14 ms·
Is anyone surprised that assigning numbers to people to identify them seems to backfire every time it's tried?
by sneakernets 8y ago
Is anyone surprised that assigning numbers to people to identify them seems to backfire every time it's tried?
- ngneer 8y agoNumbers have to be assigned in order to break the symmetry. Otherwise how would you tell humans apart?
- politician 8y agoCoarsely, the reason for the need to tell humans apart is to assign debts.
- pkaye 8y agoWould you be fine having your medical history mixed with someone else with the same name?
- drewmol 8y agoYes, I would even be willing to pay a small fee for this. (not the op)
- politician 8y ago(op here) The premise of the grandparent is an illusion that depends on the idea that somehow a medical provider (which one?) is a better caretaker for your medical history than you are. In the cases where that is actually true, power of attorney is the real solution -- not EMR records hosted offsite by 3rd party vendors in 3rd world countries on behalf of one or more hospitals. How absurd. My medical history is mine; it's ultimately not yours. If you need my medical history, allow me to give you limited access to it. Now, if your billing is opaque and you're playing shenanigans with the insurance companies about who owes what, then sure, you need my Passport, SSN, DNA, Real ID, and biometrics -- and you should probably hold my medical history hostage too -- to make sure that you can collect on the debt.
- mulmen 8y agoHuh? What about my Safeway card that tracks my shopping habits? Or my phone number that allows anyone in the world to contact me? Or my address that identifies a physical location to send me things. Or membership numbers in clubs? Or the example from TFA: passports. How would any of those be feasible with coarse mapping of ID to human?
- Spooky23 8y agoWhy do you need an externally defined unique ID? If I tell you that i am Spooky23, 123 Main St, anytown, AK, spooky23@example.com, what more uniqueness do you need? Hoarding passport numbers, drivers licenses, ssn, etc usually doesn’t serve a legitimate purpose. When it is required to meet compliance or other requirements (say an payroll processor who needs an SSN to withhold taxes), it needs to be protected and have access controls. Marriott does not have any need to authoritatively know who I am beyond payment arrangements. I'm not borrowing money from Marriott, so they don't need my SSN. They may need my passport when I check into an international hotel to meet compliance requirements, but they don't need to store it in a reservation system, and don't need to store it beyond the international jurisdiction where I checked in.
- ngneer 8y agoSpooky23 seems to be implicitly relying on uniqueness that is leveraged by the underlying message routing system. With the case of "123 Main St, anytown, AK" there is an implicit assumption that no one else lives at that address. With the case of "spooky23@example.com" there is an implicit assumption that the mailbox is not shared. Hoarding numbers serves the very purpose of ensuring a unique assignment. For instance, if "the" department of transportation did not have a "global" database, then it would risk minting the same number twice. That having been said, it is true that knowledge of a "master" identity is not a requirement for making payment arrangements.
- Spooky23 8y agoWhat’s the anticipated trust level? For most commerce, I need to be able to tell that you are the same “Spooky23” who was here last time. If you need to positively and authoritatively identify me, collecting numbers is not sufficient. End of the day, these companies are either overcollecting for convenience or doing a poor job of collecting information for compliance purposes.
- ngneer 8y agoCapitalism is involved for sure, but "debt" seems harsh. How about "resource allocation"?
- cal5k 8y agoRight, but it's like using a private key as an identifier. As soon as it's compromised you need to get a whole new ID. I'd rather see something like Bitcoin's HD wallets used for identification - your private keys are on a hardware device, but you can generate new "personal identifiers" for use with public services that, if compromised, could be burned through a central registry without requiring a replacement of the private keys.
- solarkraft 8y agoThis is good, but it'll take a while to catch on. I can well imagine everyone receiving a hardware key generator for personal identification purposes. Some id cards already have something similar and it shouldn't be all too expensive.
- ngneer 8y agoAssuming a fair bidding process...
- njarboe 8y agoThe only real problem with most of these "identity theft" problems are that lenders are not punished/fined when they lie to credit bureaus and say you borrowed some money instead of someone who has impersonated you. Prevent the banks/loan makers from libeling you and this information leaking is not that much of a big deal. Banks might not like it, but the populous would definitely support it.
- drewmol 8y agoTo further your suggestion, start referring to "identity theft" as fraud. Banks/loan makers don't just libel you, they further the initial crime and commit fraud every time they transfer/sell/bundle the fraudulent debt.
- njarboe 8y agoThere needs to be a specific phrase to replace the phrase "identity theft". I think the phrase "bank libel" could work as it is not a phrase currently used very often. Unfortunately "bank fraud" is a common occurrence, so not a great name for this specific type of bank fraud.
- NedIsakoff 8y agoThe Chinese 居民身份证 works well for its intended purposes and has not back fired.
- Wohlf 8y agoThere is no other way to establish identity beyond a limited social circle besides a unique address or number.
- Balgair 8y agoThat's ... incredibly interesting. I can't figure out a counterpoint to this. You are correct, 'identity' is not all that easy to verify outside of a small group. I think there are larger implications about human nature here than just trying to o-auth a user.
- test6554 8y agoThe government should issue a public/private key to every citizen/resident and provide a verification service that companies can use to verify a citizen's identity without the citizen having to hand over any secret information. They could even optionally store one or more profiles that you could use for streamlining your interactions with various private industries: financial services, health care, employment, shopping, and travel could all have separate datasets about you stored for convenience. Then when you want to do business with a company, you grant them access to the appropriate profile. When you conclude your business, you revoke access. The same would be great for phone and email networks. Basically instead of giving someone your contact info, you give them a voucher to contact you. They call or email to the service and include the voucher (all automated) and the service either forwards it along or ignores it based on whether the voucher is valid. And you can invalidate any voucher at any time for any reason. For people that like things simple, they could use a single voucher for everything, but for people who want more control they could do separate vouchers for everyone, or some easier middle-ground like family, friends, professional, commercial, and misc.
- sbarre 8y agoYeah until the government database gets compromised and all the private keys get leaked.
- user5994461 8y agoThey couldn't be leaked, they would be in the hands of the people. The government only needs a public key.
- colejohnson66 8y agoThen when the user inevitable loses their private key? Not everyone is tech savvy enough.
- BenjiWiebe 8y agoThen use an annoying lengthy in person procedure to issue a new one.
- lawlorino 8y agoWhat alternative would you propose?
- briffle 8y agoThere is no problem with assigning people a number. the problem is that people start using that number as Verification, not as an identifier. People treat your SSN as a password, when really, it just uniquely identifies you. Its basically an Email Address, not a password.
- reaperducer 8y agoit just uniquely identifies you Try working face-to-face in communities of recent, poor immigrants where five, six, even ten people using the same (likely purchased) SSN is not unusual. I've seen entire families using the same SSN.
- alkonaut 8y agoDon’t use any service that considers SSN a verification.
- lotsofpulp 8y agoFunctionally useless advice if you ever have to deal with mobile networks, internet service providers, financial institutions, utilities' providers, any government, schools, universities, and the list goes on.
- alkonaut 8y agoThose services take the SSN as proof of identity and not just identity? Wouldn’t most people’s SSN’s be leaked already so using SSN rather than proper ID isn’t much better than nothing?
- lotsofpulp 8y agoYes, when you call customer service you’re usually asked to provide your SSN to verify you are who you are. Some are finally requiring a PIN or passcode, but very few in my experience.
- 8y ago
- alkonaut 8y agoThat’s not a problem so long as the number is a non-secret identity rather than a secret used to verify identity. A social security number (or any such personal identification number in any country) is only an identifier and not secret. It’s like an email address, not like a password. A leak of lots of non-secret data (eg email addresses) is an integrity problem not a security problem. A leak of passwords or other secret data is s security issue.