I tend to agree. Best practices are that we shouldn't use guids as authentication/security mechanisms in software systems because 1. they aren't necessarily random so it's difficult to prevent fraud as a result of guessing and 2. you can't rectify authentication issues (e.g. via rotation of authentication or adding additional entropy) without compromising the identification function see (https://tools.ietf.org/html/rfc4122#section-6).
We should never have used them as authentication methods IRL.
2. It's also now used as an authentication mechanism by many businesses (because it's relatively ubiquitous and banks, gov, etc. assumed that the SSN owner would and could keep it secret) :
a. accepting card payments on stripe (https://support.stripe.com/questions/why-do-you-need-my-date-of-birth-and-4-digits-of-my-social-security-number)
b. driving with lyft (https://www.lyft.com/drive-with-lyft under "What are Lyft’s requirements?")
c. also for bonus points take a look at what happens when you search google for "SSN for resetting" and marvel at all the banks that let you reset your password with your SSN.
> SSN are NOT an identity mechanism
You purposely misquoted them to make your point. That's pretty lame.
It's not a misquote if you parse the original statement as "NOT ((an identity mechanism) or (infrastructure to facilitate business))". It's perfectly fine to simplify "Not A or B" into "Not A" when your argument is "Yes A".
In the context of godzilla82's wording, I think the latter interpretation is more likely, making it not a misquote. Even if that's mistaken, I doubt it was an intentional misquote.
That's exactly what they are. I don't understand who you're trying to fool here. It's a number, for social security, that is assigned to a person. It's poor as an identification method, so it's commonly used in fraud, but that's just hand waving to distract from the discussion about the purpose.