4 ms·

Serious question, how would that be any different than a SSN?

lolsal 5y ago
I have this same question also.
sethhochberg 5y ago
SSNs aren't a great source of identity mostly because they were never designed to be - they aren't unique, until somewhat recently they were issued in a predictable order, an individual can have their SSN changed, and since they are only 9 digits we're going to run out of them on a practical timeline, etc. They became a defacto identifier for many institutions just because US citizens and permanent residents generally have one - but aside from convenience, they're pretty problematic compared even to something like a UUID/GUID. If you were trying to design a true national ID number, you'd probably want to approach the problem more like a database designer would: you'd want something that had possible unique values far exceeding the reasonable number of people you expect to exist before the collapse of society, that was reasonably random and difficult to predict based on other known attributes about the person, that by spec was never shared with another person, etc.
iknowstuff 5y ago
The EU has a federated public key cryptography based identity system. The member states recognize identities issued by other member states, but there is no central system. In any case, the private key is stored on a plastic ID, only released with a PIN, and the databases only store the corresponding public key. A leak of a public key without the private key is harmless. https://en.m.wikipedia.org/wiki/EIDAS https://en.m.wikipedia.org/wiki/EIDAS
gregoryjjb 5y ago
An SSN is a username, not a password. We need an identity system with real passwords that can be changed in the case of a breach.
slg 5y ago
SSNs sit in a middle ground between being public and private. A large number of companies and organizations use it to both identify people and as proof of identity. Those are two separate functions. When I go to a bank for a loan, I should give them some form of private id as proof I am who I say I am (this doesn't have to be a federally issued number). When companies communicate about me with each other (such as running a credit check on me which is likely why T-Mobile even had SSNs) they should use my public id.
- lotsofpulp 5y ago
  The only reason companies get away with using it as proof of identity is because the government allows them to hit your credit report with a debt without having to prove you engaged in a transaction, and then make it your problem to prove you never did what someone else is claiming you did. The solution is pretty simple, the government should require others to prove they engaged in a transition with you before being able to put an unpaid debt on your credit report, not the other way around.
  - InitialLastName 5y ago
    > government allows them to hit your credit report with a debt You appear to be operating under a misunderstanding: The government doesn't organize credit reports. Credit reports (in the US, at least) are compiled by independent companies, who operate with very little oversight or recourse (and occasionally leak lots of data themselves).
    - lotsofpulp 5y ago
      I know how they operate, but the government can create legislation to change things.
    - sidewndr46 5y ago
      You have the misunderstanding. Credit reports in the United States are compiled by independent companies regulated under the FCRA. This is a federal act that basically whitewashes all the trashy behavior by credit bureaus.
Spooky23 5y ago
If the US was capable of rational policy decisions, you could do any of a number of things to present a trusted representation of your identity without a “secret” 9 digit number. We already have such a system, it’s called a passport, and it has complementary “cousins” like passport cards and nexus cards. That framework could easily be built upon, but there is a mountain of paranoia and stupid to climb first. Instead we have the current system where fraud is endemic and where millions of people are marginalized by poor access to ID.
stickfigure 5y ago
One option would be to offer a national oauth-style ID verification system.

I have this same question also.

SSNs aren't a great source of identity mostly because they were never designed to be - they aren't unique, until somewhat recently they were issued in a predictable order, an individual can have their SSN changed, and since they are only 9 digits we're going to run out of them on a practical timeline, etc. They became a defacto identifier for many institutions just because US citizens and permanent residents generally have one - but aside from convenience, they're pretty problematic compared even to something like a UUID/GUID. If you were trying to design a true national ID number, you'd probably want to approach the problem more like a database designer would: you'd want something that had possible unique values far exceeding the reasonable number of people you expect to exist before the collapse of society, that was reasonably random and difficult to predict based on other known attributes about the person, that by spec was never shared with another person, etc.

iknowstuff 5y ago

The EU has a federated public key cryptography based identity system. The member states recognize identities issued by other member states, but there is no central system. In any case, the private key is stored on a plastic ID, only released with a PIN, and the databases only store the corresponding public key. A leak of a public key without the private key is harmless. https://en.m.wikipedia.org/wiki/EIDAS https://en.m.wikipedia.org/wiki/EIDAS

gregoryjjb 5y ago

An SSN is a username, not a password. We need an identity system with real passwords that can be changed in the case of a breach.

slg 5y ago

SSNs sit in a middle ground between being public and private. A large number of companies and organizations use it to both identify people and as proof of identity. Those are two separate functions. When I go to a bank for a loan, I should give them some form of private id as proof I am who I say I am (this doesn't have to be a federally issued number). When companies communicate about me with each other (such as running a credit check on me which is likely why T-Mobile even had SSNs) they should use my public id.

lotsofpulp 5y ago
The only reason companies get away with using it as proof of identity is because the government allows them to hit your credit report with a debt without having to prove you engaged in a transaction, and then make it your problem to prove you never did what someone else is claiming you did. The solution is pretty simple, the government should require others to prove they engaged in a transition with you before being able to put an unpaid debt on your credit report, not the other way around.
- InitialLastName 5y ago
  > government allows them to hit your credit report with a debt You appear to be operating under a misunderstanding: The government doesn't organize credit reports. Credit reports (in the US, at least) are compiled by independent companies, who operate with very little oversight or recourse (and occasionally leak lots of data themselves).
  - lotsofpulp 5y ago
    I know how they operate, but the government can create legislation to change things.
  - sidewndr46 5y ago
    You have the misunderstanding. Credit reports in the United States are compiled by independent companies regulated under the FCRA. This is a federal act that basically whitewashes all the trashy behavior by credit bureaus.

Spooky23 5y ago

If the US was capable of rational policy decisions, you could do any of a number of things to present a trusted representation of your identity without a “secret” 9 digit number. We already have such a system, it’s called a passport, and it has complementary “cousins” like passport cards and nexus cards. That framework could easily be built upon, but there is a mountain of paranoia and stupid to climb first. Instead we have the current system where fraud is endemic and where millions of people are marginalized by poor access to ID.

stickfigure 5y ago

One option would be to offer a national oauth-style ID verification system.