3 ms·

> "national ID with a cryptographic token" means that OpenID / Paypal-based single-sign on logins are illegal. Why? Why doesn't it just mean that there's a can

• dragontamer 8y ago
  PayPal touches your SSN, as it is tied to your bank account. (Bank accounts require a "Individual Taxpayer Identification Number", which is the SSN for any citizen. Non-citizens get a different ID, but really its the TIN that is the cause of all of these security issues). So yes, really, the proposed wording would probably make Paypal illegal. You have a point on OpenID, but my overall point is that OpenID would probably be sufficient for most financial transactions on today's internet. OpenID is basically equivalent to Paypal's security model. Neither Paypal nor OpenID require 2-factor or security tokens. I think they're an optional feature. But in any case, the Paypal / OpenID model of identification (Paypal controlled website verifies password, and sends a token to the 3rd party website) would be sufficient for today's security. ---------------- Of course, none of this even touches upon Equifax. Equifax uses SSNs to identify people, and often without their knowledge or consent. Equifax is a service to the financial industry, to help keep tabs on individual's history. So the Paypal model will NOT work with Equifax's use case, because the individuals don't always know when they are being tracked. Maybe it'd have to be something to OAuth's model. In any case, I'm not an expert either. I just appreciate the difficulty of this problem.