America Keeps Rejecting an ID Card It Already Has

This video does a great job explaining it: ▶ this video The summary is that the USA does not have an official national person identity number. The SSN is the closest approximation, so it is being (ab)used as one. This is despite that it is explicitly not designed for it and has some qualities which make it less suitable (the numbers are small and very predictable). In general, nearly every national-identity-system suffers from a contradiction between assigning identities and identifying. Where the number you get assigned is simultaneously your identity and a secret you use to establish your identity. There are initiatives to solve this using cryptography, but this is complicated by political attitudes towards privacy and government tracking. I dare say in the USA this is more pronounced due to both the problem and the political attitude against solutions being more pronounced.

in “Having trouble with the IRS site? Try all caps” · View on HN

CGP Grey recently made a great video about this exact problem with social security numbers: ▶ this video They were started to keep of taxes and never meant to be used as IDs.

in “Bank of the Underworld (2015)” · View on HN

Actually, the SSN is an account number, solely intended for tracking money paid into and paid out of an account. It isn't meant for identification, and the method it's used for identification is terrible. (Largely: If you know the number, you are identified.) It's treated like a secret, but as a 9-digit number you give to dozens of organizations in your life which follows a predictable and partially guessable pattern, it is an absolutely terrible secret. Absolutely good explainer video about how this travesty took place historically: ▶ this video

in “FTC Approves Roughly $5B Facebook Settlement” · View on HN

Here's a relevant pop science video by CGP Grey[0] that explains all the various problems with SSNs. My favorite part is the fact that until quite recently (2011) you could decrement or increment a given SSN by 1 and get another valid SSN, since they were sequential. [0]: ▶ this video

in “Senators push to ditch social security numbers in light of Equifax hack” · View on HN

The SSN was never intended as a national ID. It was originally created alongside the Social Security Administration, to track what individuals put in and what they take out. People only received one upon becoming employed. Over time, the IRS realized that it could be used as a national ID, and adopted it for that purpose. They encouraged people to obtain one from a young age (even for their newborn children), and it was used to replace the original 'honor system' of 'How many children do you have?' tax discounts; now they'd need to register their child with a SSN. Companies eventually began piggybacking on the number as a national identifier (due to our lack of one), and voila. We're left with an awfully insecure identification system that shouldn't be an identification system for much in the first place. For anyone interested in more: ▶ this video , and the sources below the video.

in “Cybersecurity Incident Involving Consumer Information” · View on HN

You're right it was never meant to be a unique identifier, we need a national identification card, link to a video about it. ▶ this video

in “Cybersecurity Incident Involving Consumer Information” · View on HN

CGP Gray did a really good video[1] about this recently. The short version is that it's the least terrible mechanism presently available for uniquely identifying and disambiguating American citizens. [1] ▶ this video

in “Stop Calling it ‘Identity Theft’” · View on HN

Don't blame the immigrants, blame those who are fully or partly paying under the table. Of course, would you support a national ID card as a means of combating this variable you accuse? In the US we pretty much have such a thing already, just without any proper security or identification aspects... ▶ this video (A short (< 8 min) video by the ever informative CGP Grey on the inanity of US SS cards.)

in “Men Without Work” · View on HN

Americans have no national identity card. The closest thing is a Social Security number, which has no security or biometric features. ▶ this video

in “IRS Will Soon Require Selfies for Online Access” · View on HN

They are in fact not great IDs and the Social Security Administration asked very nicely for the rest of the country to not use them as a form of identification: ▶ this video A few reasons why SSNs are bad as IDs: 1. There are a number of situations where people will not have a SSN. 2. SSNs are "secrets" that need to be broadly shared to participate in many parts of business and government in the US. 3. SSNs lack many security and authentication mechanisms most forms of ID have (e.g. photo ID) There are folks in the US who rally against the idea of a national ID, but I've always thought it was a silly argument considering how pervasive and problematic SSNs are as a form of identification.

in “Security Breach at US Universities” · View on HN

I was talking about this with a friend the other day. I don't know about the technical feasibility (RE sybil attack[0]), but if it were possible, it would have a massive impact on the web. The current state of the art (in terms of new user signup) is using phone numbers as representing unique "trustable" people, which is kind of absurd. This reminds me of how social security numbers weren't originally intended to be used as unique identification, but the demand for some form of identification was so strong that organisations ended up hackily using it anyway.[1] [0] [link] [1] ▶ this video

in “Ask HN: What is the single top-priority software engineering problem?” · View on HN

Yeah, I suppose that's right. And as you say, it's very practical. > Keep in mind that the social number in USA is apparently also supposed to be secret (like a password) which sounds absolutely crazy to me. That's very true, reminds me of this video [1] by CGP Grey, giving some background of the issue. [1] ▶ this video

in “A privacy flaw in Comcast's automated telephone system” · View on HN

This happened to a photography editor who sits in the cube across from me. He found out he had a ticket in Pittsburgh, a city he had never been to, when he tried to transfer his license to a new state. No lawyer would take the case either. He eventually went to an identity theft company, who took $400 and fixed the issue in three months. I use to work in Identity Management at a major university. A number of people came through our systems without SSNs. We had a complicated set of rules to make sure we didn't provision two accounts. We'd check if the names were reversed and we'd check both the month/date = date/month on the date of birth (people from other countries might enter it backwards without thinking about it). We even had rules for SSNs that were off by <2 digits with similar names. Every morning we'd have a set of "manual provisions" we'd have to stop and check. Occasionally duplicate accounts get created and we'd have to go through a big manual process of combining them and telling them "You need to use this account; forget about the other one. It no longer exists," and get their stuff synced across all AD domains (Universities typically have several). What surprises me about this article is the NYC system doesn't use the SSN (which is good in a sense, it should never be used as a identification number, see the latest GCP Greg: ▶ this video ). The idea of an identity and criminal record us that follows us digitally is a very new concept, one that didn't exist 150+ years

in “For 18 years I thought she was stealing my identity, until I found her” · View on HN

You're right. My guess is most "anonymized" data is lazy--stripping out obvious identifying information. There are quite a few cases where you can pinpoint users from correlating to publicly available data. CGPGrey posted a video today showing a layman's example with Social Security Numbers[1]. One cool thing I heard Apple talk about[2] was injecting noise or subsampling to help mask individuals. Although, I don't see that mentioned in their public page on privacy[3] or their whitepaper[4]. [1] ▶ this video [2] [link] [3] [link] [4] [link]

in “You can’t buy Congress’s web history – that's not how any of this works” · View on HN