4 ms·

Does the SSN not mostly fulfill that need? Edit: The SSN seems a lot like JavaScript at this point. Y'all are talking about how you would never use it for anyt

Does the SSN not mostly fulfill that need? Edit: The SSN seems a lot like JavaScript at this point. Y'all are talking about how you would never use it for anything and yet it's the one thing everyone is using for identity verification these days.

toomuchtodo 5y ago
No, it doesn't. It's not meant as a secure identifier and it doesn't provide for identity proofing. A national ID systems, as only_as_i_fall stated, is required. A previous comment I wrote on this topic: https://news.ycombinator.com/item?id=28280851 https://news.ycombinator.com/item?id=28280851 Someone in the trenches wrote about it: https://billhunt.dev/blog/2020/12/18/federal-policy-recs/#4-solve-identity-once-and-for-all https://billhunt.dev/blog/2020/12/18/federal-policy-recs/#4-...
- duxup 5y ago
  I recall an interview with someone in charge of the Social Security Administration about how they were constantly asked about various issues surrounding SSNs and he had to constantly respond "It wasn't meant for this, it wasn't built for it, it's not used in a consistent way that we could do that, and I'm not sure you want the Social Security administration to be in charge of that, that's not what we even do..."
  - toomuchtodo 5y ago
    Indeed. Interestingly enough, they support Login.gov (a USDS/18F/GSA identity project) as an identity provider service [1] :) I keep poking government agencies who don't support it. Some are easier, some are harder. Some I have to go talk to legislators about appropriations to extend their applications to include the support. A necessary schlep. [1] https://secure.ssa.gov/RIL/SiView.action https://secure.ssa.gov/RIL/SiView.action
    - ceejayoz 5y ago
      Login.gov is shockingly well done. Multiple U2F keys, gives clear reasons why SMS is less optimal than U2F/TOTP, very clear flow.
      - deleted 5y ago
        [deleted]
      - tyingq 5y ago
        The US Digital Service seems to have benefitted from having real technologists run it. The current leader is Matt Cutts, the former public face of Google's anti-spam efforts for search.
        rbanffy 5y ago
        I remember in my interactions with the White House petitions site folk (when I worked for Avaaz and helped integrate both systems) always impressed me as being very smart and dedicated. Sadly, at some point (during the Trump administration) I lost my White House Github badge. I thought it was quite cool.
        toomuchtodo 5y ago
        Matt Cutts’ tenure recently ended, and Mina Hsiang has assumed his role as head of USDS. https://news.ycombinator.com/item?id=28390511 https://news.ycombinator.com/item?id=28390511
- sombremesa 5y ago
  To add to this, an SSN seems to be pretty carelessly shared these days — I recently had an interaction with a government official where they just asked me for it, and of course there's plenty of forms both online and offline where you need to share it. If I saw that someone printed a form with their SSN on the office printer and forgot to pick it up, I'd just set it aside without a second thought, because it just isn't something that makes one think "red alarm fire". Contrast this with something like a private key, which never leaves your possession and is never shared directly, just used for signing. Unfortunately most non-technical people have no concept of such a thing, apart from...stamps and seals? The chip on a credit card might count, but it doesn't seem like people care about losing possession of that too much either.
  - toomuchtodo 5y ago
    > Contrast this with something like a private key, which never leaves your possession and is never shared directly, just used for signing. Unfortunately most non-technical people have no concept of such a thing, apart from...stamps and seals? The chip on a credit card might count, but it doesn't seem like people care about losing possession of that too much either. So, consider how Apple is about to handle state IDs and driver's licenses with iOS 15. It's what you describe, mostly. Not a private key, but identity built on crypto, with a UX that doesn't suck. We're getting there. https://9to5mac.com/2021/07/27/ios-15-apple-implementing-security-verification-with-selfies-to-validate-id-cards-in-the-wallet-app/ https://9to5mac.com/2021/07/27/ios-15-apple-implementing-sec...
sonicggg 5y ago
It was never meant to be used as such. Its adoption as an identifier is the worst "hack" I've seen. I hate how businesses trust it as sort of some password. It's ridiculous how much damage a scammer can do by using your SSN. Like it's a freaking plain text number. At this point it really should not be used for anything at all, and we should just assume that our SSN is public knowledge. I think we have the technology and means to come up with something better.
GeneralMayhem 5y ago
Absolutely not. An SSN is at best a username. It's not a password. It doesn't even have a checksum in it - my library card number is is literally more secure than my SSN.
ironmagma 5y ago
We use it for identification because there’s no alternative. Hence the suggestion to create an alternative.
ajsnigrutin 5y ago
What happens when someone hacks some government database and leaks the whole "first name - last name - ssn" datbase?

toomuchtodo 5y ago

No, it doesn't. It's not meant as a secure identifier and it doesn't provide for identity proofing. A national ID systems, as only_as_i_fall stated, is required. A previous comment I wrote on this topic: https://news.ycombinator.com/item?id=28280851 https://news.ycombinator.com/item?id=28280851 Someone in the trenches wrote about it: https://billhunt.dev/blog/2020/12/18/federal-policy-recs/#4-solve-identity-once-and-for-all https://billhunt.dev/blog/2020/12/18/federal-policy-recs/#4-...

duxup 5y ago
I recall an interview with someone in charge of the Social Security Administration about how they were constantly asked about various issues surrounding SSNs and he had to constantly respond "It wasn't meant for this, it wasn't built for it, it's not used in a consistent way that we could do that, and I'm not sure you want the Social Security administration to be in charge of that, that's not what we even do..."
- toomuchtodo 5y ago
  Indeed. Interestingly enough, they support Login.gov (a USDS/18F/GSA identity project) as an identity provider service [1] :) I keep poking government agencies who don't support it. Some are easier, some are harder. Some I have to go talk to legislators about appropriations to extend their applications to include the support. A necessary schlep. [1] https://secure.ssa.gov/RIL/SiView.action https://secure.ssa.gov/RIL/SiView.action
  - ceejayoz 5y ago
    Login.gov is shockingly well done. Multiple U2F keys, gives clear reasons why SMS is less optimal than U2F/TOTP, very clear flow.
    - deleted 5y ago
      [deleted]
    - tyingq 5y ago
      The US Digital Service seems to have benefitted from having real technologists run it. The current leader is Matt Cutts, the former public face of Google's anti-spam efforts for search.
      - rbanffy 5y ago
        I remember in my interactions with the White House petitions site folk (when I worked for Avaaz and helped integrate both systems) always impressed me as being very smart and dedicated. Sadly, at some point (during the Trump administration) I lost my White House Github badge. I thought it was quite cool.
      - toomuchtodo 5y ago
        Matt Cutts’ tenure recently ended, and Mina Hsiang has assumed his role as head of USDS. https://news.ycombinator.com/item?id=28390511 https://news.ycombinator.com/item?id=28390511
sombremesa 5y ago
To add to this, an SSN seems to be pretty carelessly shared these days — I recently had an interaction with a government official where they just asked me for it, and of course there's plenty of forms both online and offline where you need to share it. If I saw that someone printed a form with their SSN on the office printer and forgot to pick it up, I'd just set it aside without a second thought, because it just isn't something that makes one think "red alarm fire". Contrast this with something like a private key, which never leaves your possession and is never shared directly, just used for signing. Unfortunately most non-technical people have no concept of such a thing, apart from...stamps and seals? The chip on a credit card might count, but it doesn't seem like people care about losing possession of that too much either.
- toomuchtodo 5y ago
  > Contrast this with something like a private key, which never leaves your possession and is never shared directly, just used for signing. Unfortunately most non-technical people have no concept of such a thing, apart from...stamps and seals? The chip on a credit card might count, but it doesn't seem like people care about losing possession of that too much either. So, consider how Apple is about to handle state IDs and driver's licenses with iOS 15. It's what you describe, mostly. Not a private key, but identity built on crypto, with a UX that doesn't suck. We're getting there. https://9to5mac.com/2021/07/27/ios-15-apple-implementing-security-verification-with-selfies-to-validate-id-cards-in-the-wallet-app/ https://9to5mac.com/2021/07/27/ios-15-apple-implementing-sec...

sonicggg 5y ago

It was never meant to be used as such. Its adoption as an identifier is the worst "hack" I've seen. I hate how businesses trust it as sort of some password. It's ridiculous how much damage a scammer can do by using your SSN. Like it's a freaking plain text number. At this point it really should not be used for anything at all, and we should just assume that our SSN is public knowledge. I think we have the technology and means to come up with something better.

GeneralMayhem 5y ago

Absolutely not. An SSN is at best a username. It's not a password. It doesn't even have a checksum in it - my library card number is is literally more secure than my SSN.

ironmagma 5y ago

We use it for identification because there’s no alternative. Hence the suggestion to create an alternative.

ajsnigrutin 5y ago

What happens when someone hacks some government database and leaks the whole "first name - last name - ssn" datbase?