4 ms·

On a fundamental level, it's absurd to use the same datum as a unique identifier and an identity proof. The best analogy I can think of is signing up for websit

On a fundamental level, it's absurd to use the same datum as a unique identifier and an identity proof. The best analogy I can think of is signing up for websites with only a password, and then having to provide that password as an identifier any time you need support. Oh, and the password is almost impossible to change, and you're required to use it to sign in on a host of other sites.

elliekelly 7y ago
I recently redeemed my Amtrak points for a free ticket and then needed to change the ticket which required a phone call. The gentleman on the phone asked me for my “points PIN” that was apparently required to change any Amtrak points reservations. I had never needed to change any points reservations before so I didn’t have one. Amtrak’s solution? I could set a PIN, right then and there, verbally with the agent over the phone. No logging into my account. No email or text message confirmation. They didn’t even ask to confirm my DoB or address. Nothing. I had only given him my reservation number. And not 30 seconds after creating my new PIN the same agent was then able to “verify” my identity/account by asking me... for my PIN.
- c1yd3i 7y ago
  Based Amtrak.
- newsreview1 7y ago
  ridiculous
- astura 7y ago
  Krebs wrote about this sort of problem with airline boarding passes back in 2015. https://krebsonsecurity.com/2015/10/whats-in-a-boarding-pass-barcode-a-lot/ https://krebsonsecurity.com/2015/10/whats-in-a-boarding-pass...
  - tumba 7y ago
    Internet Archive copy of the IATA publication on boarding pass barcodes referenced in the Krebs piece. https://web.archive.org/web/20120324074139/https://www.iata.org/whatwedo/stb/documents/bcbp_implementation_guidev4_jun2009.pdf https://web.archive.org/web/20120324074139/https://www.iata....
- ghaff 7y ago
  Though that also sort of illustrates some of tradeoffs involved. Historically, something like that might well have been handled by snail-mailing a default pin to the address on record for the account and telling you to call back after you received it. Of course, the problem is that a lot of people these days would think that was really poor customer service.
- lonelappde 7y ago
  You can do the same thing to steal anyone's Delta Inflight wifi account to use wifi credit they've paid for and not used on a flight, just by knowing their email address.
mehrdadn 7y ago
Having only a password is just fine for many sites. The real problem comes up when you have to show it as an identifier to a third party. If you don't ever need to do that, all you need is a password, not a username. (Auditability of login information within a company notwithstanding -- isn't really something a user can try to enforce, and it can happen in a variety of ways. As a user, at the end of the day, you trust the company with your credentials, and assume they secure internal access in some fashion.)
- mtlogstdo 7y ago
  Imagine all you have is a password, and I come along to register, attempting to set my password to "hunter2". Turns out someone else has already used this. Do you allow me to continue or tell me the password is already in use? If its in use - great, I'll just log in using that other guys account! Of course, you could let the site specify the password, which would work if they're long and random. But social security numbers are neither of those.
  - mehrdadn 7y ago
    Nobody said they should let you choose your own passwords. We were comparing with SSNs, which are assigned to you, not chosen by you. You'd do the same with such passwords. And nobody claimed SSNs are appropriate passwords either.
    - lonelappde 7y ago
      >And nobody claimed SSNs are appropriate passwords either. Except for the US government, and most banks, medical providers, and cell phone companies.
- Bartweiss 7y ago
  This is a good point - not all services need both identification and authentication. I've noticed some sites using identification only (like the days of IRC), so you can have a consistent identifier to interact with people but a username isn't actually secure or owned. The converse should also be possible, in the same sense that a bank PIN is used to authenticate with no public identifier involved. That said, for many offerings we should consider "a company employee" to be a third party. There are already employees with access to my data, but the outsourced call center employee who answers the customer service number probably isn't one of them, and I want them to be able to look up my account details without being able to impersonate me.

elliekelly 7y ago

I recently redeemed my Amtrak points for a free ticket and then needed to change the ticket which required a phone call. The gentleman on the phone asked me for my “points PIN” that was apparently required to change any Amtrak points reservations. I had never needed to change any points reservations before so I didn’t have one. Amtrak’s solution? I could set a PIN, right then and there, verbally with the agent over the phone. No logging into my account. No email or text message confirmation. They didn’t even ask to confirm my DoB or address. Nothing. I had only given him my reservation number. And not 30 seconds after creating my new PIN the same agent was then able to “verify” my identity/account by asking me... for my PIN.

c1yd3i 7y ago
Based Amtrak.
newsreview1 7y ago
ridiculous
astura 7y ago
Krebs wrote about this sort of problem with airline boarding passes back in 2015. https://krebsonsecurity.com/2015/10/whats-in-a-boarding-pass-barcode-a-lot/ https://krebsonsecurity.com/2015/10/whats-in-a-boarding-pass...
- tumba 7y ago
  Internet Archive copy of the IATA publication on boarding pass barcodes referenced in the Krebs piece. https://web.archive.org/web/20120324074139/https://www.iata.org/whatwedo/stb/documents/bcbp_implementation_guidev4_jun2009.pdf https://web.archive.org/web/20120324074139/https://www.iata....
ghaff 7y ago
Though that also sort of illustrates some of tradeoffs involved. Historically, something like that might well have been handled by snail-mailing a default pin to the address on record for the account and telling you to call back after you received it. Of course, the problem is that a lot of people these days would think that was really poor customer service.
lonelappde 7y ago
You can do the same thing to steal anyone's Delta Inflight wifi account to use wifi credit they've paid for and not used on a flight, just by knowing their email address.

mehrdadn 7y ago

Having only a password is just fine for many sites. The real problem comes up when you have to show it as an identifier to a third party. If you don't ever need to do that, all you need is a password, not a username. (Auditability of login information within a company notwithstanding -- isn't really something a user can try to enforce, and it can happen in a variety of ways. As a user, at the end of the day, you trust the company with your credentials, and assume they secure internal access in some fashion.)

mtlogstdo 7y ago
Imagine all you have is a password, and I come along to register, attempting to set my password to "hunter2". Turns out someone else has already used this. Do you allow me to continue or tell me the password is already in use? If its in use - great, I'll just log in using that other guys account! Of course, you could let the site specify the password, which would work if they're long and random. But social security numbers are neither of those.
- mehrdadn 7y ago
  Nobody said they should let you choose your own passwords. We were comparing with SSNs, which are assigned to you, not chosen by you. You'd do the same with such passwords. And nobody claimed SSNs are appropriate passwords either.
  - lonelappde 7y ago
    >And nobody claimed SSNs are appropriate passwords either. Except for the US government, and most banks, medical providers, and cell phone companies.
Bartweiss 7y ago
This is a good point - not all services need both identification and authentication. I've noticed some sites using identification only (like the days of IRC), so you can have a consistent identifier to interact with people but a username isn't actually secure or owned. The converse should also be possible, in the same sense that a bank PIN is used to authenticate with no public identifier involved. That said, for many offerings we should consider "a company employee" to be a third party. There are already employees with access to my data, but the outsourced call center employee who answers the customer service number probably isn't one of them, and I want them to be able to look up my account details without being able to impersonate me.