4 ms·

The system we have with SSNs are just fundamentally flawed. It's like a password you can't choose or change, that is also in a million databases (in plaintext)

• pacificmint 2y ago
  That’s right. You can use a number as a unique identifier for each person that everybody stores. You can also use a number as a secret code to authenticate yourself. But you can’t use the same number for both purposes.
• Terr_ 2y ago
  Even worse is going to be when people start misusing biometrics, where--like with SSNs--they make a very wrong yet temporarily convenient assumption that the information is secret.
  • e63f67dd-065b 2y ago
    Biometrics don't have to be secret to be useful -- my home country has national ID cards with embedded fingerprint data, and certain transactions are required by law to have you physically present yourself and verify your identity with a fingerprint reader that checks it against your card's info.
    • Terr_ 2y ago
      Does an authority always inspects everyone's fingers to make sure nobody is wearing a gelatin pad, or is it a facility which has a rather expensive machine that does a lot of extra anti-spoofing tests? In general, the common situations some people wish they could use biometrics--like a grocery store payment--are also ones where it won't actually be that secure. After someone goes on a shopping-spree with your stolen fingerprint, you can't really change it.
    • Galatians4_16 2y ago
      Fingerprints are real easy to forge with super glue, a digital camera with telephoto lens, a printer, and elmer's glue (1) 1. https://www.ccc.de/en/updates/2014/ursel https://www.ccc.de/en/updates/2014/ursel
      • Eddy_Viscosity2 2y ago
        This may be true, but its even easier with the SSN where you just give them the number and that's it. Because the fingerprint scan isn't perfect doesn't mean it isn't better (much better).
• teeray 2y ago
  The USG just needs to choose an authentication scheme that is easily and securely implemented in smartphones, yet still accessible to the grandmas out there that will use this as their first piece of technology. Then, once adopted, they should double down and publish the full mapping of names to SSNs, eradicating any remaining value they have as anything other than a User ID.
  • rho138 2y ago
    What happens to people without smartphones or if someone loses theirs via theft?
    • basch 2y ago
      Stop at the Post Office to pick up your One Time Expiring Activation Code, bring along a piece of mail and a friend to vouch for you.
      • voxic11 2y ago
        So if someone has a friend and a printer they can impersonate anyone? Doesn't seem like that adds much security.
        • txru 2y ago
          At some point, identity relies on an official who is legally empowered to make a decision, and people stating things where lying would be fraud. We currently have very weak intermediary steps in the US-- transmitting 9 digits that last a lifetime-- that could be firmed up in similar ways to 2FA and notarization
        • basch 2y ago
          I described the current process for voting. I meant it both a little facetiously, and mostly just matter of factly.
    • hgyjnbdet 2y ago
      Or you simply don't have a smartphone.
• kfrzcode 2y ago
  It isn't like a password; it's a globally unique, (mostly) immutable identifier, used across a broad range of systems.
  • pwg 2y ago
    > It isn't like a password True, but far too many businesses treat it as an "authentication" token that they can use to authenticate that you are who you say you are. I.e., they treat it like a password that only you know, and so if you can recite it to the telephone help desk person, then the help desk person is assured that the voice on the other side of the phone must be Mr. X who has SSN YYY-YY-YYYY.
  • xboxnolifes 2y ago
    That "must" be kept secret. So, a password.
• e63f67dd-065b 2y ago
  The problem is that SSNs weren't designed as a unique identifier for US identity, with no consideration given for protection, authentication, etc. The earliest SS cards came with 'NOT FOR IDENTIFICATION' on the front, was used for nothing except SS, and was in general designed as nothing more than a record-keeping number. Then people figured out that since the government went through the trouble of assigning every* [1] american* [2] a unique* [3] number* [4], they might as well use that as their own ID too for inter-operability between different financial firms, and that's how we ended up in this shitty situation. Every time somebody proposes 'hey we should come up with a better national ID number' you get people yelling about mumble mumble big government mumble mumble privacy mumble mumble feds tracking you around, and the proposal dies in committee. [1] originally only issued to those who worked, and was not exempted from the SS system, notably children. Of course these days children have SS numbers because they're a de-facto ID number, and it's required to claim dependents, and with varying degrees of resistance from weird groups like the Amish. Additionally, non-eligible people are issued tax IDs instead, which have the same format as SSNs because it was easier that way [2] big(?) political fights over who exactly must get numbers, of course, from religious groups, illegal immigrants, and many more [3] except of course it's not unique, there were errors where people got duplicate numbers, and people can get reassigned numbers, thereby having more than one [4] did you know they used to assign SSNs sequentially? The guy who was next in line got your number + 1
  • quartesixte 2y ago
    Weren't the cards originally for retirees to go pick up the social security check from the social security office, as well as request documents and such? It's like pension books in other countries.
  • silisili 2y ago
    Don't forget that social security numbers are also recycled upon death, so definitely not unique.