> How comes it that in the US this kind of trust based systems with numbers are so popular compared to other parts of the world? Like many other things in secu

> How comes it that in the US this kind of trust based systems with numbers are so popular compared to other parts of the world? Like many other things in security, because systems evolve and these things aren't planned. SS numbers were never meant to be these all-identifying secret numbers. It just happened that we wanted something like that and the SS program had already given everyone something that would kinda suffice, so we slowly started using it. Over time, it just came to be accepted. We just slowly evolved into a situation of using our SSNs everywhere as a personal ID. Same thing happened with e-mail. Developers needed a secure way to communicate with users to let them reset accounts and such. Slowly, e-mail accounts became the center crux of your online security. It was never designed or intended to be, but it just sort of became that way. It was convenient. The same thing is happening with smartphones. Two-factor auth is on the rise, which is a very good thing, but what do you use for your second factor? Well, a lot of people are carrying smartphones, so why not use that? Hundreds of people come to the same conclusion and now phones are standard second auth factor. They were never designed to be, no committee ever sat down and said "we need to design phones to be a persons' personal identity managing token", but that's kind of what they're becoming. Our kids will ask us in a decade why a phone number confirmed via text is used to validate so much important stuff. These things are chosen out of convenience, which is mainly being the right tool at the right place at the right time. Once they become popular there's a made scramble to adapt and actually make it secure, but those mad scrambles are not as effective as a good design from the beginning. I almost ended with "ah well, live and learn", but... we don't learn.