with anew number. For anything serious like opening a back account, applying for credit you need to show this card in person. This is why identity theft crimes are more than 10 times higher in the US.
- mjevans 8y ago
  The weak link you present is actually one of the reasons use HAS to be public record. Making it public record also implies that there's a Cert Revocation List check (during the submit to the central monitor(s) oracles) and also gives everyone the ability to monitor those lists FOR unauthorized use they aren't yet aware of.
adrianmonk 8y ago
I'm not following how authentication obviates the need for record-keeping. Credit reporting agencies are basically a data warehouse for financial event history. If such a thing didn't exist in some form, how would a lender check whether you made previous payments on time? They can't contact every possible creditor that you could have interacted with. Maybe a better architecture is possible than storing all the data centrally and creating a massive single point of failure, though.
- Eridrus 8y ago
  A super common complaint about Equifax is that everyone's SSNs were stolen, which puts people at risk of identity theft. With a national ID scheme where authentication is not based on knowing what is essentially a primary key, this concern would go away. This would do nothing about any other data, but to draw a parallel to merchant breaches, we mostly see stolen credit cards as a nuisance and a matter for the banks to deal with, rather than something we really worry about.
- luhn 8y ago
  The problem is that SSNs are used for both identity and authentication. It’s as if your login was just a username, no password. Equifax et al only need to know your “username” and still allow for credit checks. But since all we have is SSN, Equifax has your “password” as well, turning a data breach from a theft of private data into a wide open avenue for identity theft.

spydum 8y ago

Agree, too often we are using drivers licenses #s (which btw, are public record often), address, phone numbers, and worst case SSNs and foolish "security questions" in the US for identity. None of these are appropriate authenticators of a person, and almost all of this data has been leaked in the past. I think if there is anyone who is well suited to tackle this, it's.. banks. There are so many bank locations, most people have an existing relationship with a local bank. If we allow tellers in banks responsible for verifying identity of people (the same way a social security office or DMV office verifies a person: birth certs and records checking), they could be be paid to be the hands and feet of something like national ID system.

AnssiH 8y ago

I think the availability of digital authentication methods significantly varies by country. E.g. here in Finland TUPAS (https://en.wikipedia.org/wiki/TUPAS https://en.wikipedia.org/wiki/TUPAS) is used by both government sites and private companies. It relies on two-factor bank credentials that almost everyone here has. Two-factor has been standard since online banking became a thing in the 90s and all banks are part of the ~10 bank groups so there aren't any small unsupported banks that I'm aware of. Government sites also support ID cards but no-one uses that option. I believe some other countries have working, but different, digital authentication schemes as well. Maybe Estonia and Belgium? These don't work over the phone, though, and asking for address and your identity code (or some part thereof) remains a common over-the-phone "verification" method, at least here. So the identity code / social security number issue still exists, at least to some extent.

tonysdg 8y ago

> That method would need to be secure, reliable, and traceable. And that's why it will never happen. This is one of my biggest complaints about the Hacker News community: so many of us are engineers who see a problem and immediately think "here's a solution, technical or otherwise." We can't "solve" humanity -- it's pure hubris to think otherwise. Any national ID will run the same risks the befall SSNs, passports, licenses, passwords, or any other form of identification. Which, simply put, is that the weakest link is always the person behind them. All it takes is one screw-up -- your passport falls out of your bag on a busy street, a thief breaks into your home and steals the safe with your SSN card inside, someone accidentally makes a list of password hashes public -- and the "secure, reliable, traceable" goes out the window. I don't have a solution. But I think those of us who are engineers owe it to the general public to stop kidding ourselves into thinking we can come up with "solutions" -- technical or otherwise -- that aren't (1) flawed in some other fashion, (2) unacceptable due to societal norms, or (3) require the elimination of personal freedoms and liberties that at least we in the U.S./Canada/Europe seem to enjoy.

iokanuon 8y ago
In my opinion there is a much better solution. My European id card including its number used for authentication is valid for 10 years, and I can report is as lost or stolen. The same technique is already in use for debit and credit cards across the globe. Why not use it for identification in the United States?
sydd 8y ago
Yeah, but you can make it hard to fake someones identity. In the US you just need some Google skills and their SSN number. In the EU you need to fake a plastic card that has your photo, has holograms and whatnot. If its lost I get a new one with anew number. For anything serious like opening a back account, applying for credit you need to show this card in person. This is why identity theft crimes are more than 10 times higher in the US.
mjevans 8y ago
The weak link you present is actually one of the reasons use HAS to be public record. Making it public record also implies that there's a Cert Revocation List check (during the submit to the central monitor(s) oracles) and also gives everyone the ability to monitor those lists FOR unauthorized use they aren't yet aware of.

adrianmonk 8y ago

I'm not following how authentication obviates the need for record-keeping. Credit reporting agencies are basically a data warehouse for financial event history. If such a thing didn't exist in some form, how would a lender check whether you made previous payments on time? They can't contact every possible creditor that you could have interacted with. Maybe a better architecture is possible than storing all the data centrally and creating a massive single point of failure, though.

Eridrus 8y ago
A super common complaint about Equifax is that everyone's SSNs were stolen, which puts people at risk of identity theft. With a national ID scheme where authentication is not based on knowing what is essentially a primary key, this concern would go away. This would do nothing about any other data, but to draw a parallel to merchant breaches, we mostly see stolen credit cards as a nuisance and a matter for the banks to deal with, rather than something we really worry about.
luhn 8y ago
The problem is that SSNs are used for both identity and authentication. It’s as if your login was just a username, no password. Equifax et al only need to know your “username” and still allow for credit checks. But since all we have is SSN, Equifax has your “password” as well, turning a data breach from a theft of private data into a wide open avenue for identity theft.