5 ms·

Everyone, let's have this "secure" service where we put _ALL_ of our sensitive data!! Including export controlled materials? To be honest, it seems like PII inc

Everyone, let's have this "secure" service where we put _ALL_ of our sensitive data!! Including export controlled materials? To be honest, it seems like PII including SSN leak regularly. Whatever... freeze your credit and get monitoring. On the other hand, export controlled ITAR/EAR... now that's bad!

pmiller2 6y ago
That just sounds like a single point of failure to me. That is, if this is a serious proposal. Sarcasm does not come through on the internets very well. :P
- JellyBeanThief 6y ago
  It is sarcasm. The tell is the quoted word "secure", and the hyper-emphasized word _ALL_.
iso1631 6y ago
Why is SSN considered secure information? It's the equivalent of a username (or indeed just a name), or a phone number.
- Daho0n 6y ago
  In a perfect world. In this world it is often username and password in one. Know the SSN and you are the SSN owner.
  - iso1631 6y ago
    Which is the fault of the person treating it as a password. If I said "can I have a loan, my name is John Smith from 123 Main Street" And the bank gave me money and stuck it on John Smith's account, people (John Smith) wouldn't stand for it. In an ideal world SSNs would be published in a global lookup list, getting rid of the entire idea in the average person's head that SSNs are secret information when they aren't.
    - tuwtuwtuwtuw 6y ago
      > In an ideal world Could just replace that with "in other countries". Where I live my personal number is considered public and government will give it to anyone asking. Authentication is done using one time codes, certificates, identification cards and similar. Nothing stops a company from treating the personal number as some authentication factor but it would make no sense.
      - iso1631 6y ago
        The problem in the US is that the SSN is treated as being a secret form of information. It's not a problem with the SSN, it's a cultural problem. (A large number of problems in the US are cultural problems, and many "solutions" from SV are solutions for uniquely american problems)
        angry_octet 6y ago
        It's a secret that you are compelled to share with many many entities. And apparently it is hard coded into 'too many' places to change. I would bet the US is still using SSNs of the exact same format when I'm long dead.
      - perpetualpatzer 6y ago
        Ignorant american question... in not-in-person transactions, how do they make sure that the one time code/ certificate goes to John, not just someone claiming to be John? Is there some centralized password issuer/validator that can only be reset in person?
        mejutoco 6y ago
        Here in Germany you either get some username and password in person, setup an app for 2FA, or sometimes you get two different letters (one with the username and another one with the password). I guess so that it is slightly more difficult to intercept both. For a few services if you forget the password you get the letters again.
        6y ago

pmiller2 6y ago

That just sounds like a single point of failure to me. That is, if this is a serious proposal. Sarcasm does not come through on the internets very well. :P

JellyBeanThief 6y ago
It is sarcasm. The tell is the quoted word "secure", and the hyper-emphasized word _ALL_.

iso1631 6y ago

Why is SSN considered secure information? It's the equivalent of a username (or indeed just a name), or a phone number.

Daho0n 6y ago
In a perfect world. In this world it is often username and password in one. Know the SSN and you are the SSN owner.
- iso1631 6y ago
  Which is the fault of the person treating it as a password. If I said "can I have a loan, my name is John Smith from 123 Main Street" And the bank gave me money and stuck it on John Smith's account, people (John Smith) wouldn't stand for it. In an ideal world SSNs would be published in a global lookup list, getting rid of the entire idea in the average person's head that SSNs are secret information when they aren't.
  - tuwtuwtuwtuw 6y ago
    > In an ideal world Could just replace that with "in other countries". Where I live my personal number is considered public and government will give it to anyone asking. Authentication is done using one time codes, certificates, identification cards and similar. Nothing stops a company from treating the personal number as some authentication factor but it would make no sense.
    - iso1631 6y ago
      The problem in the US is that the SSN is treated as being a secret form of information. It's not a problem with the SSN, it's a cultural problem. (A large number of problems in the US are cultural problems, and many "solutions" from SV are solutions for uniquely american problems)
      - angry_octet 6y ago
        It's a secret that you are compelled to share with many many entities. And apparently it is hard coded into 'too many' places to change. I would bet the US is still using SSNs of the exact same format when I'm long dead.
    - perpetualpatzer 6y ago
      Ignorant american question... in not-in-person transactions, how do they make sure that the one time code/ certificate goes to John, not just someone claiming to be John? Is there some centralized password issuer/validator that can only be reset in person?
      - mejutoco 6y ago
        Here in Germany you either get some username and password in person, setup an app for 2FA, or sometimes you get two different letters (one with the username and another one with the password). I guess so that it is slightly more difficult to intercept both. For a few services if you forget the password you get the letters again.
      - 6y ago