5 ms·

Indeed, here in the UK we have the very similar "National Insurance Number" for tax reasons but it's never used for identification as it's assumed to be public

Indeed, here in the UK we have the very similar "National Insurance Number" for tax reasons but it's never used for identification as it's assumed to be public knowledge.

sokoloff 7y ago
There are multiple meanings of the word identification. SSN and NIN could reasonably be used for identification of the form of "this person's data is different from that person's data". (identification as in primary/unique key) They can't/shouldn't be used for authentication that this person is who they claim to be. (identification as in password)
- SmellyGeekBoy 7y ago
  > They can't/shouldn't be used for authentication that this person is who they claim to be. 100% agreed, perhaps I should have worded my comment better. My point was that this seems to be common practice in the US but not over here.
- TheSoftwareGuy 7y ago
  You're absolutely right. SSN's were only ever meant to be used for identification (as in a username). In the beginning the worst that could happen is that someone else would file their payroll taxes with your SSN, and make you eligible for more Social Security benefits when you retired. It was never meant to be a password.
  - lonelappde 7y ago
    How would you receive benefits if not by using SSN as a password? Or to get a job when you may not have authorization to do so (noncitizen not on a worker visa)
    - sokoloff 7y ago
      You use the SSN (acting as the username [which links to authority to work or claim benefits]) combined with another piece of information that establishes your identity (acting as the password to establish that it's really you and not me who is applying). For employment, the I-9 form is what we fill out as authorized US workers and to document same. https://www.uscis.gov/i-9 https://www.uscis.gov/i-9 (the "paper version" link works best) You'll note that Social Security card is in List C "documents that establish employment authorization" and not in List B "documents that establish identity" nor in List A "documents that establish both identity and employment authorization" I guess you can look at it as a form of off-line multi-factor authentication. You are using the Social Security card as proof of eligibility for the person whose identity you have already established using another factor. In that case, it's the card that acts as the factor, not the number (which if you've ever seen a social security card, it's ridiculous to think that it's in any way secure or even durable).

Indeed, here in the UK we have the very similar "National Insurance Number" for tax reasons but it's never used for identification as it's assumed to be public knowledge.

sokoloff 7y ago

There are multiple meanings of the word identification. SSN and NIN could reasonably be used for identification of the form of "this person's data is different from that person's data". (identification as in primary/unique key) They can't/shouldn't be used for authentication that this person is who they claim to be. (identification as in password)

SmellyGeekBoy 7y ago
> They can't/shouldn't be used for authentication that this person is who they claim to be. 100% agreed, perhaps I should have worded my comment better. My point was that this seems to be common practice in the US but not over here.
TheSoftwareGuy 7y ago
You're absolutely right. SSN's were only ever meant to be used for identification (as in a username). In the beginning the worst that could happen is that someone else would file their payroll taxes with your SSN, and make you eligible for more Social Security benefits when you retired. It was never meant to be a password.
- lonelappde 7y ago
  How would you receive benefits if not by using SSN as a password? Or to get a job when you may not have authorization to do so (noncitizen not on a worker visa)
  - sokoloff 7y ago
    You use the SSN (acting as the username [which links to authority to work or claim benefits]) combined with another piece of information that establishes your identity (acting as the password to establish that it's really you and not me who is applying). For employment, the I-9 form is what we fill out as authorized US workers and to document same. https://www.uscis.gov/i-9 https://www.uscis.gov/i-9 (the "paper version" link works best) You'll note that Social Security card is in List C "documents that establish employment authorization" and not in List B "documents that establish identity" nor in List A "documents that establish both identity and employment authorization" I guess you can look at it as a form of off-line multi-factor authentication. You are using the Social Security card as proof of eligibility for the person whose identity you have already established using another factor. In that case, it's the card that acts as the factor, not the number (which if you've ever seen a social security card, it's ridiculous to think that it's in any way secure or even durable).