5 ms·

Exactly. The whole idea that end users are responsible for their stolen "identity" is absurd. It was a successful tactic used by banks and credit bureaus to sh

Exactly. The whole idea that end users are responsible for their stolen "identity" is absurd. It was a successful tactic used by banks and credit bureaus to shed their responsibility of proper verification when opening lines of credit or other accounts.

jimt1234 3y ago
I would go one step further, saying that proper verification is prone to fraud because of failure in government (in the US; not sure about other countries). It still baffles me that identification typically comes down to two things: social security card and driver's license, and both are managed by agencies whose primary objective is not identification. IMHO, it's time for a single agency at either the fed or state level that's in charge of just identification. That's it. Fund that agency and let them do it properly. However, inevitably someone will scream "Big Brother!", and we'll end up back where we started, with this Rube Goldberg system that basically leaves individuals to fend for themselves.
- mindslight 3y ago
  I'll go yet another step further, and say that the main opposition to having a better technical system of government identification is because we're lacking a comprehensive privacy law akin to the GDPR. As it stands if the government started say issuing smart cards for identify verification, then every business would gradually force their customers to identify themselves, for helping the commercial surveillance industry track everything they do. This is the current dynamic with mobile apps, phone numbers, and existing static identifiers, and it's only held back because one can feign not having them and/or being worried about giving out that info. Whereas with actually secure technicals, that friction basically disappears. And so the only way to prevent this dynamic (and make it so better identification isn't itself a security vulnerability) is by gaining the legal right to inspect/audit/reject the collection, use, and storage of such information in the first place.
  - throwway120385 3y ago
    There's also a significant constituency that believes any nationwide system of identity is the "mark of the beast" as spoken of in the Bible.
    - mindslight 3y ago
      It feels like the people who literally believe this as an actual political concern is a vanishingly small contingent, especially given that the ship has already sailed with SSNs and the like, making this more of a partisan talking point strawman. Of course I do respect that the relevant political party has made their whole platform one of stirring up such tempests in teapots instead of focusing on substantive policy. But still regardless of the possible superstitious narratives that objections may end up taking, the best way to eliminate objections is to address the actual practical concerns. And that is chiefly the myriad of ways in which existing identifiers are being abused.
    - GoblinSlayer 3y ago
      Phone numbers already do that.
  - GoblinSlayer 3y ago
    Digital identification can be done correctly, i.e. give business one time pseudonym maybe with one time email pseudonym. Then businesses won't ask for such identification :) Or it can require ATM, which is not frictionless. Businesses already ask for phone numbers anyway. Can it become worse?
    - mindslight 3y ago
      Phone numbers are bad, but of course it could be worse. Phone numbers have both escape hatches (VOIP, shared number burner services, or your own psuedonymous SIM + device ID), and friction (people are wary of businesses spamming them). Pseudonyms don't work for the topic under discussion, issuing credit. And for the general case, since credit issuers would be able to require you to do a non-psuedonym identification, then any other entity can require this as well, unless there were a privacy law. (no idea what you mean by "ATM")
Xymist 3y ago
Strong disagree that such a responsibility exists. I should be able to open a bank account with _nothing_, save perhaps a _de minimis_ initial deposit (one penny, or similar). I can walk into a shop with a handful of cash, buy an item, and leave without anyone knowing who I was. That should be true of any good or service, including banking, that does not require additional data for direct practical reasons related to the provision of the service, e.g. cleaners need to know where you live. "Prevention of fraud/laundering/terrorism/whatever" is not such a reason.
- mindslight 3y ago
  I'm sympathetic to your comment, but we are talking about the issuing of credit. Surely you see that this idea is a non-starter for a bank issuing credit? This is further complicated by US bank accounts including an intrinsic bit of credit from writing checks and other ACH debits.
- MyNameIs_Hacker 3y ago
  That is fine for opening a deposit account. The fraud we're talking about is for obtaining credit or future financial obligations. It is wrong to let this be done with so little proof of identity and enforce the obligation in courts. Banks have notaries of the public. After you have established a relationship with a bank, the notary may have enough evidence to authenticate you for others. If you have continued to use the bank in an anonymous manner, then you should not be authenticated to others.

jimt1234 3y ago

I would go one step further, saying that proper verification is prone to fraud because of failure in government (in the US; not sure about other countries). It still baffles me that identification typically comes down to two things: social security card and driver's license, and both are managed by agencies whose primary objective is not identification. IMHO, it's time for a single agency at either the fed or state level that's in charge of just identification. That's it. Fund that agency and let them do it properly. However, inevitably someone will scream "Big Brother!", and we'll end up back where we started, with this Rube Goldberg system that basically leaves individuals to fend for themselves.

mindslight 3y ago
I'll go yet another step further, and say that the main opposition to having a better technical system of government identification is because we're lacking a comprehensive privacy law akin to the GDPR. As it stands if the government started say issuing smart cards for identify verification, then every business would gradually force their customers to identify themselves, for helping the commercial surveillance industry track everything they do. This is the current dynamic with mobile apps, phone numbers, and existing static identifiers, and it's only held back because one can feign not having them and/or being worried about giving out that info. Whereas with actually secure technicals, that friction basically disappears. And so the only way to prevent this dynamic (and make it so better identification isn't itself a security vulnerability) is by gaining the legal right to inspect/audit/reject the collection, use, and storage of such information in the first place.
- throwway120385 3y ago
  There's also a significant constituency that believes any nationwide system of identity is the "mark of the beast" as spoken of in the Bible.
  - mindslight 3y ago
    It feels like the people who literally believe this as an actual political concern is a vanishingly small contingent, especially given that the ship has already sailed with SSNs and the like, making this more of a partisan talking point strawman. Of course I do respect that the relevant political party has made their whole platform one of stirring up such tempests in teapots instead of focusing on substantive policy. But still regardless of the possible superstitious narratives that objections may end up taking, the best way to eliminate objections is to address the actual practical concerns. And that is chiefly the myriad of ways in which existing identifiers are being abused.
  - GoblinSlayer 3y ago
    Phone numbers already do that.
- GoblinSlayer 3y ago
  Digital identification can be done correctly, i.e. give business one time pseudonym maybe with one time email pseudonym. Then businesses won't ask for such identification :) Or it can require ATM, which is not frictionless. Businesses already ask for phone numbers anyway. Can it become worse?
  - mindslight 3y ago
    Phone numbers are bad, but of course it could be worse. Phone numbers have both escape hatches (VOIP, shared number burner services, or your own psuedonymous SIM + device ID), and friction (people are wary of businesses spamming them). Pseudonyms don't work for the topic under discussion, issuing credit. And for the general case, since credit issuers would be able to require you to do a non-psuedonym identification, then any other entity can require this as well, unless there were a privacy law. (no idea what you mean by "ATM")

Xymist 3y ago

Strong disagree that such a responsibility exists. I should be able to open a bank account with _nothing_, save perhaps a _de minimis_ initial deposit (one penny, or similar). I can walk into a shop with a handful of cash, buy an item, and leave without anyone knowing who I was. That should be true of any good or service, including banking, that does not require additional data for direct practical reasons related to the provision of the service, e.g. cleaners need to know where you live. "Prevention of fraud/laundering/terrorism/whatever" is not such a reason.

mindslight 3y ago
I'm sympathetic to your comment, but we are talking about the issuing of credit. Surely you see that this idea is a non-starter for a bank issuing credit? This is further complicated by US bank accounts including an intrinsic bit of credit from writing checks and other ACH debits.
MyNameIs_Hacker 3y ago
That is fine for opening a deposit account. The fraud we're talking about is for obtaining credit or future financial obligations. It is wrong to let this be done with so little proof of identity and enforce the obligation in courts. Banks have notaries of the public. After you have established a relationship with a bank, the notary may have enough evidence to authenticate you for others. If you have continued to use the bank in an anonymous manner, then you should not be authenticated to others.