News for hackers. Stuff that matters.
Re:Our entire credit bureau system is broken by alkonaut on Monday September 11, 2017 @05:23AM (#15217170)
They will figure out that they need some form of 2FA. There is a very simple and crude way of 2FA: Mail.

If you say "I'm bob smith with SSN 12345", then you gave them your id. You didnt' verify that you are in fact bob smith with SSN 12345.

Now they have to verify with some degree of certainty that you are. So they lookup your address, and send a regular paper mail describing what needs to be authorized, and you sign and return it (or call a number and enter a code, or visit a website, or whatever).

This kind of crude 2FA can still be circumvented by someone stalking you mailbox, but it's a lot better than nothing.

Now: what this requires is a mapping from name+ssn (or some unique identifier) to an up to date address. Having that has several other benefits when it comes to e.g. automatic voter registration etc.

Re:Our entire credit bureau system is broken by ghaff on Monday September 11, 2017 @05:49AM (#15217269)
Historically something like this, with our without transactions involving SSN, was pretty common. Forget the PIN associated with your frequent flyer account? The airline would send you a new PIN in the mail that would arrive in about a week or so.

There are obvious latency issues with this though and it would mostly be considered less than optimal today.

Re:Our entire credit bureau system is broken by alkonaut on Monday September 11, 2017 @06:00AM (#15217308)
Right. So this mail 2FA is clearly not good enough for general use, but you really only need to use it once. Just like the airline just mailed the PIN for the next auth, so would a reasonable digital ID work too.

Make a national digital ID app. Applicants fill in a web form saying they want to have it. They enter their personal ID number (SSN or equivalent). The one time key for the digital ID is then sent to the mail address. The user installs the digital ID app on their smartphone/computer and enters the key from the mail.

Now they can use that app to 2FA anything: fill in their tax returns online, buy things online, send money to anyone else, login to their internet bank or any other website (by open API), manage social security and other systems, apply for schools etc. This must sound like science fiction in the US but it's been a reality for 5-10 years where I live.

Re:Our entire credit bureau system is broken by ghaff on Monday September 11, 2017 @06:09AM (#15217338)
Americans are very resistant to the idea of a national ID. Yes, in some respects it already sort of exists between SSN, Passports, and individual states drivers licenses (about which there's still some residual squabbling about complying with the RealID federal standard). It may seem silly but if you as a politician propose a national ID card, you'll probably be involved in a recall election within a few months.
Re:Our entire credit bureau system is broken by alkonaut on Monday September 11, 2017 @07:04AM (#15217560)
I think it hasn't been framed right. National ID is what gives the easy tax returns, protection against identity theft, less reliance on outdated systems like slow bank transfer, paper checks, manual voter registration, census processes...

I'm not sure what the fear is with a large central table having a number in one column and your name and address in the others.

Re:Our entire credit bureau system is broken by ghaff on Monday September 11, 2017 @07:36AM (#15217710)
I'm not going to argue it's wholly rational but there's a strong undercurrent of suspicion of and resistance to federal government power in the US. As a result, distributed messy processes are often seen as a feature rather than bug. I realize that it's probably hard for many Europeans to get their heads around this but it's the way it is--especially outside of coastal urban centers. And I don't even really disagree with this general attitude.
Re:Our entire credit bureau system is broken by alkonaut on Monday September 11, 2017 @07:51AM (#15217773)
There is nothing that inherently requires this to be national. You could have this system distributed over 50 different databases if you wanted. It would require "transferring" people that move between the systems.

That said -if you are afraid of federal/national systems (which is an entirely valid if not entirely rational position) then why have a federal tax authority, national passports etc? It seems like getting the worst of both worlds if you have to run authorities that obviously need to keep track of every living soul in the country whether they like it or not - but then not giving them the tools to do so.

The EU is federal in much the same way (independent states, we don't want the central EU government to meddle too much in state business etc) but then we made sure that the EU government doesn't have anything to do with individuals in the member states, they deal only with the member states themselves. I pay taxes to the EU only indirectly through my home country's tax - so there is no need for an EU tax authority to know who I am, and so on.

The analogous situation for the US would be there was no federal taxes collected from individuals, if states issued passports etc.

Re:Our entire credit bureau system is broken by dbattaglia on Monday September 11, 2017 @07:39AM (#15217730)
My guess is the fear is of national anything, not just ID. Regardless if it's good or bad, state level authority is a big deal to a lot of people in the US, especially those on the conservative side of the fence.
Re:Our entire credit bureau system is broken by Sami_Lehtinen on Tuesday September 12, 2017 @04:43AM (#15225769)
This solution is still being used all the time. But they've outsourced the sending. They ask you to provide your utility bill, proving that it's you. Therefore there's no need to send a new document, if we already know that you already got existing document.