6 ms·

As I've said before, it's time to wipe the slate on SSN's. They are de facto public anyway. A date should be announced when the entire database will be publishe

As I've said before, it's time to wipe the slate on SSN's. They are de facto public anyway. A date should be announced when the entire database will be published. After that date all liability for fraud perpetrated using an SSN as a shared "secret" will be assigned to the party who accepted the SSN as "authentication". That would solve the problem. As an aside: When it comes to an authentication source to take the place of silly shared public "secrets" I think it would be great if the United States Postal Service "pivoted" into issuing digital certificates to individuals. They already have infrastructure and procedures in place for identity verification and physical delivery. I suppose that's too much like a federally-issued ID to ever fly, though our "REAL ID" drivers licenses are, in effect, a federal ID anyway. I'd rather have a digital certificate out of the deal too.

rafale 5y ago
What are we gonna use instead? Hardware keys, like Ledger but for ID?
- gruez 5y ago
  That's basically what some countries have: IDs with a smartcard built in which functions like a HSM
- dredmorbius 5y ago
  I'm strongly partial to a wearable token. The NFC Ring is one highly attractive option. - It's inobtrusive enough to wear all, or very nearly all of the time. Contrast cards or similar carried-but-not-worn tokens. - It can be readily use to tap a sensor for identification purposes. Contrast cards or similar tokens (e.g., USB keys), which are far less immediate. - It is replaceable. That is, if it's compromised, stolen, or lost, it can be replaced. If it becomes unadvisable to possess, it's readily discarded and reasonably easily destroyed. This contrasts with biometrics or permanently embedded sensors. - Its absence is reasonably immediately determinable. Again, contrast carried-but-not-worn tokens. - The existing prevalence of ring-wearing makes use of an NFC ring less obvious or evident (mostly a concern in early-adoption periods), or the opting-out of wearing one (which ring is the NFC ring?), without directly querying each individual, which ... might not work regardless (depending on implementations). - There are relatively few people who would be entirely unable to use such a device. Ready alternatives for most such cases exist: wrist bands - Unintentional validation (e.g., surveillance) is relatively easily avoided, if devices require immediate contact with a sensor/receiver. That is, a surveillance entity couldn't mass scan a crowd or region quickly, but would have to individually query rings in close proximity. (This might be achieved through high-volume transit points already, but this already raises the ante.) - It's possible with a query/response system that multiple identities with the same root, but not immediately correlated, could be supported. (Deanonymisation or identity linking remains a significant problem, however.) Ideally, such a system could be limited to only satisfying minimum qualifying criteria (e.g., "I've paid a fare for this trip"), rather than transmitting either a full personal dossier or an absolute identity. Key (so to speak) challenges are in agreeing on a single standard, ensuring crytpgraphic robustness, and protecting privacy, surveillance, and other concerns, as well as distributing the detector infrastructure for desired uses.
  - EvanAnderson 5y ago
    This all sounds very reasonable, albeit I'm partial to chip-and-PIN for preventing unintentional validation and to render the token useless if lost or stolen. The ring form factor doesn't lend itself to PIN entry, but otherwise it sounds reasonable compelling. (Granted I can't make myself wear a ring without taking it off, fidgeting with it, and ultimately losing it. I've tried, failed, and lost three as a result.)
    - dredmorbius 5y ago
      An NFC ring can still require secondary authentication (e.g., pin) in some contexts. That would be application-dependent. There are cases (e.g., mass-transit turnstiles) where this isn't desirable --- the intent is to maximise throughput. (The quesiton of whether or not validating or fares are a net benefit is also open.) For a more secure facility, or payment system, tag + pin (and potentially other identifiers) would be preferred.
MeinBlutIstBlau 5y ago
I'm at the point where I just want a tattoo or chip embedded in me. Like I'm integrated in the system at this point. I can't exactly go off grid.
- 55873445216111 5y ago
  "How come no tattoo?!"
  - Forbo 5y ago
    For those wondering, this is a reference to Idiocracy: https://www.youtube.com/watch?v=BdPmNM0IF7Y https://www.youtube.com/watch?v=BdPmNM0IF7Y I believe the direct quote is "Why come you got no tattoo?"
    - 55873445216111 5y ago
      I am Not Sure.
55873445216111 5y ago
Yes! SSNs are already not private given the number of hacks that have occured. Today, the real damage comes from the fact that people/businesses still believe they are private. Publish a list of all SSNs would eliminate the misperception once and for all and force people to verify identity in a better way. SSNs should only ever be used for your employer knows how to report who paid what taxes to the IRS. If someone else wants to use my SSN to claim that they paid my taxes, fine with me!
- barbazoo 5y ago
  Not sure if it's a problem of perception or just the lack of legal responsibility. As long as the legal and financial risk isn't owned by the party using the SSN for a purpose they shouldn't (identification), nothing will change.
  - rory 5y ago
    100%. The very concept of "identity theft" feels like corporate newspeak to shift the onus of remediation from the party that actually got defrauded (the company) to someone uninvolved in the transaction.
  - ryanlol 5y ago
    How is the financial risk not owned by the party using the SSN for identification? Guess who ends up footing the bill when a bank gives a loan to someone pretending to be you? Hint: It’s not you, and it’s not the fraudster either.
- nybble41 5y ago
  > SSNs should only ever be used for your employer knows how to report who paid what taxes to the IRS. If someone else wants to use my SSN to claim that they paid my taxes, fine with me! That could go the other way, with someone else filing their income under your SSN without any corresponding withholding. This, too, needs better authentication than a mere SSN can provide.
mancerayder 5y ago
I agree, but I am afraid that our two party system, which is incentivized to 'politicize' (I dislike that broad term) everything, it would be quite hard. The one party proposes it, the other party will find "reasons" why it's either government overreach, or discriminatory, or something something something depending on the ideology. Purported ideology. Most likely it's another horse that gets debated in debates about a package of other things. But yes, I wish we could be as modern as some European countries. I haven't heard of these identity theft issues in France, where everyone has a national identity card.
- barbazoo 5y ago
  In Germany the postal service does what GP described by validating someone's identity for various purposes > Deutsche Post offers a secure identity check service – to millions of users every year. > On behalf of your contracting party > To ensure that only identified persons have access to sensitive services > To sensitive services including those from the financial services sector (such as opening an online bank account), telecommunications (activating a prepaid SIM card), health care (access to health information) or the mobility industry (including car sharing). https://www.deutschepost.de/en/p/postident.html https://www.deutschepost.de/en/p/postident.html
  - EvanAnderson 5y ago
    Stories about foreign countries and their societal infrastructure, as an American, make me really envious and sad for my country's state of affairs. It's kind of like the feeling I get looking at somebody with a very nice car or house: "Oh, it would be neat to have such a thing but there's no way I'd ever splurge and get that." It's difficult for me to conceive of some things other countries have as just being "normal".
    - mistrial9 5y ago
      it is selection bias -- the people with miserable and oppressive systems do not report it in detail, in English, on YNews right? second, many systems of law treat individuals quite differently.. many systems that are not repeated in detail, on YNews, do not give much choice to an individual by design
SevenSigs 5y ago
Maybe we need to tell each individual company that our SSN is public when they ask for it and why they rely on it to identify me... another form of ID that they like to use when you apply for credit is previous addresses/cars/etc... as if that isn't public.
codegeek 5y ago
I would say that most Identify Theft issues will be resolved if you are forced to do a 5 min video verification call. I can show my ID (DL, Real ID etc) just like I can do in person. It may add a little bit of hassle but I would trade that for peace of mind that some random person cannot steal my identity that easy just because they know my DOB, SSN etc and can fill out an online form etc. The video call can easily weed out the scammers especially because a lot of ID thefts happen where a young person is stealing an older person's identity or vice versa or it is a different Gender etc.
gumby 5y ago
In Sweden the personnumber is public info and there is no value to keeping it secret. Everything works fine there.
codegeek 5y ago
I think that we need to somehow make it harder for companies to request SSN if that continues to be a "secret". I cannot tell you how many times a Doctor's office casually asks for an SSN on a sheet of paper in plain text and I am like Why. I always fight that and found out that in a lot of cases, they just have it there and they didn't care when I didn't fill it. Some of them do force me (probably for credit/billing reasons) but I always try not to fill it out. Also why are these phone companies persisting SSNs in database ? Why can't they run the credit check initially and discard the SSN. There should be laws around this and enforced. It is time to hold these companies accountable. We are so tired of being worried that our ID may get stolen.
- jader201 5y ago
  Ironically, having it in plain text on a piece of paper in some random doctor’s office is much more secure than having it hashed in some website’s database. Possibly even more secure than that same doctor having it in their system.
  - silisili 5y ago
    Good point. But realize it's only on that paper for a few mins before being typed into their system. Doctor's offices are so archaic at times. Only a handful let me do the forms online in advance. And even those have more paper for me to waste when I arrive.
    - undersuit 5y ago
      A public system to enter data into, probably some sort of SAS or COT for most practices, has got to introduce far more insecurities than having the clerical staff enter it into the same backend the public system has to interact with.
  - georgyo 5y ago
    Dumpster diving is a thing. In almost all cases, someone is entering what you hand wrote into a system; and then they discard the paper copy. If they shred it that's great, but dumpster diving at medical offices has made the news many many times.
hanniabu 5y ago
Should have it where your social security is a public key and government has your private key. You're given a device that has your private key to confirm things but you don't know it directly. Public key is used in replace of discussi security number. If your public key gets compromised the government blacklists it and gives you a new one. This is just a knee-jerk thought and I'm sure it can be improved, but I believe asymmetric keys are the solution.
- mikestew 5y ago
  If your public key gets compromised... Do you mean private key? Or am I about to have a TIL moment? Because your public key is, well, public so I wonder what a compromise of that would look like.
- discardable_dan 5y ago
  Nah, one-time pad with government verification for third parties. Keep it rolling.
- t0mbstone 5y ago
  You have it totally backwards. Public keys are called public keys because they are intended to be public. You should be able to freely advertise a public key on a billboard. On the other hand, you can't really expect the average citizen to properly curate a private key, and a private key also doesn't work for verification purposes. I think the problem would be easily solved without encryption or keys by using the social security number in combination with a user-selected PIN number. Any time you apply for credit somewhere, you should have to provide the social and a PIN. There should also be an easy way to generate single-use PIN numbers that can be used when applying for credit. They already have a lot of the infrastructure for doing this. You can already put a credit freeze on your social security number and protect the credit freeze with a PIN, for example. Whenever I am applying for credit, I simply "thaw" out my social security number for a couple of days. This works pretty well, but it's a hassle because you have to do it for all three agencies. It also suffers from the problem that my credit could get compromised if I left it thawed out too long.
zug_zug 5y ago
Proposed alternative - you get your own private-key as an identifier. Nobody ever can ask for the private key, they can only ask for a signed message that proves identity. Thus a lot of categories of fraud are no longer possible because there is no shared reusable number in the event of a leak.
- sillysaurusx 5y ago
  What do you do when you lose your private key? Who issues the private key? "get" implies it comes from somewhere, i.e. a CA system. If the government is the CA system, and your private key is your identity, how do you establish your identity in the event that you lost your key? The nice thing about SSNs being immutable is that none of these are concerns. (It's also the bad thing about SSNs being immutable.)
  - azinman2 5y ago
    That and I can memorize my SSN. We do have one thing in the US that’s physical proof, and that’s your birth certificate. But I’m sure people lose them and they can be pretty easily fabricated.
- discardable_dan 5y ago
  In Denmark, you are issued a one-time pad. You get a new one with some frequency. If you lose it, you are issued a new one. In that case, third parties could use a government website to get a row/col and ask you to verify, and the website could say yes/no. Yes, there is a risk of your one-time pad being stolen, but it is no greater than the current risk that any US citizen's tax documents or SS card can be stolen.
  - xxpor 5y ago
    How do they bootstrap the verification when you say you lost your key?
    - discardable_dan 5y ago
xur17 5y ago
It seems like someone could do us all a public service by combining a few of these lists and making a very public and hard to take down website with them all listed. Create a forcing function for a replacement. Not recommending anyone do this as it's obviously illegal, but..
- squeaky-clean 5y ago
  I still doubt much would come of it until someone began to target lawmakers with it.
- smorgusofborg 5y ago
  I'm not sure if it is illegal since the US expends a lot of energy keeping privacy rights out of its civil rights.. But it would be a chore to process gdpr requests from dual citizens, etc.
- meowster 5y ago
  What laws make it illegal for a regular person to republish a list of SSNs and corresponding names?
ryanlol 5y ago
> After that date all liability for fraud perpetrated using an SSN as a shared "secret" will be assigned to the party who accepted the SSN as "authentication". lol. How do you think it works right now? The party who accepted the SSN (or their insurance) is liable for footing the bill for the fraud, except in the ridiculously unlikely scenario where they’d manage to collect money from the fraudster.
nashashmi 5y ago
Interesting point of view. Maybe ssn should be used for authentication purposes. Give SSN. Get email txt or notification to verify. SSN service replies back with a real Id number. Real id number is used for banking.
tshaddox 5y ago
> After that date all liability for fraud perpetrated using an SSN as a shared "secret" will be assigned to the party who accepted the SSN as "authentication". That would solve the problem. Except that the problem isn't which party is legally liable. The problem is that the legal system is almost entirely inaccessible to the vast majority of people.
babyshake 5y ago
It's really simple to those of us who do any work at all with authentication. If you share it with anyone, it's not a secret.

rafale 5y ago

What are we gonna use instead? Hardware keys, like Ledger but for ID?

gruez 5y ago
That's basically what some countries have: IDs with a smartcard built in which functions like a HSM
dredmorbius 5y ago
I'm strongly partial to a wearable token. The NFC Ring is one highly attractive option. - It's inobtrusive enough to wear all, or very nearly all of the time. Contrast cards or similar carried-but-not-worn tokens. - It can be readily use to tap a sensor for identification purposes. Contrast cards or similar tokens (e.g., USB keys), which are far less immediate. - It is replaceable. That is, if it's compromised, stolen, or lost, it can be replaced. If it becomes unadvisable to possess, it's readily discarded and reasonably easily destroyed. This contrasts with biometrics or permanently embedded sensors. - Its absence is reasonably immediately determinable. Again, contrast carried-but-not-worn tokens. - The existing prevalence of ring-wearing makes use of an NFC ring less obvious or evident (mostly a concern in early-adoption periods), or the opting-out of wearing one (which ring is the NFC ring?), without directly querying each individual, which ... might not work regardless (depending on implementations). - There are relatively few people who would be entirely unable to use such a device. Ready alternatives for most such cases exist: wrist bands - Unintentional validation (e.g., surveillance) is relatively easily avoided, if devices require immediate contact with a sensor/receiver. That is, a surveillance entity couldn't mass scan a crowd or region quickly, but would have to individually query rings in close proximity. (This might be achieved through high-volume transit points already, but this already raises the ante.) - It's possible with a query/response system that multiple identities with the same root, but not immediately correlated, could be supported. (Deanonymisation or identity linking remains a significant problem, however.) Ideally, such a system could be limited to only satisfying minimum qualifying criteria (e.g., "I've paid a fare for this trip"), rather than transmitting either a full personal dossier or an absolute identity. Key (so to speak) challenges are in agreeing on a single standard, ensuring crytpgraphic robustness, and protecting privacy, surveillance, and other concerns, as well as distributing the detector infrastructure for desired uses.
- EvanAnderson 5y ago
  This all sounds very reasonable, albeit I'm partial to chip-and-PIN for preventing unintentional validation and to render the token useless if lost or stolen. The ring form factor doesn't lend itself to PIN entry, but otherwise it sounds reasonable compelling. (Granted I can't make myself wear a ring without taking it off, fidgeting with it, and ultimately losing it. I've tried, failed, and lost three as a result.)
  - dredmorbius 5y ago
    An NFC ring can still require secondary authentication (e.g., pin) in some contexts. That would be application-dependent. There are cases (e.g., mass-transit turnstiles) where this isn't desirable --- the intent is to maximise throughput. (The quesiton of whether or not validating or fares are a net benefit is also open.) For a more secure facility, or payment system, tag + pin (and potentially other identifiers) would be preferred.

MeinBlutIstBlau 5y ago

I'm at the point where I just want a tattoo or chip embedded in me. Like I'm integrated in the system at this point. I can't exactly go off grid.

55873445216111 5y ago
"How come no tattoo?!"
- Forbo 5y ago
  For those wondering, this is a reference to Idiocracy: https://www.youtube.com/watch?v=BdPmNM0IF7Y https://www.youtube.com/watch?v=BdPmNM0IF7Y I believe the direct quote is "Why come you got no tattoo?"
  - 55873445216111 5y ago
    I am Not Sure.

55873445216111 5y ago

Yes! SSNs are already not private given the number of hacks that have occured. Today, the real damage comes from the fact that people/businesses still believe they are private. Publish a list of all SSNs would eliminate the misperception once and for all and force people to verify identity in a better way. SSNs should only ever be used for your employer knows how to report who paid what taxes to the IRS. If someone else wants to use my SSN to claim that they paid my taxes, fine with me!

barbazoo 5y ago
Not sure if it's a problem of perception or just the lack of legal responsibility. As long as the legal and financial risk isn't owned by the party using the SSN for a purpose they shouldn't (identification), nothing will change.
- rory 5y ago
  100%. The very concept of "identity theft" feels like corporate newspeak to shift the onus of remediation from the party that actually got defrauded (the company) to someone uninvolved in the transaction.
- ryanlol 5y ago
  How is the financial risk not owned by the party using the SSN for identification? Guess who ends up footing the bill when a bank gives a loan to someone pretending to be you? Hint: It’s not you, and it’s not the fraudster either.
nybble41 5y ago
> SSNs should only ever be used for your employer knows how to report who paid what taxes to the IRS. If someone else wants to use my SSN to claim that they paid my taxes, fine with me! That could go the other way, with someone else filing their income under your SSN without any corresponding withholding. This, too, needs better authentication than a mere SSN can provide.

mancerayder 5y ago

I agree, but I am afraid that our two party system, which is incentivized to 'politicize' (I dislike that broad term) everything, it would be quite hard. The one party proposes it, the other party will find "reasons" why it's either government overreach, or discriminatory, or something something something depending on the ideology. Purported ideology. Most likely it's another horse that gets debated in debates about a package of other things. But yes, I wish we could be as modern as some European countries. I haven't heard of these identity theft issues in France, where everyone has a national identity card.

barbazoo 5y ago
In Germany the postal service does what GP described by validating someone's identity for various purposes > Deutsche Post offers a secure identity check service – to millions of users every year. > On behalf of your contracting party > To ensure that only identified persons have access to sensitive services > To sensitive services including those from the financial services sector (such as opening an online bank account), telecommunications (activating a prepaid SIM card), health care (access to health information) or the mobility industry (including car sharing). https://www.deutschepost.de/en/p/postident.html https://www.deutschepost.de/en/p/postident.html
- EvanAnderson 5y ago
  Stories about foreign countries and their societal infrastructure, as an American, make me really envious and sad for my country's state of affairs. It's kind of like the feeling I get looking at somebody with a very nice car or house: "Oh, it would be neat to have such a thing but there's no way I'd ever splurge and get that." It's difficult for me to conceive of some things other countries have as just being "normal".
  - mistrial9 5y ago
    it is selection bias -- the people with miserable and oppressive systems do not report it in detail, in English, on YNews right? second, many systems of law treat individuals quite differently.. many systems that are not repeated in detail, on YNews, do not give much choice to an individual by design

SevenSigs 5y ago

Maybe we need to tell each individual company that our SSN is public when they ask for it and why they rely on it to identify me... another form of ID that they like to use when you apply for credit is previous addresses/cars/etc... as if that isn't public.

codegeek 5y ago

I would say that most Identify Theft issues will be resolved if you are forced to do a 5 min video verification call. I can show my ID (DL, Real ID etc) just like I can do in person. It may add a little bit of hassle but I would trade that for peace of mind that some random person cannot steal my identity that easy just because they know my DOB, SSN etc and can fill out an online form etc. The video call can easily weed out the scammers especially because a lot of ID thefts happen where a young person is stealing an older person's identity or vice versa or it is a different Gender etc.

gumby 5y ago

In Sweden the personnumber is public info and there is no value to keeping it secret. Everything works fine there.

codegeek 5y ago

I think that we need to somehow make it harder for companies to request SSN if that continues to be a "secret". I cannot tell you how many times a Doctor's office casually asks for an SSN on a sheet of paper in plain text and I am like Why. I always fight that and found out that in a lot of cases, they just have it there and they didn't care when I didn't fill it. Some of them do force me (probably for credit/billing reasons) but I always try not to fill it out. Also why are these phone companies persisting SSNs in database ? Why can't they run the credit check initially and discard the SSN. There should be laws around this and enforced. It is time to hold these companies accountable. We are so tired of being worried that our ID may get stolen.

jader201 5y ago
Ironically, having it in plain text on a piece of paper in some random doctor’s office is much more secure than having it hashed in some website’s database. Possibly even more secure than that same doctor having it in their system.
- silisili 5y ago
  Good point. But realize it's only on that paper for a few mins before being typed into their system. Doctor's offices are so archaic at times. Only a handful let me do the forms online in advance. And even those have more paper for me to waste when I arrive.
  - undersuit 5y ago
    A public system to enter data into, probably some sort of SAS or COT for most practices, has got to introduce far more insecurities than having the clerical staff enter it into the same backend the public system has to interact with.
- georgyo 5y ago
  Dumpster diving is a thing. In almost all cases, someone is entering what you hand wrote into a system; and then they discard the paper copy. If they shred it that's great, but dumpster diving at medical offices has made the news many many times.

hanniabu 5y ago

Should have it where your social security is a public key and government has your private key. You're given a device that has your private key to confirm things but you don't know it directly. Public key is used in replace of discussi security number. If your public key gets compromised the government blacklists it and gives you a new one. This is just a knee-jerk thought and I'm sure it can be improved, but I believe asymmetric keys are the solution.

mikestew 5y ago
If your public key gets compromised... Do you mean private key? Or am I about to have a TIL moment? Because your public key is, well, public so I wonder what a compromise of that would look like.
discardable_dan 5y ago
Nah, one-time pad with government verification for third parties. Keep it rolling.
t0mbstone 5y ago
You have it totally backwards. Public keys are called public keys because they are intended to be public. You should be able to freely advertise a public key on a billboard. On the other hand, you can't really expect the average citizen to properly curate a private key, and a private key also doesn't work for verification purposes. I think the problem would be easily solved without encryption or keys by using the social security number in combination with a user-selected PIN number. Any time you apply for credit somewhere, you should have to provide the social and a PIN. There should also be an easy way to generate single-use PIN numbers that can be used when applying for credit. They already have a lot of the infrastructure for doing this. You can already put a credit freeze on your social security number and protect the credit freeze with a PIN, for example. Whenever I am applying for credit, I simply "thaw" out my social security number for a couple of days. This works pretty well, but it's a hassle because you have to do it for all three agencies. It also suffers from the problem that my credit could get compromised if I left it thawed out too long.

zug_zug 5y ago

Proposed alternative - you get your own private-key as an identifier. Nobody ever can ask for the private key, they can only ask for a signed message that proves identity. Thus a lot of categories of fraud are no longer possible because there is no shared reusable number in the event of a leak.

sillysaurusx 5y ago
What do you do when you lose your private key? Who issues the private key? "get" implies it comes from somewhere, i.e. a CA system. If the government is the CA system, and your private key is your identity, how do you establish your identity in the event that you lost your key? The nice thing about SSNs being immutable is that none of these are concerns. (It's also the bad thing about SSNs being immutable.)
- azinman2 5y ago
  That and I can memorize my SSN. We do have one thing in the US that’s physical proof, and that’s your birth certificate. But I’m sure people lose them and they can be pretty easily fabricated.
discardable_dan 5y ago
In Denmark, you are issued a one-time pad. You get a new one with some frequency. If you lose it, you are issued a new one. In that case, third parties could use a government website to get a row/col and ask you to verify, and the website could say yes/no. Yes, there is a risk of your one-time pad being stolen, but it is no greater than the current risk that any US citizen's tax documents or SS card can be stolen.
- xxpor 5y ago
  How do they bootstrap the verification when you say you lost your key?
  - discardable_dan 5y ago

xur17 5y ago

It seems like someone could do us all a public service by combining a few of these lists and making a very public and hard to take down website with them all listed. Create a forcing function for a replacement. Not recommending anyone do this as it's obviously illegal, but..

squeaky-clean 5y ago
I still doubt much would come of it until someone began to target lawmakers with it.
smorgusofborg 5y ago
I'm not sure if it is illegal since the US expends a lot of energy keeping privacy rights out of its civil rights.. But it would be a chore to process gdpr requests from dual citizens, etc.
meowster 5y ago
What laws make it illegal for a regular person to republish a list of SSNs and corresponding names?

ryanlol 5y ago

> After that date all liability for fraud perpetrated using an SSN as a shared "secret" will be assigned to the party who accepted the SSN as "authentication". lol. How do you think it works right now? The party who accepted the SSN (or their insurance) is liable for footing the bill for the fraud, except in the ridiculously unlikely scenario where they’d manage to collect money from the fraudster.

nashashmi 5y ago

Interesting point of view. Maybe ssn should be used for authentication purposes. Give SSN. Get email txt or notification to verify. SSN service replies back with a real Id number. Real id number is used for banking.

tshaddox 5y ago

> After that date all liability for fraud perpetrated using an SSN as a shared "secret" will be assigned to the party who accepted the SSN as "authentication". That would solve the problem. Except that the problem isn't which party is legally liable. The problem is that the legal system is almost entirely inaccessible to the vast majority of people.

babyshake 5y ago

It's really simple to those of us who do any work at all with authentication. If you share it with anyone, it's not a secret.