3 ms·

They are in fact not great IDs and the Social Security Administration asked very nicely for the rest of the country to not use them as a form of identification:

by d4mi3n 6y ago

They are in fact not great IDs and the Social Security Administration asked very nicely for the rest of the country to not use them as a form of identification: https://www.youtube.com/watch?v=Erp8IAUouus https://www.youtube.com/watch?v=Erp8IAUouus A few reasons why SSNs are bad as IDs: 1. There are a number of situations where people will not have a SSN. 2. SSNs are "secrets" that need to be broadly shared to participate in many parts of business and government in the US. 3. SSNs lack many security and authentication mechanisms most forms of ID have (e.g. photo ID) There are folks in the US who rally against the idea of a national ID, but I've always thought it was a silly argument considering how pervasive and problematic SSNs are as a form of identification.

hedora 6y ago
4. SSN’s are not unique, nor were they designed to be, but people think they are.
mulmen 6y ago
If a living person has a SSN they can be identified by it [1]. That does not imply any individual can be identified by a SSN or that any SSN identifies an individual. The suitability of an SSN is situational for ID purposes. The video conflates identification and authentication to its detriment. Social Security Numbers are very good identifiers, that’s literally their purpose. Social Security Cards are poor authentication tokens because they contain no validation to prove the card holder is the person associated with the number. Or said another way, you cannot prove your identity (authenticate) with a social security card. I don’t see what built in validation of the number has to do with the security of the identifier. So again, the problem is using a Social Security Number or card for authentication. It’s fine as an identifier. [1]: Social Security Numbers can be reissued but this should only happen when the number is no longer in use.
- mulmen 6y ago
  Too late to edit but apparently SSNs are not reused: https://www.ssa.gov/history/hfaq.html https://www.ssa.gov/history/hfaq.html Q20: Are Social Security numbers reused after a person dies? A: No. We do not reassign a Social Security number (SSN) after the number holder's death. Even though we have issued over 453 million SSNs so far, and we assign about 5 and one-half million new numbers a year, the current numbering system will provide us with enough new numbers for several generations into the future with no changes in the numbering system.
  - nathanaldensr 6y ago
    I wonder how this is possible when there are only one billion combinations of digits.
    - rodonn 6y ago
      There are only around 330 million Americans and about 5 million born/immigrated each year. 1 billion possibilities will be enough for about 100 more years. Presumably sometime before then we can replace or update the system (or worst case add one more digit).
ACS_Solver 6y ago
Somewhat tangential, but I've always found it weird when I read about strong opposition of some in the US to government ID, framing it as something that jeopardizes the indivdiual's rights. My perspective from a European point of view is different, a government system that provides some ID (which is good both for identification and authentication) is a crucial protection of my rights. I don't want anybody to be able to impersonate me, which means I want a universally accepted system of strong authentication. That's what government ID is to me, it's like a PGP keyring where the government is the introducer in the web of trust. In the absence of such a system, various ad-hoc systems emerge, and that's IMO why identity theft is so staggeringly common in the US - it's easy, and it's easy because very poor systems are routinely used for authentication. If I understand correctly, you can do a lot in the US with one-factor knowledge authentication, where the "something you know" are things like your name, address, DOB or SSN, all of which are exceptionally poor as authentication.
- jhanschoo 6y ago
  One dimension to this is that racism and xenophobia is so nakedly tolerated including in the political class in the US, that many are fear that any governmental ID would only be half-heartedly rolled out to inconvenient and undesirable people in an effort to suppress their voice.
  - deleted 6y ago
    [deleted]
- mulmen 6y ago
  While there is no Federal ID every state in the Union (to my knowledge) provides ID cards to citizens. These vary slightly from place to place but all contain verifiable identity (authentication). This may seem strange to outsiders but makes more sense when you consider the United States is a federation of sovereign states. The system is built on the idea of limited federal power with states sharing but retaining much of their own sovereignty. This has many of the benefits of any federated system and makes for a robust democracy. There’s very little of consequence you can do in the United States with single factor knowledge. If identity theft is more common here than elsewhere (citation needed) I would guess it has more to do with a lack of consequences (consumer protection) than a Federal ID.
swiley 6y ago
I'm pretty sure I read somewhere SSNs aren't even guaranteed to be unique.

by d4mi3n 6y ago

hedora 6y ago

4. SSN’s are not unique, nor were they designed to be, but people think they are.

mulmen 6y ago

If a living person has a SSN they can be identified by it [1]. That does not imply any individual can be identified by a SSN or that any SSN identifies an individual. The suitability of an SSN is situational for ID purposes. The video conflates identification and authentication to its detriment. Social Security Numbers are very good identifiers, that’s literally their purpose. Social Security Cards are poor authentication tokens because they contain no validation to prove the card holder is the person associated with the number. Or said another way, you cannot prove your identity (authenticate) with a social security card. I don’t see what built in validation of the number has to do with the security of the identifier. So again, the problem is using a Social Security Number or card for authentication. It’s fine as an identifier. [1]: Social Security Numbers can be reissued but this should only happen when the number is no longer in use.

mulmen 6y ago
Too late to edit but apparently SSNs are not reused: https://www.ssa.gov/history/hfaq.html https://www.ssa.gov/history/hfaq.html Q20: Are Social Security numbers reused after a person dies? A: No. We do not reassign a Social Security number (SSN) after the number holder's death. Even though we have issued over 453 million SSNs so far, and we assign about 5 and one-half million new numbers a year, the current numbering system will provide us with enough new numbers for several generations into the future with no changes in the numbering system.
- nathanaldensr 6y ago
  I wonder how this is possible when there are only one billion combinations of digits.
  - rodonn 6y ago
    There are only around 330 million Americans and about 5 million born/immigrated each year. 1 billion possibilities will be enough for about 100 more years. Presumably sometime before then we can replace or update the system (or worst case add one more digit).

ACS_Solver 6y ago

Somewhat tangential, but I've always found it weird when I read about strong opposition of some in the US to government ID, framing it as something that jeopardizes the indivdiual's rights. My perspective from a European point of view is different, a government system that provides some ID (which is good both for identification and authentication) is a crucial protection of my rights. I don't want anybody to be able to impersonate me, which means I want a universally accepted system of strong authentication. That's what government ID is to me, it's like a PGP keyring where the government is the introducer in the web of trust. In the absence of such a system, various ad-hoc systems emerge, and that's IMO why identity theft is so staggeringly common in the US - it's easy, and it's easy because very poor systems are routinely used for authentication. If I understand correctly, you can do a lot in the US with one-factor knowledge authentication, where the "something you know" are things like your name, address, DOB or SSN, all of which are exceptionally poor as authentication.

jhanschoo 6y ago
One dimension to this is that racism and xenophobia is so nakedly tolerated including in the political class in the US, that many are fear that any governmental ID would only be half-heartedly rolled out to inconvenient and undesirable people in an effort to suppress their voice.
- deleted 6y ago
  [deleted]
mulmen 6y ago
While there is no Federal ID every state in the Union (to my knowledge) provides ID cards to citizens. These vary slightly from place to place but all contain verifiable identity (authentication). This may seem strange to outsiders but makes more sense when you consider the United States is a federation of sovereign states. The system is built on the idea of limited federal power with states sharing but retaining much of their own sovereignty. This has many of the benefits of any federated system and makes for a robust democracy. There’s very little of consequence you can do in the United States with single factor knowledge. If identity theft is more common here than elsewhere (citation needed) I would guess it has more to do with a lack of consequences (consumer protection) than a Federal ID.

swiley 6y ago

I'm pretty sure I read somewhere SSNs aren't even guaranteed to be unique.