5 ms·

You do need the SSN to match up with the name and other personal information like age, gender, address, etc. In that way, it's a bit like authenticating with a

You do need the SSN to match up with the name and other personal information like age, gender, address, etc. In that way, it's a bit like authenticating with a common username and a password that is publicly available with the username obfuscated (except in the case of data leaks).

toomuchtodo 7y ago
Instead of a unique ID like a SSN, we should be using an identity provider to support such use cases. Imagine instead that you would authenticate with https://login.gov https://login.gov (ideally with your credentials and a hardware 2FA device), which would then attest to whatever service you were logging in to that you are you. You can't rotate a social security number with reasonable effort, and we can longer treat it as a secret, because it isn't one. It's time to move past it as an identifier.
- wnoise 7y ago
  It was, of course, never intended to be used as an authenticator, nor a secret in any way.
- nybble41 7y ago
  Now imagine that for whatever reason you suddenly become persona non grata, and https://login.gov/ https://login.gov/ refuses to attest that you are you to any of the services you have come to depend on. Or just imagine https://login.gov/ https://login.gov/ passively collecting information about all the services you're logging into. I wouldn't be opposed to common login protocol—preferably a distributed or federated one—where the government and other parties can add their own signatures to attest that a particular identity belongs to a certain real-world person, and you can choose which of those signatures you present to any given service. However, having the login itself go through a government server would be an incredibly bad idea.
  - toomuchtodo 7y ago
    We're already at that point (driver's licenses, passports) and it hasn't happened yet. Yes, you can get blacklisted by the TSA for air transport, but they have an exception process for that (redress control number). Proper functioning of democracy and government requires eternal vigilance (apologies to Jefferson).
    - nybble41 7y ago
      You don't need your driver's license or passport to log in to your e-mail or Facebook account and communicate with your friends, or to buy groceries. Revoking your driver's license and passport affects your ability to travel long distances and not much else, at least in the short term. It's bad enough that you need a current government ID for domestic flights; we don't need to make it mandatory for everything. > Proper functioning of democracy and government requires eternal vigilance Indeed, and part of that vigilance is pushing back against government involvement in areas they have no business in, such as authentication for non-government services.
      - fastball 7y ago
        Nobody is proposing a system where you need to authenticate with some national ID in order to do any of the things you mentioned. We are talking about having better authentication (both more privacy-aware and more flexible) for situations where it's needed. You don't need to validate your identity for email, facebook, or groceries, so obviously this wouldn't apply there. This would apply to things where some ID auth is already taking place (e.g. anything that asks for your SSN, KYC processes in general, etc).

toomuchtodo 7y ago

Instead of a unique ID like a SSN, we should be using an identity provider to support such use cases. Imagine instead that you would authenticate with https://login.gov https://login.gov (ideally with your credentials and a hardware 2FA device), which would then attest to whatever service you were logging in to that you are you. You can't rotate a social security number with reasonable effort, and we can longer treat it as a secret, because it isn't one. It's time to move past it as an identifier.

wnoise 7y ago
It was, of course, never intended to be used as an authenticator, nor a secret in any way.
nybble41 7y ago
Now imagine that for whatever reason you suddenly become persona non grata, and https://login.gov/ https://login.gov/ refuses to attest that you are you to any of the services you have come to depend on. Or just imagine https://login.gov/ https://login.gov/ passively collecting information about all the services you're logging into. I wouldn't be opposed to common login protocol—preferably a distributed or federated one—where the government and other parties can add their own signatures to attest that a particular identity belongs to a certain real-world person, and you can choose which of those signatures you present to any given service. However, having the login itself go through a government server would be an incredibly bad idea.
- toomuchtodo 7y ago
  We're already at that point (driver's licenses, passports) and it hasn't happened yet. Yes, you can get blacklisted by the TSA for air transport, but they have an exception process for that (redress control number). Proper functioning of democracy and government requires eternal vigilance (apologies to Jefferson).
  - nybble41 7y ago
    You don't need your driver's license or passport to log in to your e-mail or Facebook account and communicate with your friends, or to buy groceries. Revoking your driver's license and passport affects your ability to travel long distances and not much else, at least in the short term. It's bad enough that you need a current government ID for domestic flights; we don't need to make it mandatory for everything. > Proper functioning of democracy and government requires eternal vigilance Indeed, and part of that vigilance is pushing back against government involvement in areas they have no business in, such as authentication for non-government services.
    - fastball 7y ago
      Nobody is proposing a system where you need to authenticate with some national ID in order to do any of the things you mentioned. We are talking about having better authentication (both more privacy-aware and more flexible) for situations where it's needed. You don't need to validate your identity for email, facebook, or groceries, so obviously this wouldn't apply there. This would apply to things where some ID auth is already taking place (e.g. anything that asks for your SSN, KYC processes in general, etc).