10 ms·

At this point, we should just make the name -> SSN mapping public information by some deadline. They’ve proven to be an uncontrollable secret time and again. Th

by teeray 3y ago

At this point, we should just make the name -> SSN mapping public information by some deadline. They’ve proven to be an uncontrollable secret time and again. The answer is to make SSNs completely worthless to fraudsters.

lcnPylGDnU4H9OF 3y ago
They're already public, including the name map. Nothing difficult needs to happen other than to convince the general public -- and institutional support staff -- that SSNs are not private information which can be used to securely verify a person's identity.
- ars 3y ago
  Autozone is not using SSN to verify identity, they use it to report taxable income. (They don't collect SSN from customers, it's from employees.) What would you do instead of SSN? Or how would you change the process of providing a number for income tax purposes?
  - kulahan 3y ago
    I think you're pushing upon an idea that's philosophically more significant than "how do we fix/replace SSNs". We really need to start talking about how to verify who a human actually is. I don't see a future where we just have to remember some shitty, leakable password when more and more things are entering some sort of password-based trust system. I have no ideas for implementation, I just think we're having the wrong conversation.
  - lcnPylGDnU4H9OF 3y ago
    You might sometimes see people say that a SSN is both a username and a password. What they mean is that it’s used both for unique identification as well as authentication; imagine if your email address was also necessarily the password for your email. There’s nothing wrong with having the identifier. What’s wrong is treating the identifier as though only the person it identifies knows it, which is patently false because that would make it useless as an identifier. As for what I’d do instead: create an application that is fully managed by the IRS and let me login with some combination of a client certificate, password, U2F device, TOTP, et. al. Have the IRS securely implement something like OAuth (I hear “securely” doesn’t quite fit with “OAuth” but they could implement something custom-built if they want to) so I can get the IRS to tell whoever I need them to tell that I am me. Ideally, replace IRS with a purposeful identification organization for these purposes and let the IRS use what this new organization gives them.
    - theultdev 3y ago
      that's https://id.me https://id.me essentially.
      - lcnPylGDnU4H9OF 3y ago
        As a public service, yes.
  - landemva 3y ago
    > What would you do instead of SSN? We could easily avoid this mess of PII honeypots by repealing the federal income tax. The country was not founded with a claim on your labor.

by teeray 3y ago

lcnPylGDnU4H9OF 3y ago

They're already public, including the name map. Nothing difficult needs to happen other than to convince the general public -- and institutional support staff -- that SSNs are not private information which can be used to securely verify a person's identity.

ars 3y ago
Autozone is not using SSN to verify identity, they use it to report taxable income. (They don't collect SSN from customers, it's from employees.) What would you do instead of SSN? Or how would you change the process of providing a number for income tax purposes?
- kulahan 3y ago
  I think you're pushing upon an idea that's philosophically more significant than "how do we fix/replace SSNs". We really need to start talking about how to verify who a human actually is. I don't see a future where we just have to remember some shitty, leakable password when more and more things are entering some sort of password-based trust system. I have no ideas for implementation, I just think we're having the wrong conversation.
- lcnPylGDnU4H9OF 3y ago
  You might sometimes see people say that a SSN is both a username and a password. What they mean is that it’s used both for unique identification as well as authentication; imagine if your email address was also necessarily the password for your email. There’s nothing wrong with having the identifier. What’s wrong is treating the identifier as though only the person it identifies knows it, which is patently false because that would make it useless as an identifier. As for what I’d do instead: create an application that is fully managed by the IRS and let me login with some combination of a client certificate, password, U2F device, TOTP, et. al. Have the IRS securely implement something like OAuth (I hear “securely” doesn’t quite fit with “OAuth” but they could implement something custom-built if they want to) so I can get the IRS to tell whoever I need them to tell that I am me. Ideally, replace IRS with a purposeful identification organization for these purposes and let the IRS use what this new organization gives them.
  - theultdev 3y ago
    that's https://id.me https://id.me essentially.
    - lcnPylGDnU4H9OF 3y ago
      As a public service, yes.
- landemva 3y ago
  > What would you do instead of SSN? We could easily avoid this mess of PII honeypots by repealing the federal income tax. The country was not founded with a claim on your labor.