3 ms·

> IDscan was never cryptographic proof you were who you said you were. Maybe better than “enter your name and SSN” With the benefit of hindsight, we'd have all

by Terr_ 19d ago

> IDscan was never cryptographic proof you were who you said you were. Maybe better than “enter your name and SSN” With the benefit of hindsight, we'd have all been better off if SSNs had been so obviously flagrantly public that nobody would ever consider them a trust-factor.

AngryData 19d ago
To be fair many SS cards were printed stating right on them they aren't for ID usage.
- simoncion 19d ago
  Yep. Social Security numbers are not guaranteed to be unique, and for a very long time, were pretty easy to figure out if you knew roughly when a person was born and where. "I know! We'll use this number that its issuing agency says is most definitely not to be used for identification purposes for identification purposes!" is real PHB thinking.
- Terr_ 19d ago
  Right, I don't blame the SS administration, they knew what people shouldn't do and warned everyone about it... the problem was private companies were desperate for security-theater and were never punished as they built an entire grand opera-house of insecurity.
  - mahboi 17d ago
    What should the companies have used instead? Even the government identifies you by SSN, eg taxes or voter registration. They combine that with state ID often, but the only national ID is passport which not everyone has.
fortran77 19d ago
But they were! My college student ID from 1980 has my SS number right on it. I have here an employee badge from the Walt Disney Company from 2000 and my SS number is in a bar code right on the bottom. Even in 2000, it would be trivial to take a photo of someone wearing the ID badge and decode the 1D bar code on it.
- quesera 19d ago
  In some states, until the early 1990s, SSNs were also used as drivers license numbers.
- deleted 19d ago
  [deleted]
- Terr_ 19d ago
  Right, but somehow a bunch of companies still made them into a "prove who you are" factor, and (if we assume incompetence instead of malice) that means a bunch of decision makers still considered the a trust factor.

by Terr_ 19d ago

AngryData 19d ago

To be fair many SS cards were printed stating right on them they aren't for ID usage.

simoncion 19d ago
Yep. Social Security numbers are not guaranteed to be unique, and for a very long time, were pretty easy to figure out if you knew roughly when a person was born and where. "I know! We'll use this number that its issuing agency says is most definitely not to be used for identification purposes for identification purposes!" is real PHB thinking.
Terr_ 19d ago
Right, I don't blame the SS administration, they knew what people shouldn't do and warned everyone about it... the problem was private companies were desperate for security-theater and were never punished as they built an entire grand opera-house of insecurity.
- mahboi 17d ago
  What should the companies have used instead? Even the government identifies you by SSN, eg taxes or voter registration. They combine that with state ID often, but the only national ID is passport which not everyone has.

fortran77 19d ago

But they were! My college student ID from 1980 has my SS number right on it. I have here an employee badge from the Walt Disney Company from 2000 and my SS number is in a bar code right on the bottom. Even in 2000, it would be trivial to take a photo of someone wearing the ID badge and decode the 1D bar code on it.

quesera 19d ago
In some states, until the early 1990s, SSNs were also used as drivers license numbers.
deleted 19d ago
[deleted]
Terr_ 19d ago
Right, but somehow a bunch of companies still made them into a "prove who you are" factor, and (if we assume incompetence instead of malice) that means a bunch of decision makers still considered the a trust factor.