2 ms·

> legislation that has actual fangs, for companies like Equifax. It should be a potential bankruptcy event when you leak most of America's social security numbe

> legislation that has actual fangs, for companies like Equifax. It should be a potential bankruptcy event when you leak most of America's social security numbers Immutable identifiers should never have this much weight. When your encryption key is compromised, you roll it. When your SSN is leaked, you're doing damage control for the rest of your life. This problem did not begin with Equifax. It's a 7-digit number that encoded most people's birth region in it until two decades ago and gets asked for by all sorts of randos having anything to do with finance. The problem here is that something so readily shared and easily compromised and impossible to change has this much weight in our identification protocols.

bruce511 3y ago
You are not wrong, but I'd argue that mutable ID methods would be worse. Ok, context and perspective will matter a lot here. If you are wanting to hide from authority then mutable id sounds good. If you are wanting to "know the history" of a person then mutable is bad. In our social contract the "inability" to change id is baked into the way be behave, and the consequences for bad behavior. Equally there are lots of good reasons to be able to get a quick history of say a prospective employee, loan recipient, tennant, supplier, customer, and so on. If I can apply for a new Social Security number every month/year then that number does become useless as a form of id. But it would then just need to be replaced with something else. Too much of what we do is predicated on our historical behavior. Having a 12-month limit on identity would break, well, just about any kind of contract. And in most contract situations uou most definitely want to know "who" you are contracting with.
jchw 3y ago
I truly feel that is neither here nor there. As long as we don't fix what's wrong with Equifax, we can trust absolutely nothing to stay private with them or similar entities for any substantial amount of time. Therefore, we actually need to fix this problem anyways. Having just one of these fixed will not solve much. I am receiving approximately one parcel per month informing me of a new data breach.

bruce511 3y ago

You are not wrong, but I'd argue that mutable ID methods would be worse. Ok, context and perspective will matter a lot here. If you are wanting to hide from authority then mutable id sounds good. If you are wanting to "know the history" of a person then mutable is bad. In our social contract the "inability" to change id is baked into the way be behave, and the consequences for bad behavior. Equally there are lots of good reasons to be able to get a quick history of say a prospective employee, loan recipient, tennant, supplier, customer, and so on. If I can apply for a new Social Security number every month/year then that number does become useless as a form of id. But it would then just need to be replaced with something else. Too much of what we do is predicated on our historical behavior. Having a 12-month limit on identity would break, well, just about any kind of contract. And in most contract situations uou most definitely want to know "who" you are contracting with.

jchw 3y ago

I truly feel that is neither here nor there. As long as we don't fix what's wrong with Equifax, we can trust absolutely nothing to stay private with them or similar entities for any substantial amount of time. Therefore, we actually need to fix this problem anyways. Having just one of these fixed will not solve much. I am receiving approximately one parcel per month informing me of a new data breach.