4 ms·

We already have a national ID. It is called social security, and it is bad at its job because it was explicitly not supposed to be a national ID when it was cre

We already have a national ID. It is called social security, and it is bad at its job because it was explicitly not supposed to be a national ID when it was created.

vxNsr 6y ago
Right ssn is part of the problem. It’s used as a national I’d despite being terrible for the job. I didn’t wanna make my comment too long, but I have a lot of issues w how SSN is used.
mjevans 6y ago
Alternately, every flipping service that demands you identify with a phone number (or billable credit card); which is being used as a proxy for an ID.
- Shared404 6y ago
  > demands you identify with a phone number... I recently found jmp.chat [0] which provides an easy workaround for this. [0] https://jmp.chat https://jmp.chat
  - techsupporter 6y ago
    The problem with jmp.chat and Google Voice and all of their kin (all of those "disposable number" or "second line" apps on the various app stores) is the numbers provided by them are SMS-capable VoIP numbers and a significant minority of businesses will flatly refuse to allow users to use that type of numbers. T-Mobile's DIGITS service was fantastic for this, at least for doing SMS with a number not attached to the SIM you have inserted in your phone, but they blocked almost all short-code senders when the service entered production. What I do these days is give banks and businesses a mobile number attached to the second SIM in my iPhone. That number is on a prepaid carrier under a completely different name and address than mine. There's the non-zero chance that someday I'll have to "prove" who I am to that prepaid carrier and won't be able to prove that name. The odds of that are a lot lower than the odds of having my main number snatched from my mobile carrier just by an attacker knowing the last four digits of my SSN and persuading a customer service rep to swap SIMs on the "strength" of knowing this information.
    - Shared404 6y ago
      > a significant minority of businesses will flatly refuse to allow users to use that type of numbers. How unfortunate to hear, I guess I've just gotten lucky so far.
greggyb 6y ago
I responded in more depth to a sibling[0]. SSNs are not valid for use in uniquely identifying individuals. If you try to use an SSN as a primary key for U.S. individuals you are in for a world of pain. [0] https://news.ycombinator.com/item?id=24104158 https://news.ycombinator.com/item?id=24104158
- jcrawfordor 6y ago
  You may notice, however, that this practice is extremely widespread throughout both the government and private industry. Yes, it is unsuitable for the purpose as parent says, but this is still the de facto purpose. Use of SSNs as identification is so ubiquitous in certain fields that when security concerns around SSNs became apparent in the '90s they were simply replaced with "pseudo-SSNs" which are randomly generated in the same format - which had already been the practice for individuals not possessing an SSN or in other exceptional situations.
  - hedora 6y ago
    SSNs aren’t unique, and were never intended to be.
    - jcrawfordor 6y ago
      I'm not arguing with that at all! I'm saying that the fact that they aren't hasn't actually stopped anyone from using them that way. When this assumption is violated, a psuedo-identifier is assigned. I have worked with multiple systems that work this way and it is the norm in finance and was the norm in higher education until relatively recently. State government information systems also use SSN as primary identifier surprisingly often, and in the system I've worked most closely with reused SSNs were resolved by just deleting the old record. You could say that SSNs are the perfect storm - they aren't unique, but they're pretty close to unique, and this allows you to rely on SSNs as an identifier for long enough that when you run into a problem you're too dug in and so you find a workaround. For example, assign non-citizens "SSNs" with prefixes not used by SSA---this was the norm in higher ed, and many institutions "eliminated" the use of SSNs by just handling all students as international. The IRS, of all organizations, uses SSN as a primary means of identifying individuals. They absolutely run into all kinds of problems with this that must be resolved by using other information as well but that doesn't stop them because it's just too convenient. Many such defects in use of SSNs are resolved by assigning an ITIN, which is just a pseudo-SSN with first digit '9' which is not in use by SSA. Even EINs have the same digit length as SSNs, suggesting that they're handled as SSNs by some systems. Or consider this similar situation: name and DOB are not unique, but this doesn't stop them being near universally used as primary identifier in healthcare information systems. Actually healthcare widely used SSN before HIPPA mandated a change.

We already have a national ID. It is called social security, and it is bad at its job because it was explicitly not supposed to be a national ID when it was created.

vxNsr 6y ago

Right ssn is part of the problem. It’s used as a national I’d despite being terrible for the job. I didn’t wanna make my comment too long, but I have a lot of issues w how SSN is used.

mjevans 6y ago

Alternately, every flipping service that demands you identify with a phone number (or billable credit card); which is being used as a proxy for an ID.

Shared404 6y ago
> demands you identify with a phone number... I recently found jmp.chat [0] which provides an easy workaround for this. [0] https://jmp.chat https://jmp.chat
- techsupporter 6y ago
  The problem with jmp.chat and Google Voice and all of their kin (all of those "disposable number" or "second line" apps on the various app stores) is the numbers provided by them are SMS-capable VoIP numbers and a significant minority of businesses will flatly refuse to allow users to use that type of numbers. T-Mobile's DIGITS service was fantastic for this, at least for doing SMS with a number not attached to the SIM you have inserted in your phone, but they blocked almost all short-code senders when the service entered production. What I do these days is give banks and businesses a mobile number attached to the second SIM in my iPhone. That number is on a prepaid carrier under a completely different name and address than mine. There's the non-zero chance that someday I'll have to "prove" who I am to that prepaid carrier and won't be able to prove that name. The odds of that are a lot lower than the odds of having my main number snatched from my mobile carrier just by an attacker knowing the last four digits of my SSN and persuading a customer service rep to swap SIMs on the "strength" of knowing this information.
  - Shared404 6y ago
    > a significant minority of businesses will flatly refuse to allow users to use that type of numbers. How unfortunate to hear, I guess I've just gotten lucky so far.

greggyb 6y ago

I responded in more depth to a sibling[0]. SSNs are not valid for use in uniquely identifying individuals. If you try to use an SSN as a primary key for U.S. individuals you are in for a world of pain. [0] https://news.ycombinator.com/item?id=24104158 https://news.ycombinator.com/item?id=24104158

jcrawfordor 6y ago
You may notice, however, that this practice is extremely widespread throughout both the government and private industry. Yes, it is unsuitable for the purpose as parent says, but this is still the de facto purpose. Use of SSNs as identification is so ubiquitous in certain fields that when security concerns around SSNs became apparent in the '90s they were simply replaced with "pseudo-SSNs" which are randomly generated in the same format - which had already been the practice for individuals not possessing an SSN or in other exceptional situations.
- hedora 6y ago
  SSNs aren’t unique, and were never intended to be.
  - jcrawfordor 6y ago
    I'm not arguing with that at all! I'm saying that the fact that they aren't hasn't actually stopped anyone from using them that way. When this assumption is violated, a psuedo-identifier is assigned. I have worked with multiple systems that work this way and it is the norm in finance and was the norm in higher education until relatively recently. State government information systems also use SSN as primary identifier surprisingly often, and in the system I've worked most closely with reused SSNs were resolved by just deleting the old record. You could say that SSNs are the perfect storm - they aren't unique, but they're pretty close to unique, and this allows you to rely on SSNs as an identifier for long enough that when you run into a problem you're too dug in and so you find a workaround. For example, assign non-citizens "SSNs" with prefixes not used by SSA---this was the norm in higher ed, and many institutions "eliminated" the use of SSNs by just handling all students as international. The IRS, of all organizations, uses SSN as a primary means of identifying individuals. They absolutely run into all kinds of problems with this that must be resolved by using other information as well but that doesn't stop them because it's just too convenient. Many such defects in use of SSNs are resolved by assigning an ITIN, which is just a pseudo-SSN with first digit '9' which is not in use by SSA. Even EINs have the same digit length as SSNs, suggesting that they're handled as SSNs by some systems. Or consider this similar situation: name and DOB are not unique, but this doesn't stop them being near universally used as primary identifier in healthcare information systems. Actually healthcare widely used SSN before HIPPA mandated a change.