4 ms·

But what kind of authentication signal can you possibly get from someone supplying a name, date of birth, SSN and address? Providing a tuple of those values th

But what kind of authentication signal can you possibly get from someone supplying a name, date of birth, SSN and address? Providing a tuple of those values that match a record in the social security database, or the Experian or Equifax databases, does absolutely nothing to tell you whether the person applying for a loan/job/credit card/twitter verification etc is the human being who that SSN record corresponds to.

kube-system 2y ago
> But what kind of authentication signal can you possibly get from someone supplying a name, date of birth, SSN and address? Doctors at a hospital will administer potentially deadly drugs using half of that -- just last name and date of birth. They are shared secrets. They might be weak shared secrets. But alas, that's the issue with shared secrets. A lot of them suck. https://en.wikipedia.org/wiki/Knowledge-based_authentication https://en.wikipedia.org/wiki/Knowledge-based_authentication
- jameshart 2y ago
  Medical checks of name and DoB aren’t authentication - they’re more of a parity check. There’s not generally a lot of value in a medical treatment scenario in impersonating another patient; it’s not an adversarial scenario.
  - kube-system 2y ago
    Doctors don't ask for your name and DoB to verify that your bits are in order. They do it to verify the identity of the patient. Authentication is literally: any process used to verify the identity of someone. The definition holds no requirement for any level of certainty, or anything else for that matter. Asking someone for their name and DoB is just weak authentication. The fact that is it not an adversarial scenario is why weak authentication works just fine for the use case. This is an illustration why there is no such thing as a universally "good authentication" or "bad authentication". A good authentication design depends entirely on the specific problem being solved.
    - jameshart 2y ago
      > Doctors don't ask for your name and DoB to verify that your bits are in order. Metaphorically, yes they do. They're mainly checking they're in the right room talking to the patient whose name is on the notes in front of them. It's a checksum, not an identity challenge.

kube-system 2y ago

> But what kind of authentication signal can you possibly get from someone supplying a name, date of birth, SSN and address? Doctors at a hospital will administer potentially deadly drugs using half of that -- just last name and date of birth. They are shared secrets. They might be weak shared secrets. But alas, that's the issue with shared secrets. A lot of them suck. https://en.wikipedia.org/wiki/Knowledge-based_authentication https://en.wikipedia.org/wiki/Knowledge-based_authentication

jameshart 2y ago
Medical checks of name and DoB aren’t authentication - they’re more of a parity check. There’s not generally a lot of value in a medical treatment scenario in impersonating another patient; it’s not an adversarial scenario.
- kube-system 2y ago
  Doctors don't ask for your name and DoB to verify that your bits are in order. They do it to verify the identity of the patient. Authentication is literally: any process used to verify the identity of someone. The definition holds no requirement for any level of certainty, or anything else for that matter. Asking someone for their name and DoB is just weak authentication. The fact that is it not an adversarial scenario is why weak authentication works just fine for the use case. This is an illustration why there is no such thing as a universally "good authentication" or "bad authentication". A good authentication design depends entirely on the specific problem being solved.
  - jameshart 2y ago
    > Doctors don't ask for your name and DoB to verify that your bits are in order. Metaphorically, yes they do. They're mainly checking they're in the right room talking to the patient whose name is on the notes in front of them. It's a checksum, not an identity challenge.