5 ms·

Yes, indeed. The real issue isn’t that businesses use SSN to authenticate. It’s that they don’t authenticate at all.

kube-system 2y ago
Meh, I don't agree. Authentication certainty is a spectrum. Bad authentication is still authentication, and good authentication is never perfect.
- jameshart 2y ago
  But what kind of authentication signal can you possibly get from someone supplying a name, date of birth, SSN and address? Providing a tuple of those values that match a record in the social security database, or the Experian or Equifax databases, does absolutely nothing to tell you whether the person applying for a loan/job/credit card/twitter verification etc is the human being who that SSN record corresponds to.
  - kube-system 2y ago
    > But what kind of authentication signal can you possibly get from someone supplying a name, date of birth, SSN and address? Doctors at a hospital will administer potentially deadly drugs using half of that -- just last name and date of birth. They are shared secrets. They might be weak shared secrets. But alas, that's the issue with shared secrets. A lot of them suck. https://en.wikipedia.org/wiki/Knowledge-based_authentication https://en.wikipedia.org/wiki/Knowledge-based_authentication
    - jameshart 2y ago
      Medical checks of name and DoB aren’t authentication - they’re more of a parity check. There’s not generally a lot of value in a medical treatment scenario in impersonating another patient; it’s not an adversarial scenario.
      - kube-system 2y ago
        Doctors don't ask for your name and DoB to verify that your bits are in order. They do it to verify the identity of the patient. Authentication is literally: any process used to verify the identity of someone. The definition holds no requirement for any level of certainty, or anything else for that matter. Asking someone for their name and DoB is just weak authentication. The fact that is it not an adversarial scenario is why weak authentication works just fine for the use case. This is an illustration why there is no such thing as a universally "good authentication" or "bad authentication". A good authentication design depends entirely on the specific problem being solved.
        jameshart 2y ago
        > Doctors don't ask for your name and DoB to verify that your bits are in order. Metaphorically, yes they do. They're mainly checking they're in the right room talking to the patient whose name is on the notes in front of them. It's a checksum, not an identity challenge.
- twodave 2y ago
  I would argue that since authenticating a person’s identity requires one to prove or show that they are genuinely that person, and since providing an SSN does prove I am a particular person, providing an SSN is not a means of authenticating a person’s identity.
  - kube-system 2y ago
    The ability to compromise a shared secret is a known weakness of using shared secrets as an authentication factor. That doesn't make shared secrets "not authentication". They're still the most common type of authentication credential. An SSN is just a relatively weak one. Like "hunter2" for a password, or a 4 digit PIN, or a security question. What does it even mean to "prove" identity? That's the million dollar question when designing an authentication system, isn't it? First you need to determine what level of certainty you're looking for. If you want to be really certain, a supervised blood draw and DNA test might work well. This method has proven to be overkill for the customer-only bathrooms at my local Chipotle, though. They've opted to use the much less secure 4-digit shared pin. My bank uses something in between the two. I guess they've seen my account, and know they can't get blood from a stone :)
    - twodave 2y ago
      Grocery stores, notaries, etc. all manage to verify identity in person and even remotely. I’m not sure why we need to go from a public 9-digit number straight to drawing blood.
      - kube-system 2y ago
        Really, it depends on the problem you're trying to solve. I was humorously illustrating a wide spectrum of requirements in terms of both authentication certainty and implementation friction. To determine what "good authentication" is, you must first determine if you're protecting a nuclear missile silo, a Chipotle bathroom, or something in between. A 9 digit shared secret is probably not a good authentication factor for launching a nuclear missile. It's also not great for handing out loans. But it's also probably overkill for accessing a Chipotle bathroom. And a slight nit: SSNs aren't public. They are, of course, frequently shared, and easily compromised. But they are literally private shared secrets.

Meh, I don't agree. Authentication certainty is a spectrum. Bad authentication is still authentication, and good authentication is never perfect.

jameshart 2y ago
But what kind of authentication signal can you possibly get from someone supplying a name, date of birth, SSN and address? Providing a tuple of those values that match a record in the social security database, or the Experian or Equifax databases, does absolutely nothing to tell you whether the person applying for a loan/job/credit card/twitter verification etc is the human being who that SSN record corresponds to.
- kube-system 2y ago
  > But what kind of authentication signal can you possibly get from someone supplying a name, date of birth, SSN and address? Doctors at a hospital will administer potentially deadly drugs using half of that -- just last name and date of birth. They are shared secrets. They might be weak shared secrets. But alas, that's the issue with shared secrets. A lot of them suck. https://en.wikipedia.org/wiki/Knowledge-based_authentication https://en.wikipedia.org/wiki/Knowledge-based_authentication
  - jameshart 2y ago
    Medical checks of name and DoB aren’t authentication - they’re more of a parity check. There’s not generally a lot of value in a medical treatment scenario in impersonating another patient; it’s not an adversarial scenario.
    - kube-system 2y ago
      Doctors don't ask for your name and DoB to verify that your bits are in order. They do it to verify the identity of the patient. Authentication is literally: any process used to verify the identity of someone. The definition holds no requirement for any level of certainty, or anything else for that matter. Asking someone for their name and DoB is just weak authentication. The fact that is it not an adversarial scenario is why weak authentication works just fine for the use case. This is an illustration why there is no such thing as a universally "good authentication" or "bad authentication". A good authentication design depends entirely on the specific problem being solved.
      - jameshart 2y ago
        > Doctors don't ask for your name and DoB to verify that your bits are in order. Metaphorically, yes they do. They're mainly checking they're in the right room talking to the patient whose name is on the notes in front of them. It's a checksum, not an identity challenge.
twodave 2y ago
I would argue that since authenticating a person’s identity requires one to prove or show that they are genuinely that person, and since providing an SSN does prove I am a particular person, providing an SSN is not a means of authenticating a person’s identity.
- kube-system 2y ago
  The ability to compromise a shared secret is a known weakness of using shared secrets as an authentication factor. That doesn't make shared secrets "not authentication". They're still the most common type of authentication credential. An SSN is just a relatively weak one. Like "hunter2" for a password, or a 4 digit PIN, or a security question. What does it even mean to "prove" identity? That's the million dollar question when designing an authentication system, isn't it? First you need to determine what level of certainty you're looking for. If you want to be really certain, a supervised blood draw and DNA test might work well. This method has proven to be overkill for the customer-only bathrooms at my local Chipotle, though. They've opted to use the much less secure 4-digit shared pin. My bank uses something in between the two. I guess they've seen my account, and know they can't get blood from a stone :)
  - twodave 2y ago
    Grocery stores, notaries, etc. all manage to verify identity in person and even remotely. I’m not sure why we need to go from a public 9-digit number straight to drawing blood.
    - kube-system 2y ago
      Really, it depends on the problem you're trying to solve. I was humorously illustrating a wide spectrum of requirements in terms of both authentication certainty and implementation friction. To determine what "good authentication" is, you must first determine if you're protecting a nuclear missile silo, a Chipotle bathroom, or something in between. A 9 digit shared secret is probably not a good authentication factor for launching a nuclear missile. It's also not great for handing out loans. But it's also probably overkill for accessing a Chipotle bathroom. And a slight nit: SSNs aren't public. They are, of course, frequently shared, and easily compromised. But they are literally private shared secrets.