4 ms·

There should be zero reason for a phone company to even have our SSNs. We really need a public national ID system in the US.

by slg 5y ago

gjsman-1000 5y ago
Fantastic. Let's centralize all records from everybody in one central location that totally won't get hacked, by the same government that screwed up Healthcare.gov, your DMV, and just recently a war against militants wearing sandals.
- iknowstuff 5y ago
  The EU has a federated public key cryptography based identity system. The member states recognize identities issued by other member states, but there is no central system. In any case, the private key is stored on a plastic ID, only released with a PIN, and the databases only store the corresponding public key. A leak of a public key without the private key is harmless. https://en.m.wikipedia.org/wiki/EIDAS https://en.m.wikipedia.org/wiki/EIDAS
  - gjsman-1000 5y ago
    That makes more sense than the OP's suggestion.
  - nickthemagicman 5y ago
    Yep. Public private key is absolutely great for this. SSH been using it all these years and still going strong.
- toomuchtodo 5y ago
  This is just an unhelpful argument. You might take issue with how government functions, and necessary improvements, but these government functions are still required in a developed nation.
  - gjsman-1000 5y ago
    Well, the government in the US functions just fine without the centralized ID System the OP is wishing for, even though stuff like this occurs. There is literally no reason why Americans would trust the central government to be more secure than T-Mobile at this point.
    - toomuchtodo 5y ago
      It clearly doesn’t, and it’s foolish to say it does based on the evidence.
      - gjsman-1000 5y ago
        WannaCry was developed with stolen NSA technology in 2017. Despite that the National Security Agency should be more secure than anyone and these tools weren't available to the public. You really trust a public service, not run by the Security Agency, to be more secure than that?
    - encryptluks2 5y ago
      I disagree here. There are innovative solutions for private decentralized encryption. Other countries have also already implemented similar solutions. Almost anything is better than a 9 digit number. The government also has the resources to hire some of the top academics. Companies have proven time and time again to only care about money. While politics is messed up in a larger sense, there are some divisions that are majorly effective and good at what they do.
  - bcherny 5y ago
    Clarification: OC doesn’t seem to be arguing that these govt functions shouldn’t exist; they’re arguing that it’s wrong to trust govt with digital security more than we trust private companies.
    - gjsman-1000 5y ago
      Exactly. I don't dispute government services existing, I'm disputing that the government will do a better job than T-Mobile just because they're the government.
- nemothekid 5y ago
  Fantastic. Instead of one location that can be properly outfitted with the best practices let's have 1000 shitty ones.
  - gjsman-1000 5y ago
    As an American... don't trust for a second that they will follow "best practices." After all, how did the NSA's top-secret Vault7 weapons get stolen considering that they were following "best practices"? And then proceed to bring havoc to the world with WannaCry...
- UseStrict 5y ago
  Or, just a thought, design an identifier where compromising one system doesn't immediately compromise all the individual data contained within it. SSN breaches only really hurt because its exposure means instant compromise of identity, whereas a system with some sort of partial key, signature, etc, where the user retains a portion means they have to compromise the database and the user, and if a "central" system (i.e. government, private key issuer, etc) is compromised you can re-issue the user identifier portions. If anything it might encourage companies to smarten up if there was a law on the books that required companies that get compromised to pay for the re-issuing of the user tokens to every impacted individual.
dougbarrett 5y ago
Serious question, how would that be any different than a SSN?
- lolsal 5y ago
  I have this same question also.
- sethhochberg 5y ago
  SSNs aren't a great source of identity mostly because they were never designed to be - they aren't unique, until somewhat recently they were issued in a predictable order, an individual can have their SSN changed, and since they are only 9 digits we're going to run out of them on a practical timeline, etc. They became a defacto identifier for many institutions just because US citizens and permanent residents generally have one - but aside from convenience, they're pretty problematic compared even to something like a UUID/GUID. If you were trying to design a true national ID number, you'd probably want to approach the problem more like a database designer would: you'd want something that had possible unique values far exceeding the reasonable number of people you expect to exist before the collapse of society, that was reasonably random and difficult to predict based on other known attributes about the person, that by spec was never shared with another person, etc.
- iknowstuff 5y ago
  The EU has a federated public key cryptography based identity system. The member states recognize identities issued by other member states, but there is no central system. In any case, the private key is stored on a plastic ID, only released with a PIN, and the databases only store the corresponding public key. A leak of a public key without the private key is harmless. https://en.m.wikipedia.org/wiki/EIDAS https://en.m.wikipedia.org/wiki/EIDAS
- gregoryjjb 5y ago
  An SSN is a username, not a password. We need an identity system with real passwords that can be changed in the case of a breach.
- slg 5y ago
2OEH8eoCRo0 5y ago
A SSN should be useless anyway. It shouldn't matter any more than your mailing address being out there.
- slg 5y ago
  I agree and they were generally designed with that intention. The reason they aren't used that way is because we have no other means of federal ID.
chrismarlow9 5y ago
The problem is you can't easily change your SSN. Recently I got a new state id and reported it as lost. They sent me a new license and it has the same DL number and everything. Why can't we rotate things? Is it a slow convergence thing into other systems or something? It's really concerning.
- withinboredom 5y ago
  I had a coworker lose their Drivers license and later get arrested because the person who found it decided to rob a bank and drop it on the floor to send the cops elsewhere.

There should be zero reason for a phone company to even have our SSNs. We really need a public national ID system in the US.

by slg 5y ago

There should be zero reason for a phone company to even have our SSNs. We really need a public national ID system in the US.

gjsman-1000 5y ago

Fantastic. Let's centralize all records from everybody in one central location that totally won't get hacked, by the same government that screwed up Healthcare.gov, your DMV, and just recently a war against militants wearing sandals.

iknowstuff 5y ago
The EU has a federated public key cryptography based identity system. The member states recognize identities issued by other member states, but there is no central system. In any case, the private key is stored on a plastic ID, only released with a PIN, and the databases only store the corresponding public key. A leak of a public key without the private key is harmless. https://en.m.wikipedia.org/wiki/EIDAS https://en.m.wikipedia.org/wiki/EIDAS
- gjsman-1000 5y ago
  That makes more sense than the OP's suggestion.
- nickthemagicman 5y ago
  Yep. Public private key is absolutely great for this. SSH been using it all these years and still going strong.
toomuchtodo 5y ago
This is just an unhelpful argument. You might take issue with how government functions, and necessary improvements, but these government functions are still required in a developed nation.
- gjsman-1000 5y ago
  Well, the government in the US functions just fine without the centralized ID System the OP is wishing for, even though stuff like this occurs. There is literally no reason why Americans would trust the central government to be more secure than T-Mobile at this point.
  - toomuchtodo 5y ago
    It clearly doesn’t, and it’s foolish to say it does based on the evidence.
    - gjsman-1000 5y ago
      WannaCry was developed with stolen NSA technology in 2017. Despite that the National Security Agency should be more secure than anyone and these tools weren't available to the public. You really trust a public service, not run by the Security Agency, to be more secure than that?
  - encryptluks2 5y ago
    I disagree here. There are innovative solutions for private decentralized encryption. Other countries have also already implemented similar solutions. Almost anything is better than a 9 digit number. The government also has the resources to hire some of the top academics. Companies have proven time and time again to only care about money. While politics is messed up in a larger sense, there are some divisions that are majorly effective and good at what they do.
- bcherny 5y ago
  Clarification: OC doesn’t seem to be arguing that these govt functions shouldn’t exist; they’re arguing that it’s wrong to trust govt with digital security more than we trust private companies.
  - gjsman-1000 5y ago
    Exactly. I don't dispute government services existing, I'm disputing that the government will do a better job than T-Mobile just because they're the government.
nemothekid 5y ago
Fantastic. Instead of one location that can be properly outfitted with the best practices let's have 1000 shitty ones.
- gjsman-1000 5y ago
  As an American... don't trust for a second that they will follow "best practices." After all, how did the NSA's top-secret Vault7 weapons get stolen considering that they were following "best practices"? And then proceed to bring havoc to the world with WannaCry...
UseStrict 5y ago
Or, just a thought, design an identifier where compromising one system doesn't immediately compromise all the individual data contained within it. SSN breaches only really hurt because its exposure means instant compromise of identity, whereas a system with some sort of partial key, signature, etc, where the user retains a portion means they have to compromise the database and the user, and if a "central" system (i.e. government, private key issuer, etc) is compromised you can re-issue the user identifier portions. If anything it might encourage companies to smarten up if there was a law on the books that required companies that get compromised to pay for the re-issuing of the user tokens to every impacted individual.

dougbarrett 5y ago

Serious question, how would that be any different than a SSN?

lolsal 5y ago
I have this same question also.
sethhochberg 5y ago
SSNs aren't a great source of identity mostly because they were never designed to be - they aren't unique, until somewhat recently they were issued in a predictable order, an individual can have their SSN changed, and since they are only 9 digits we're going to run out of them on a practical timeline, etc. They became a defacto identifier for many institutions just because US citizens and permanent residents generally have one - but aside from convenience, they're pretty problematic compared even to something like a UUID/GUID. If you were trying to design a true national ID number, you'd probably want to approach the problem more like a database designer would: you'd want something that had possible unique values far exceeding the reasonable number of people you expect to exist before the collapse of society, that was reasonably random and difficult to predict based on other known attributes about the person, that by spec was never shared with another person, etc.
iknowstuff 5y ago
The EU has a federated public key cryptography based identity system. The member states recognize identities issued by other member states, but there is no central system. In any case, the private key is stored on a plastic ID, only released with a PIN, and the databases only store the corresponding public key. A leak of a public key without the private key is harmless. https://en.m.wikipedia.org/wiki/EIDAS https://en.m.wikipedia.org/wiki/EIDAS
gregoryjjb 5y ago
An SSN is a username, not a password. We need an identity system with real passwords that can be changed in the case of a breach.
slg 5y ago

2OEH8eoCRo0 5y ago

A SSN should be useless anyway. It shouldn't matter any more than your mailing address being out there.

slg 5y ago
I agree and they were generally designed with that intention. The reason they aren't used that way is because we have no other means of federal ID.

chrismarlow9 5y ago

The problem is you can't easily change your SSN. Recently I got a new state id and reported it as lost. They sent me a new license and it has the same DL number and everything. Why can't we rotate things? Is it a slow convergence thing into other systems or something? It's really concerning.

withinboredom 5y ago
I had a coworker lose their Drivers license and later get arrested because the person who found it decided to rob a bank and drop it on the floor to send the cops elsewhere.