3 ms·

Social security isn't a piece of technology, it's a government program. How is it in any way like VHS?

dragontamer 8y ago
Whatever will replace SSNs will be a piece of technology. Ideally, something that uses public/private key encryption. There's a lot of things that use public/private keys however, or security tokens, or whatnot. Should it be a smartphone app? A hardware dongle? Etc. etc. If a hardware dongle, which one? As such, its the Executive Branch's job to research the various technologies, and implement a new standard to solve the online identity problem. ---------- For example, 18f (White House's crack website team) has the following: https://login.gov/ https://login.gov/ Github code here: https://github.com/18F/identity-idp https://github.com/18F/identity-idp If single-sign on were widely deployed across US Agencies (and tied to financial services / private sector banks), we'd be in a way better place. In any case, this is clearly the realm of the Executive Branch. Specifically 18f probably should continue to lead the effort, as they have been.
- freehunter 8y ago
  All Congress has to do is pass a law saying "private companies are not allowed to store SSNs" and let those private companies figure out what the replacement is. Congress doesn't need to legislate the replacement technology.
  - dragontamer 8y ago
    That fundamentally misunderstands the problem. SSNs are fine and useful. They just shouldn't be the "password" to financial systems. When every damn bank uses "Whats your pin and SSN" to gain access to an account... that's the problem. The issue is that private companies use SSNs for security. There's nothing wrong in using SSNs as an identifier. The USA needs to start assuming that SSNs are public information, and to build security through other means. SSNs were never a secret number to be used for authentication / authorization purposes.
    - tialaramex 8y ago
      > There's nothing wrong in using SSNs as an identifier. There's plenty wrong with this. SSNs were already a pretty bad identifier when they were invented and didn't get better. There's no check digit, so if you make any mistake at all it's probably a different person's valid SSN. Until relatively recently they were assigned both chronologically and geographically, so one digit error in SSN plus Address plus date of birth... Causes no red flags, it looks about right. Modern ones are randomly assigned, but it'll be decades before that's most people. Like most similar systems the US SSN also very explicitly says it isn't suitable for any purpose except numbering Social Security recipients. People you want numbers for may or may not have SSNs. Don't worry though, since they all look pretty similar and there's no check digit the people who don't have one long learned to give a bogus SSN, probably belonging to somebody else. Somebody you know probably does this today. What a useful "identifier".
      - dragontamer 8y ago
        What you say is true, but is entirely tangential to the topic of Equifax breaches. > Don't worry though, since they all look pretty similar and there's no check digit the people who don't have one long learned to give a bogus SSN, probably belonging to somebody else. Its trivial to use US Government sources to do a name-check on the SSN, to ensure that you've got the right person. https://www.ssa.gov/employer/ssnv.htm https://www.ssa.gov/employer/ssnv.htm https://www.ssa.gov/cbsv/ https://www.ssa.gov/cbsv/ The latter costs money, but not much money in terms of doing business. --------- The fact remains: People use SSNs because the Social Security Administration is very good about keeping SSNs in order. Perhaps the number could be designed a bit better, but the system has been in use since the 1930s and there's no better number to use in the USA in most cases.

Whatever will replace SSNs will be a piece of technology. Ideally, something that uses public/private key encryption. There's a lot of things that use public/private keys however, or security tokens, or whatnot. Should it be a smartphone app? A hardware dongle? Etc. etc. If a hardware dongle, which one? As such, its the Executive Branch's job to research the various technologies, and implement a new standard to solve the online identity problem. ---------- For example, 18f (White House's crack website team) has the following: https://login.gov/ https://login.gov/ Github code here: https://github.com/18F/identity-idp https://github.com/18F/identity-idp If single-sign on were widely deployed across US Agencies (and tied to financial services / private sector banks), we'd be in a way better place. In any case, this is clearly the realm of the Executive Branch. Specifically 18f probably should continue to lead the effort, as they have been.

freehunter 8y ago
All Congress has to do is pass a law saying "private companies are not allowed to store SSNs" and let those private companies figure out what the replacement is. Congress doesn't need to legislate the replacement technology.
- dragontamer 8y ago
  That fundamentally misunderstands the problem. SSNs are fine and useful. They just shouldn't be the "password" to financial systems. When every damn bank uses "Whats your pin and SSN" to gain access to an account... that's the problem. The issue is that private companies use SSNs for security. There's nothing wrong in using SSNs as an identifier. The USA needs to start assuming that SSNs are public information, and to build security through other means. SSNs were never a secret number to be used for authentication / authorization purposes.
  - tialaramex 8y ago
    > There's nothing wrong in using SSNs as an identifier. There's plenty wrong with this. SSNs were already a pretty bad identifier when they were invented and didn't get better. There's no check digit, so if you make any mistake at all it's probably a different person's valid SSN. Until relatively recently they were assigned both chronologically and geographically, so one digit error in SSN plus Address plus date of birth... Causes no red flags, it looks about right. Modern ones are randomly assigned, but it'll be decades before that's most people. Like most similar systems the US SSN also very explicitly says it isn't suitable for any purpose except numbering Social Security recipients. People you want numbers for may or may not have SSNs. Don't worry though, since they all look pretty similar and there's no check digit the people who don't have one long learned to give a bogus SSN, probably belonging to somebody else. Somebody you know probably does this today. What a useful "identifier".
    - dragontamer 8y ago
      What you say is true, but is entirely tangential to the topic of Equifax breaches. > Don't worry though, since they all look pretty similar and there's no check digit the people who don't have one long learned to give a bogus SSN, probably belonging to somebody else. Its trivial to use US Government sources to do a name-check on the SSN, to ensure that you've got the right person. https://www.ssa.gov/employer/ssnv.htm https://www.ssa.gov/employer/ssnv.htm https://www.ssa.gov/cbsv/ https://www.ssa.gov/cbsv/ The latter costs money, but not much money in terms of doing business. --------- The fact remains: People use SSNs because the Social Security Administration is very good about keeping SSNs in order. Perhaps the number could be designed a bit better, but the system has been in use since the 1930s and there's no better number to use in the USA in most cases.