More importantly, we can 2FA from my id number to my address because there is a db mapping from id to post address.

With a locked mailbox (which is the default) it becomes a hassle to steal an identity.

If I get a new credit card it's sent to the address I id'd for.

It's better than just trusting the SSN, but I'd still prefer a system that can't be beat with a stick and some chewing gum.

(Yes, I had an ID theft near-miss that involved a locked mail box in a locked stairwell. To me, the more obvious perpetrator seemed to be someone with access to the mail delivery pipeline, but the investigator I spoke certainly did not think terribly highly of the security of a locked mailbox)

These systems don't work well remotely, of course. Sometimes an organisation will accept an upload of a scan or a mailing of a photocopy. They sometimes require it to be signed by a somebody to verify that it's genuine (e.g., a Justice of the Peace). But by doing that, the "hard to forge" feature is lost entirely.

They do use a scan or a photocopy, but having that stored it is easier to check the identity of the real person once they claim there was identity theft.

The "verified photocopies" can be a bit of a joke. I know somebody who was having trouble finding enough ID for something. They printed an online bank statement, photocopied it, and got a JP to verify the photocopy against the original printout.

Ukraine is experimenting and slowly rolling out an oauth-like system called BankID, where you bank can provide information to third party.

At first I was surprised by you mentioning Ukraine and BankID, especially since it's developed by Swedish banks. But reading about it now makes it seem like they are branching out to other European countries as well.

Over here it's basically used for everything that needs authentication / signatures - taxes, banking etc.

You talking about Facebook?

It's not just hard to forge: tgey expire often and change code frequently sp the exploytable window is smaller than for the quasi permanent ssn

Perhaps true to some extent, but a passport can last 10 years, which is plenty of time for identity theft.

If your identity gets stolen you get new passport with new number and put old one into stolen document database.

Cannot do this with SSN.

The question would then be how many organisations check the stolen document database when looking at a passport id.

If you want to legally lend money why shouldn't you be required to do look up? If you didn't you're liable...

however, that clearly puts the blame where it's due. ssn changes being exceptions make easy to shield company from due process. id's, otoh, have specific procedures for handling.