4 ms·

If SSN was no longer the primary key for financial and marketing data, and UCNs were only locally significant, this would make data sharing rather difficult bet

by VLM 12y ago

If SSN was no longer the primary key for financial and marketing data, and UCNs were only locally significant, this would make data sharing rather difficult between companies. Think of banks and service providers talking with credit bureaus. Or they'd just use an even more inferior technique for UUIDs like "name-address". Or even more invasive (biometrics, or something)

Jedd 12y ago
You mean a system similar to what almost every non-USA country currently uses? Here in sunny Australia we don't have anything like an SSN, at least not in terms of secrecy and potential personal disruption were it revealed. We have a TFN (Tax File Number) but lots of non-owners of that number need to, and do, have access to it. Our bank accounts contain two parts - the branch (BSB) and account numbers. Anyone can get access to those, and in fact we frequently share them in order to receive payments. The way the US, and I think the UK also, revere such evidently hard-to-protect information means the social designs around them are hugely fragile. Really, it's not a hypothetical 'there has to be a better way', but simply 'there is a better way'.
- justincormack 12y ago
  Not aware of a UK equivalent of SSN.
  - Jedd 12y ago
    Justin - you're quite right. NI number isn't anywhere near so powerful. However I was thinking more of the assumption that your Sort code[1] + account number can be kept secret, and more importantly the profound risks to your finances if it is not. [1] http://en.wikipedia.org/wiki/Sort_code http://en.wikipedia.org/wiki/Sort_code
    - JonoBB 12y ago
      Sort code and account number is no risk at all. You can (and many do) quite happily give this information out.
      - justincormack 12y ago
        Indeed, it allows you to pay me money, you can easily obtain them from invoices... they do not provide any authentication.
      - geographomics 12y ago
        There is some risk in revealing these, for example: http://news.bbc.co.uk/1/hi/7174760.stm http://news.bbc.co.uk/1/hi/7174760.stm
UnoriginalGuy 12y ago
They could just share UCNs instead. SSIDs cannot be stored (or shared). But UCNs would function exactly like SSNs in the current system. SSIDs just exist to "wrap" UCNs, they prove that you have the current SSID for whatever person you're claiming to be (kind of like a poor man's password) and make it more difficult for thieves to re-use the UCN number trivially (you'd have to be an insider to enter a UCN, outsiders need the SSID). The reason to stop people storing or sharing the SSID is primarily so SSIDs themselves don't become the SSN replacement. Companies might get lazy and instead of converting the SSID at the SSA, they instead "cache" the SSID->UCN conversion in-house or worse just use the SSID directly. You have to make SSIDs ephemeral. UCNs and SSNs are static. UCNs can be stored/shared, SSNs get outmoded eventually, and SSIDs are short-lived no storage-sharing numbers that provide the UCN.

by VLM 12y ago

Jedd 12y ago

You mean a system similar to what almost every non-USA country currently uses? Here in sunny Australia we don't have anything like an SSN, at least not in terms of secrecy and potential personal disruption were it revealed. We have a TFN (Tax File Number) but lots of non-owners of that number need to, and do, have access to it. Our bank accounts contain two parts - the branch (BSB) and account numbers. Anyone can get access to those, and in fact we frequently share them in order to receive payments. The way the US, and I think the UK also, revere such evidently hard-to-protect information means the social designs around them are hugely fragile. Really, it's not a hypothetical 'there has to be a better way', but simply 'there is a better way'.

justincormack 12y ago
Not aware of a UK equivalent of SSN.
- Jedd 12y ago
  Justin - you're quite right. NI number isn't anywhere near so powerful. However I was thinking more of the assumption that your Sort code[1] + account number can be kept secret, and more importantly the profound risks to your finances if it is not. [1] http://en.wikipedia.org/wiki/Sort_code http://en.wikipedia.org/wiki/Sort_code
  - JonoBB 12y ago
    Sort code and account number is no risk at all. You can (and many do) quite happily give this information out.
    - justincormack 12y ago
      Indeed, it allows you to pay me money, you can easily obtain them from invoices... they do not provide any authentication.
    - geographomics 12y ago
      There is some risk in revealing these, for example: http://news.bbc.co.uk/1/hi/7174760.stm http://news.bbc.co.uk/1/hi/7174760.stm

UnoriginalGuy 12y ago

They could just share UCNs instead. SSIDs cannot be stored (or shared). But UCNs would function exactly like SSNs in the current system. SSIDs just exist to "wrap" UCNs, they prove that you have the current SSID for whatever person you're claiming to be (kind of like a poor man's password) and make it more difficult for thieves to re-use the UCN number trivially (you'd have to be an insider to enter a UCN, outsiders need the SSID). The reason to stop people storing or sharing the SSID is primarily so SSIDs themselves don't become the SSN replacement. Companies might get lazy and instead of converting the SSID at the SSA, they instead "cache" the SSID->UCN conversion in-house or worse just use the SSID directly. You have to make SSIDs ephemeral. UCNs and SSNs are static. UCNs can be stored/shared, SSNs get outmoded eventually, and SSIDs are short-lived no storage-sharing numbers that provide the UCN.