4 ms·

Seems like we should stop treating SSN user id like a password

mjevans 5y ago
SSN is current the _defacto_, unplanned, person ID and somehow also password. I agree this is insane. A National ID, that is designed to more strongly prove ID and also designed to be used as a secure form of Authentication for Authorization services... THAT is what I'd really love politicians to approve. I'm currently in the process of upgrading my enhanced ID drivers license to a Passport (done) and then applying for Global Entry, because it's only 15 more dollars than the TSA Precheck and includes it... so why not do that? That's my response to a lack of a national ID.
- mindslight 5y ago
  Until there are laws putting a stop to the ongoing abuse of the current identification system by commercial surveillance (ala GDPR), a stronger identification system is a non-starter.
  - mcny 5y ago
    My ask is much smaller. Any document that the law requires you to carry has to be free of cost to the person and it must be convenient to get (or get again if lost or stolen). That means both the first issue and subsequent issues need to always be free of cost. If I need to visit some office to get it, such office must be at least as ubiquitous as a United States Postal Service office, and ideally more open hours, not less. I don't think there is either the will or the budget to do this. This will be a very expensive continuous undertaking, not a one time expensive. My personal opinion is this money should go toward medicare for all. I strongly dislike means testing (medicaid?) or age testing (medicare). I'm sure people can find better use for the money it will take to fund a national ID.
    - Joker_vD 5y ago
      > a very expensive continuous undertaking "Very expensive"? Sure, if you allow private subcontractors to charge $2500 for printing and laminating a 60x92 mm piece of plastic, it will be very expensive, no doubt about that. But it does not have to be that way, as the experience of many other countries with mandatory government-issued IDs shows.
    - mindslight 5y ago
      If I'm reading you right, that's kind of a weird argument. Paraphrasing - removing fees for mandatory government services would cost too much for this one thing, and here is a better specific use for the money instead. Rather there is a whole spectrum of better and worse uses for public money, and we generally debate each on its own merits. But either way it doesn't really address the core of what I said, in that the system currently mandated by the government has strongly benefited the surveillance industry. For example SSNs were never supposed to be used for anything besides Social Security, but a law prohibiting such abuse was never passed.
- inter_netuser 5y ago
  or maybe it was planned to evolve that way? just another happy accident.
- hangonhn 5y ago
  I have always suspected that TSA Precheck and Global Entry were always the goal. Make the non TSA Precheck line so unbearable until most travelers agree to a background check and apply for TSA Precheck or Global Entry, which is probably way more effective than most of the security they do at the airports.
- herbstein 5y ago
  > A National ID, that is designed to more strongly prove ID and also designed to be used as a secure form of Authentication for Authorization services... I can share that here in Denmark we have a system exactly like that, and have for more than a decade. It's called "NemID" (lit: EasyID), soon to be changed to "MitId" (lit: MyID). While there definitely are some problems with the current implementation, having a 2-factor auth solution in front of every government, banking, insurance, etc. web service is very helpful. [0] Keep in mind that my only interaction with individuals from the government, on the phone or otherwise, is when picking up books at the library and renewing my passport. Everything from filing my taxes through registering a child for school to reporting a move is done with a NemID login and a simple, guided form. [1] My taxes are pre-filled with the information they've already gathered from my employer and the bank through which I handle my stock portfolio. The only thing I manually have to put in is my union fees and how many times I drove to the office -- both giving me a sizable deduction. Doing my taxes at the end of the year is simply a formality too. At the start of the year I do an advance statement with what I expect to earn, and my monthly taxes are automatically pulled based on that. The end-of-year tax calculation is to ensure I didn't pay too much or too little -- the difference being due either way in April. All of this to say -- a sane, digitized interaction with public institutions is not only a possibility but a fact in certain countries. [0]: https://en.wikipedia.org/wiki/NemID https://en.wikipedia.org/wiki/NemID -- the entry is critical but not unfair. The MitID changes mitigate many of the big points. [1]: https://lifeindenmark.borger.dk/ https://lifeindenmark.borger.dk/ -- It's both a "guide to Denmark" but also has the aforementioned forms. Try going through the "Health insurance card" order flow. You can't accidentally order one without a login.
  - ubercore 5y ago
    Just moved to Norway and it's been very eye-opening seeing how easy BankID (their equivalent) makes most things in life. Only problem has been that I'm 5 months in and still don't have my ID number so I'm locked out of most aspects of life still (can't even open a bank account).
    - whizzter 5y ago
      Yeah, this is a recurring theme for immigrants in these countries (esp here in Sweden where the immigration agency has been backstopped since the big 2015 refugee influx). You can get a temporary "coordination ID" that healthcare,etc can use to register your journals but Bank's doesn't always let you create accounts without personal ID numbers (and specifically no BankID's so you're locked out of all the modern digital niceties and sometimes requirements). The EU has begun a process of creating intercommunication systems* to allow for digital logins when being in other EU countries, no idea if these systems will ever allow for non-EU identifications (that would help enormously for those countries that has gotten far along). * eIDAS , https://en.wikipedia.org/wiki/EIDAS https://en.wikipedia.org/wiki/EIDAS
- wtf_is_up 5y ago
  This already exists and has been in use for over a decade in DoD. It would be great if it was extended outside of DoD. https://en.m.wikipedia.org/wiki/Common_Access_Card https://en.m.wikipedia.org/wiki/Common_Access_Card
  - mcguire 5y ago
    It's common throughout the federal government, known as the PIV (Personal Identity Verification) badge/credential/whatever. (Except possibly for JPL because a) they're not really part of NASA and b) they filed a lawsuit. (https://hspd12jpl.org/ https://hspd12jpl.org/)
cjsawyer 5y ago
It’s an ID treated as a private key. We desperately need a better system.
- sneak 5y ago
  I think you mean password. Private keys do not work that way.

SSN is current the _defacto_, unplanned, person ID and somehow also password. I agree this is insane. A National ID, that is designed to more strongly prove ID and also designed to be used as a secure form of Authentication for Authorization services... THAT is what I'd really love politicians to approve. I'm currently in the process of upgrading my enhanced ID drivers license to a Passport (done) and then applying for Global Entry, because it's only 15 more dollars than the TSA Precheck and includes it... so why not do that? That's my response to a lack of a national ID.

mindslight 5y ago
Until there are laws putting a stop to the ongoing abuse of the current identification system by commercial surveillance (ala GDPR), a stronger identification system is a non-starter.
- mcny 5y ago
  My ask is much smaller. Any document that the law requires you to carry has to be free of cost to the person and it must be convenient to get (or get again if lost or stolen). That means both the first issue and subsequent issues need to always be free of cost. If I need to visit some office to get it, such office must be at least as ubiquitous as a United States Postal Service office, and ideally more open hours, not less. I don't think there is either the will or the budget to do this. This will be a very expensive continuous undertaking, not a one time expensive. My personal opinion is this money should go toward medicare for all. I strongly dislike means testing (medicaid?) or age testing (medicare). I'm sure people can find better use for the money it will take to fund a national ID.
  - Joker_vD 5y ago
    > a very expensive continuous undertaking "Very expensive"? Sure, if you allow private subcontractors to charge $2500 for printing and laminating a 60x92 mm piece of plastic, it will be very expensive, no doubt about that. But it does not have to be that way, as the experience of many other countries with mandatory government-issued IDs shows.
  - mindslight 5y ago
    If I'm reading you right, that's kind of a weird argument. Paraphrasing - removing fees for mandatory government services would cost too much for this one thing, and here is a better specific use for the money instead. Rather there is a whole spectrum of better and worse uses for public money, and we generally debate each on its own merits. But either way it doesn't really address the core of what I said, in that the system currently mandated by the government has strongly benefited the surveillance industry. For example SSNs were never supposed to be used for anything besides Social Security, but a law prohibiting such abuse was never passed.
inter_netuser 5y ago
or maybe it was planned to evolve that way? just another happy accident.
hangonhn 5y ago
I have always suspected that TSA Precheck and Global Entry were always the goal. Make the non TSA Precheck line so unbearable until most travelers agree to a background check and apply for TSA Precheck or Global Entry, which is probably way more effective than most of the security they do at the airports.
herbstein 5y ago
> A National ID, that is designed to more strongly prove ID and also designed to be used as a secure form of Authentication for Authorization services... I can share that here in Denmark we have a system exactly like that, and have for more than a decade. It's called "NemID" (lit: EasyID), soon to be changed to "MitId" (lit: MyID). While there definitely are some problems with the current implementation, having a 2-factor auth solution in front of every government, banking, insurance, etc. web service is very helpful. [0] Keep in mind that my only interaction with individuals from the government, on the phone or otherwise, is when picking up books at the library and renewing my passport. Everything from filing my taxes through registering a child for school to reporting a move is done with a NemID login and a simple, guided form. [1] My taxes are pre-filled with the information they've already gathered from my employer and the bank through which I handle my stock portfolio. The only thing I manually have to put in is my union fees and how many times I drove to the office -- both giving me a sizable deduction. Doing my taxes at the end of the year is simply a formality too. At the start of the year I do an advance statement with what I expect to earn, and my monthly taxes are automatically pulled based on that. The end-of-year tax calculation is to ensure I didn't pay too much or too little -- the difference being due either way in April. All of this to say -- a sane, digitized interaction with public institutions is not only a possibility but a fact in certain countries. [0]: https://en.wikipedia.org/wiki/NemID https://en.wikipedia.org/wiki/NemID -- the entry is critical but not unfair. The MitID changes mitigate many of the big points. [1]: https://lifeindenmark.borger.dk/ https://lifeindenmark.borger.dk/ -- It's both a "guide to Denmark" but also has the aforementioned forms. Try going through the "Health insurance card" order flow. You can't accidentally order one without a login.
- ubercore 5y ago
  Just moved to Norway and it's been very eye-opening seeing how easy BankID (their equivalent) makes most things in life. Only problem has been that I'm 5 months in and still don't have my ID number so I'm locked out of most aspects of life still (can't even open a bank account).
  - whizzter 5y ago
    Yeah, this is a recurring theme for immigrants in these countries (esp here in Sweden where the immigration agency has been backstopped since the big 2015 refugee influx). You can get a temporary "coordination ID" that healthcare,etc can use to register your journals but Bank's doesn't always let you create accounts without personal ID numbers (and specifically no BankID's so you're locked out of all the modern digital niceties and sometimes requirements). The EU has begun a process of creating intercommunication systems* to allow for digital logins when being in other EU countries, no idea if these systems will ever allow for non-EU identifications (that would help enormously for those countries that has gotten far along). * eIDAS , https://en.wikipedia.org/wiki/EIDAS https://en.wikipedia.org/wiki/EIDAS
wtf_is_up 5y ago
This already exists and has been in use for over a decade in DoD. It would be great if it was extended outside of DoD. https://en.m.wikipedia.org/wiki/Common_Access_Card https://en.m.wikipedia.org/wiki/Common_Access_Card
- mcguire 5y ago
  It's common throughout the federal government, known as the PIV (Personal Identity Verification) badge/credential/whatever. (Except possibly for JPL because a) they're not really part of NASA and b) they filed a lawsuit. (https://hspd12jpl.org/ https://hspd12jpl.org/)

cjsawyer 5y ago

It’s an ID treated as a private key. We desperately need a better system.

sneak 5y ago
I think you mean password. Private keys do not work that way.