4 ms·

I said this just a couple of days ago re: a data breach: The US needs to just scorch the earth re: social security numbers. Set a date when all liability for f

I said this just a couple of days ago re: a data breach: The US needs to just scorch the earth re: social security numbers. Set a date when all liability for fraud enabled by improper use of SSN's for "authentication" is the responsibility of the party misusing SSNs and publish the entire list. The list has, arguably, already been published (thanks, Equifax!). We just need to close the loop.

thephyber 6y ago
Unlikely to unfold that way (we are 20 years into the RealID standard recommendation and it has been delayed again). As I’ve mentioned elsewhere, SSN is not the only fact used for authentication. We need to move away from all pure fact-knowledge proofs of ID and to MfA preferably with one factor based on a government issued ID and asymmetric encryption.
- EvanAnderson 6y ago
  I agree that it's unlikely unless there's massive public outcry, and even then I don't see it happening. The status quo is too entrenched and until elected leaders feel the pain from their constituents nothing is going to change. I concentrated on SSN because it's the government-issued fact-based "authentication" factor. The other fact-based factors are just as bad. I wish we could have a government-sponsored PKI but between concerns from citizens about "freedom" (either freedom for business to "innovate" in the space, or freedom from individuals to be "tracked" by the government) and from surveillance advocates who will want to include key escrow/recovery provision I don't see it flying. In some other comments on this post I mentioned the USPS would be a great "trust" provider. They already serve in that capacity to some extent evidenced by the various government entities who accept an addressed piece of mail as proof of residency. I don't think there'd be enough bipartisan support to make it happen, but I think it'd work great.

thephyber 6y ago

Unlikely to unfold that way (we are 20 years into the RealID standard recommendation and it has been delayed again). As I’ve mentioned elsewhere, SSN is not the only fact used for authentication. We need to move away from all pure fact-knowledge proofs of ID and to MfA preferably with one factor based on a government issued ID and asymmetric encryption.

EvanAnderson 6y ago
I agree that it's unlikely unless there's massive public outcry, and even then I don't see it happening. The status quo is too entrenched and until elected leaders feel the pain from their constituents nothing is going to change. I concentrated on SSN because it's the government-issued fact-based "authentication" factor. The other fact-based factors are just as bad. I wish we could have a government-sponsored PKI but between concerns from citizens about "freedom" (either freedom for business to "innovate" in the space, or freedom from individuals to be "tracked" by the government) and from surveillance advocates who will want to include key escrow/recovery provision I don't see it flying. In some other comments on this post I mentioned the USPS would be a great "trust" provider. They already serve in that capacity to some extent evidenced by the various government entities who accept an addressed piece of mail as proof of residency. I don't think there'd be enough bipartisan support to make it happen, but I think it'd work great.