8 ms·

Names and Identities Change – You Should Design for That

48 points by philk10 6y ago

HenryKissinger 6y ago
I've been considering a name change in the last few years. My last name, specifically. The hard part won't be to have my name changed legally, but rather to change my name with all the organizations I belong to. My bank, my professional society, my employer, etc.
ChrisSD 6y ago
Names as identifiers are an archaic throwback at this point. Every person on the planet should have a unique GUID assigned to them. This can then be used to refer to them independent of their preferred identity. Names are for friends, not companies.
- sumtechguy 6y ago
  That is basically a 'super SSN'. With the same sort of issues that SSN has. It is a decent idea but even that you should be able to change if needed. Remember there are nefarious players out there.
  - deleted 6y ago
    [deleted]
  - jsty 6y ago
    > With the same sort of issues that SSN has Only if knowledge of one's "GUID" was regarded as sufficient to authenticate as them surely?
    - shadowfox 6y ago
      I mean it can also be used as a universal, semi-permenant activity tracking id with almost no work, which may not be desirable depending on your feelings wrt privacy. Maybe an ability to generate virtual IDs based on a permanent id (like with virtual credit cards) might help though this is sometimes tricky to use correctly in a privacy-preserving way.
  - nojokes 6y ago
    SSN has only issues when it is used as password. Many other national id's are not used like that and do not have any issues.
    - sumtechguy 6y ago
      That assumes all players will use the number correctly. SSN is an example where that did not happen and is used as an authentication and authorization token at the same time.
      - nojokes 6y ago
        That is true and it requires some educating by the state. Not possible when the state is using it wrong.
        sumtechguy 6y ago
        Education would not work that well either unfortunately. On the card it says 'not for identification' (in most cases now). Once the number was disassociated from the advice people did whatever with it. It is a thing where identity theft usually starts. It is one thing companies like to do is get whatever info they can and keep it forever and do random things with it.
        sagarm 6y ago
        Identity theft itself is an example of regulatory failure. How is it my problem that you gave someone a loan based on practically public information? They should have to prove, beyond simply an SSN, that an individual is responsible for the debt before being able to send it to collections or report it to credit agencies.
    - josefx 6y ago
      I thought you can at least derive location and date of birth with quite a bit of accuracy from them. Also if a data set containing the SSN is leaked anyone can cross reference it with any other leaked data set. Ideally you would need a unique and completely random SSN per service.
- 3np 6y ago
  Disagree. The services that require a strict one-to-one mapping between accounts and a human individual is a very small subset of all services (mostly public services and legacy finance). It would also be a privacy nightmare.
- nojokes 6y ago
  GUID following something like rfc4122 would be definitely better than current national id implementations that tend leak personal information. I have two national ids (from two different countries). Both of them leak my birth date and the second one also leaks my gender and even birth place. The main question is - who should be such authority that would actually provide such identifiers that are guaranteed to be globally unique without collisions.
coldcode 6y ago
When I worked for travel company (still exists as a captive marketing brand of someone else not a real company) booking flights was very complex as the name the user gave had to match their identity presented to the TSA exactly or they were likely to be refused entry. This was made more complex as the reservation system we had to call used EBCDIC on ancient mainframes and often failed to properly encode a person's name with non ASCII letters like Å often resulting in tickets that could not be used. The name would look fine in our booking flow and email, but the actual ticket data would be wrong leaving the customer angry at the time of flying. So supporting names is not only an issue with changing them, but preserving the actual spelling through all systems you call. I actually spent 4 years in college (long ago) with no vowels in my name, and never could get them to fix it (even my diploma had it spelled wrong).
- deleted 6y ago
  [deleted]
chenxiaolong 6y ago
My vision insurance company (in the US) is awful about this. They use emails as usernames and when you log in, there's an option to change the email or password. The problem is if you change the email, it only updates where notifications go. The username is still the old email and that's where things like password reset emails are sent. (And they don't support 2FA. Better keep the old email around indefinitely...)
srvo 6y ago
Does HN allow this? When I transitioned I made a new username and sort of started over. But it led to me disengaging from the platform.
- Jaruzel 6y ago
  Behind our usernames, there's user number. I'm sure dang & co, would let you rename yourself if you asked them nicely. However adding it as a option, raises the problem of people trolling the site, and then quickly changing their username to dodge the fallout - some sites have icons to show that a user has recently changed their name, some have a username history on the profile - it's not a trivial problem to solve.
  - srvo 6y ago
    Yeah, some places have an unwritten "just write us and we'll do it" policy. It's nice to know they're up for it, but the cognitive load of reaching out is like 100x higher than just putting it in your preferences. I know there's no good solution here though, so I guess i'll just shout at the sky.
    - Jaruzel 6y ago
      As an aside, you've got some great content on your blog btw. :)
protomyth 6y ago
My current record is a person that had 8 separate names over the course of employment. Some that were valid at the same time. Not really an issue with e-mail, but quite a lot of systems just don't deal well with names. Never mind the idiots that think they can detect fake names.
CapitalistCartr 6y ago
My wife is setting up/improving marketing for her employer, a small non-profit. The previous efforts at a Facebook presence was under the name of individual employees. So she attempts to set up the account in the actual name of the company. Facebook programmers, in their wisdom, deemed "Saint" a title and not allowed to be the first name. Clearly, they're no Catholics at Facebook.
mensetmanusman 6y ago
Build this: an identity link. A secure place where you put information about yourself that you want to share. Then, you won’t have to fill in any more forms, you just put an identity link pointer that fills in the rest.

48 points by philk10 6y ago

I've been considering a name change in the last few years. My last name, specifically. The hard part won't be to have my name changed legally, but rather to change my name with all the organizations I belong to. My bank, my professional society, my employer, etc.

ChrisSD 6y ago

Names as identifiers are an archaic throwback at this point. Every person on the planet should have a unique GUID assigned to them. This can then be used to refer to them independent of their preferred identity. Names are for friends, not companies.

sumtechguy 6y ago
That is basically a 'super SSN'. With the same sort of issues that SSN has. It is a decent idea but even that you should be able to change if needed. Remember there are nefarious players out there.
- deleted 6y ago
  [deleted]
- jsty 6y ago
  > With the same sort of issues that SSN has Only if knowledge of one's "GUID" was regarded as sufficient to authenticate as them surely?
  - shadowfox 6y ago
    I mean it can also be used as a universal, semi-permenant activity tracking id with almost no work, which may not be desirable depending on your feelings wrt privacy. Maybe an ability to generate virtual IDs based on a permanent id (like with virtual credit cards) might help though this is sometimes tricky to use correctly in a privacy-preserving way.
- nojokes 6y ago
  SSN has only issues when it is used as password. Many other national id's are not used like that and do not have any issues.
  - sumtechguy 6y ago
    That assumes all players will use the number correctly. SSN is an example where that did not happen and is used as an authentication and authorization token at the same time.
    - nojokes 6y ago
      That is true and it requires some educating by the state. Not possible when the state is using it wrong.
      - sumtechguy 6y ago
        Education would not work that well either unfortunately. On the card it says 'not for identification' (in most cases now). Once the number was disassociated from the advice people did whatever with it. It is a thing where identity theft usually starts. It is one thing companies like to do is get whatever info they can and keep it forever and do random things with it.
        sagarm 6y ago
        Identity theft itself is an example of regulatory failure. How is it my problem that you gave someone a loan based on practically public information? They should have to prove, beyond simply an SSN, that an individual is responsible for the debt before being able to send it to collections or report it to credit agencies.
  - josefx 6y ago
    I thought you can at least derive location and date of birth with quite a bit of accuracy from them. Also if a data set containing the SSN is leaked anyone can cross reference it with any other leaked data set. Ideally you would need a unique and completely random SSN per service.
3np 6y ago
Disagree. The services that require a strict one-to-one mapping between accounts and a human individual is a very small subset of all services (mostly public services and legacy finance). It would also be a privacy nightmare.
nojokes 6y ago
GUID following something like rfc4122 would be definitely better than current national id implementations that tend leak personal information. I have two national ids (from two different countries). Both of them leak my birth date and the second one also leaks my gender and even birth place. The main question is - who should be such authority that would actually provide such identifiers that are guaranteed to be globally unique without collisions.

coldcode 6y ago

When I worked for travel company (still exists as a captive marketing brand of someone else not a real company) booking flights was very complex as the name the user gave had to match their identity presented to the TSA exactly or they were likely to be refused entry. This was made more complex as the reservation system we had to call used EBCDIC on ancient mainframes and often failed to properly encode a person's name with non ASCII letters like Å often resulting in tickets that could not be used. The name would look fine in our booking flow and email, but the actual ticket data would be wrong leaving the customer angry at the time of flying. So supporting names is not only an issue with changing them, but preserving the actual spelling through all systems you call. I actually spent 4 years in college (long ago) with no vowels in my name, and never could get them to fix it (even my diploma had it spelled wrong).

deleted 6y ago
[deleted]

chenxiaolong 6y ago

My vision insurance company (in the US) is awful about this. They use emails as usernames and when you log in, there's an option to change the email or password. The problem is if you change the email, it only updates where notifications go. The username is still the old email and that's where things like password reset emails are sent. (And they don't support 2FA. Better keep the old email around indefinitely...)

srvo 6y ago

Does HN allow this? When I transitioned I made a new username and sort of started over. But it led to me disengaging from the platform.

Jaruzel 6y ago
Behind our usernames, there's user number. I'm sure dang & co, would let you rename yourself if you asked them nicely. However adding it as a option, raises the problem of people trolling the site, and then quickly changing their username to dodge the fallout - some sites have icons to show that a user has recently changed their name, some have a username history on the profile - it's not a trivial problem to solve.
- srvo 6y ago
  Yeah, some places have an unwritten "just write us and we'll do it" policy. It's nice to know they're up for it, but the cognitive load of reaching out is like 100x higher than just putting it in your preferences. I know there's no good solution here though, so I guess i'll just shout at the sky.
  - Jaruzel 6y ago
    As an aside, you've got some great content on your blog btw. :)

protomyth 6y ago

My current record is a person that had 8 separate names over the course of employment. Some that were valid at the same time. Not really an issue with e-mail, but quite a lot of systems just don't deal well with names. Never mind the idiots that think they can detect fake names.

CapitalistCartr 6y ago

My wife is setting up/improving marketing for her employer, a small non-profit. The previous efforts at a Facebook presence was under the name of individual employees. So she attempts to set up the account in the actual name of the company. Facebook programmers, in their wisdom, deemed "Saint" a title and not allowed to be the first name. Clearly, they're no Catholics at Facebook.

mensetmanusman 6y ago

Build this: an identity link. A secure place where you put information about yourself that you want to share. Then, you won’t have to fill in any more forms, you just put an identity link pointer that fills in the rest.