I wonder how many enormous breaches of so-called sensitive information it will take for infrastructural security to improve. Like I think at this point it's rea

I wonder how many enormous breaches of so-called sensitive information it will take for infrastructural security to improve. Like I think at this point it's reasonable to assume that most SSNs are public information, and dates of birth arguably always were. Why do important services still use this as a final word authentication for any individual? Why is it legal for a person's credit score for example to affect things like mortgage applications, when these measures are permanently affected by identity theft that could happen to anyone at any time through the fault of one of any number of irresponsible companies that routinely hold enough information to impersonate someone to both the government and their bank (setting aside for a moment how fraudulent and irresponsible the practices of the aggregators of these scores are themselves).