15 ms·

I would argue that since authenticating a person’s identity requires one to prove or show that they are genuinely that person, and since providing an SSN does p

I would argue that since authenticating a person’s identity requires one to prove or show that they are genuinely that person, and since providing an SSN does prove I am a particular person, providing an SSN is not a means of authenticating a person’s identity.

kube-system 2y ago
The ability to compromise a shared secret is a known weakness of using shared secrets as an authentication factor. That doesn't make shared secrets "not authentication". They're still the most common type of authentication credential. An SSN is just a relatively weak one. Like "hunter2" for a password, or a 4 digit PIN, or a security question. What does it even mean to "prove" identity? That's the million dollar question when designing an authentication system, isn't it? First you need to determine what level of certainty you're looking for. If you want to be really certain, a supervised blood draw and DNA test might work well. This method has proven to be overkill for the customer-only bathrooms at my local Chipotle, though. They've opted to use the much less secure 4-digit shared pin. My bank uses something in between the two. I guess they've seen my account, and know they can't get blood from a stone :)
- twodave 2y ago
  Grocery stores, notaries, etc. all manage to verify identity in person and even remotely. I’m not sure why we need to go from a public 9-digit number straight to drawing blood.
  - kube-system 2y ago
    Really, it depends on the problem you're trying to solve. I was humorously illustrating a wide spectrum of requirements in terms of both authentication certainty and implementation friction. To determine what "good authentication" is, you must first determine if you're protecting a nuclear missile silo, a Chipotle bathroom, or something in between. A 9 digit shared secret is probably not a good authentication factor for launching a nuclear missile. It's also not great for handing out loans. But it's also probably overkill for accessing a Chipotle bathroom. And a slight nit: SSNs aren't public. They are, of course, frequently shared, and easily compromised. But they are literally private shared secrets.

kube-system 2y ago

The ability to compromise a shared secret is a known weakness of using shared secrets as an authentication factor. That doesn't make shared secrets "not authentication". They're still the most common type of authentication credential. An SSN is just a relatively weak one. Like "hunter2" for a password, or a 4 digit PIN, or a security question. What does it even mean to "prove" identity? That's the million dollar question when designing an authentication system, isn't it? First you need to determine what level of certainty you're looking for. If you want to be really certain, a supervised blood draw and DNA test might work well. This method has proven to be overkill for the customer-only bathrooms at my local Chipotle, though. They've opted to use the much less secure 4-digit shared pin. My bank uses something in between the two. I guess they've seen my account, and know they can't get blood from a stone :)

twodave 2y ago
Grocery stores, notaries, etc. all manage to verify identity in person and even remotely. I’m not sure why we need to go from a public 9-digit number straight to drawing blood.
- kube-system 2y ago
  Really, it depends on the problem you're trying to solve. I was humorously illustrating a wide spectrum of requirements in terms of both authentication certainty and implementation friction. To determine what "good authentication" is, you must first determine if you're protecting a nuclear missile silo, a Chipotle bathroom, or something in between. A 9 digit shared secret is probably not a good authentication factor for launching a nuclear missile. It's also not great for handing out loans. But it's also probably overkill for accessing a Chipotle bathroom. And a slight nit: SSNs aren't public. They are, of course, frequently shared, and easily compromised. But they are literally private shared secrets.