Don't switch from SSN. Just accept that they are public identifiers and ensure 1) everyone has access to photo ID with that SSN and 2) an authority can lookup addresses from SSN to perform 2FA.

This means everyone in the US has to accept national ID.

(It could theoretically be done at state level but it would be a huge hassle compared to national, and your tax authority and others are already national and need to know every person that lives in the country).

Basically you need to trust the federal government to solve your ID problem. And if the answer to that is "Whoa that won't happen, people won't accept national anything" then the simple answer is you'll keep being subjected to ID theft.

Why is chip & pin a bullet to bite? Isn't that just better for all parties involved?

I think the excuse is always that small businesses can't afford to upgrade their POS. I think the reason is that a lot of money is made by processors, etc. on all the fraudulent transactions. The credit card companies make plenty on high interest rates to cover this loss. It is like retail stores factoring in 20% (e.g.) loss into their prices so the consumer pays for it. I think capping interest rates on credit cards would force them to push chip and pin more. It is weird that we don't have chip and pin at the pump but now most places require zipcode which is worse than chip and pin.

For a long time SSN cards carried a notice that they were to be used only for social security and taxation purposes and never for identification. Maybe the government should take steps to make the SSN unsuitable as an identifier outside of those two agencies.

A big question in making credit providers liable for incorrectly granting credit is the specific definition of 'correctly'.

Sadly, just 'issued without approval' is a bit too wide a definition. You need to deal with 'john' helping others fraudulently impersonating 'john'. In that case, the bank should not be liable.

In general, I see potential for a weird type of coorperation. They verify identities for credit providers for a fee. In return, this coorperation takes on the liability of wrongly verifying identities.

Question is, given the importance of such a coorperation, how much regulation is needed? At what point is there so much regulation required that it is better left as a government-run service?

All they need is an ssn you can change if it gets stolen. To change it all that's needed is to go into a government office and do a biometric scan in person. That would be so ridiculously easy.

Of course the government will never let a good crisis go to waste. Instead, we will all get chips under our skin that can't be removed that will be passively scanned by the authorities everywhere we go.

SSN is a primary key, not a shared secret.

The entire problem is that people started using SSN as a shared secret, but it was classic password reuse. Use the same secret every fucking where.

No. If you want to establish trust, use a random secret for each new trust relationship.

If you want to establish identity ask the identity providers what kind of anti-forgery guarantees they provide. Oh, nothing, you say!? Then don't use that provider.

Banks are trying to use easy to forge things to make sure they won't lose money. Sounds like stupidity. So they limit their stupidity (hence you can't just register for a credit card online, otherwise bored Russian teenagers would have already bankrupted them).

What if, when you replaced your SSN, banks could use a system that would return "invalid SSN" on any new credit application. The existing accounts would be suspended unless you called them and updated your SSN. It would be about as much as a hassle as updating all of one's autopays when a credit card number gets stolen.

I don't want to call up all of my business address book because one of them fucked up and leaked something.

They shouldn't even ask for it.

Currently fraud is held back by law enforcement. Which is triggered by fraud detection. Which is triggered when the wrong person gets a call from a collections agency.

And this chain of events is too long, but since there's no global (national) system to check if someone is a professional scam artist or a regular bloke, that's what banks are left with.

One irony is that for my US visa I had to have an interview, supply a photograph, have my fingerprints taken and submit to an eyeball scan. Making the US visa inside my UK passport more reliable an identifier than the passport itself.