On a fundamental level, it's absurd to use the same datum as a unique identifier and an identity proof. The best analogy I can think of is signing up for websites with only a password, and then having to provide that password as an identifier any time you need support.

Oh, and the password is almost impossible to change, and you're required to use it to sign in on a host of other sites.

I recently redeemed my Amtrak points for a free ticket and then needed to change the ticket which required a phone call. The gentleman on the phone asked me for my “points PIN” that was apparently required to change any Amtrak points reservations. I had never needed to change any points reservations before so I didn’t have one.

Amtrak’s solution? I could set a PIN, right then and there, verbally with the agent over the phone. No logging into my account. No email or text message confirmation. They didn’t even ask to confirm my DoB or address. Nothing. I had only given him my reservation number.

And not 30 seconds after creating my new PIN the same agent was then able to “verify” my identity/account by asking me... for my PIN.

Krebs wrote about this sort of problem with airline boarding passes back in 2015.

https://krebsonsecurity.com/2015/10/whats-in-a-boarding-pass...

Internet Archive copy of the IATA publication on boarding pass barcodes referenced in the Krebs piece.

https://web.archive.org/web/20120324074139/https://www.iata....

You can do the same thing to steal anyone's Delta Inflight wifi account to use wifi credit they've paid for and not used on a flight, just by knowing their email address.

Though that also sort of illustrates some of tradeoffs involved.

Historically, something like that might well have been handled by snail-mailing a default pin to the address on record for the account and telling you to call back after you received it.

Of course, the problem is that a lot of people these days would think that was really poor customer service.

Based Amtrak.

ridiculous

Having only a password is just fine for many sites. The real problem comes up when you have to show it as an identifier to a third party. If you don't ever need to do that, all you need is a password, not a username. (Auditability of login information within a company notwithstanding -- isn't really something a user can try to enforce, and it can happen in a variety of ways. As a user, at the end of the day, you trust the company with your credentials, and assume they secure internal access in some fashion.)

Imagine all you have is a password, and I come along to register, attempting to set my password to "hunter2". Turns out someone else has already used this. Do you allow me to continue or tell me the password is already in use? If its in use - great, I'll just log in using that other guys account!

Of course, you could let the site specify the password, which would work if they're long and random. But social security numbers are neither of those.

Nobody said they should let you choose your own passwords. We were comparing with SSNs, which are assigned to you, not chosen by you. You'd do the same with such passwords. And nobody claimed SSNs are appropriate passwords either.

>And nobody claimed SSNs are appropriate passwords either.

Except for the US government, and most banks, medical providers, and cell phone companies.

This is a good point - not all services need both identification and authentication.

I've noticed some sites using identification only (like the days of IRC), so you can have a consistent identifier to interact with people but a username isn't actually secure or owned. The converse should also be possible, in the same sense that a bank PIN is used to authenticate with no public identifier involved.

That said, for many offerings we should consider "a company employee" to be a third party. There are already employees with access to my data, but the outsourced call center employee who answers the customer service number probably isn't one of them, and I want them to be able to look up my account details without being able to impersonate me.

Because of the Swedish constitution, everyone in Sweden's name, address, birth date and, yes, personal identity number is completely public information. Thus the systems and processes in Sweden have necessarily developed around a threat model of a potential attacker knowing all these details.

The solutions Sweden has to proving identity despite this are not exactly radical: photo ID documents, and secure ID apps (encrypted certificates) on phones or smartcards.

Indeed, here in the UK we have the very similar "National Insurance Number" for tax reasons but it's never used for identification as it's assumed to be public knowledge.

There are multiple meanings of the word identification.

SSN and NIN could reasonably be used for identification of the form of "this person's data is different from that person's data". (identification as in primary/unique key)

They can't/shouldn't be used for authentication that this person is who they claim to be. (identification as in password)

> They can't/shouldn't be used for authentication that this person is who they claim to be.

100% agreed, perhaps I should have worded my comment better. My point was that this seems to be common practice in the US but not over here.

You're absolutely right.

SSN's were only ever meant to be used for identification (as in a username). In the beginning the worst that could happen is that someone else would file their payroll taxes with your SSN, and make you eligible for more Social Security benefits when you retired. It was never meant to be a password.

How would you receive benefits if not by using SSN as a password? Or to get a job when you may not have authorization to do so (noncitizen not on a worker visa)

You use the SSN (acting as the username [which links to authority to work or claim benefits]) combined with another piece of information that establishes your identity (acting as the password to establish that it's really you and not me who is applying).

For employment, the I-9 form is what we fill out as authorized US workers and to document same.

https://www.uscis.gov/i-9 (the "paper version" link works best)

You'll note that Social Security card is in List C "documents that establish employment authorization" and not in List B "documents that establish identity" nor in List A "documents that establish both identity and employment authorization"

I guess you can look at it as a form of off-line multi-factor authentication. You are using the Social Security card as proof of eligibility for the person whose identity you have already established using another factor. In that case, it's the card that acts as the factor, not the number (which if you've ever seen a social security card, it's ridiculous to think that it's in any way secure or even durable).

In Germany we too have a SSN. Only my employers know it, it can be changed. I've never ever had anyone but the tax office or my employer ask for it.

The German SSN is also trivial to query (if you don't have it at hand your employer can just phone the pension insurance) and is somewhat predictable. It's also only used for tax/pension purposes; if you steal mine you can basically only gift me money.

The closer equivalent in Germany is probably the Personalausweisnummer (ID card number). Basically everyone has an ID card, and sometimes the number of the ID card is used as age verification or is written down as part of identity verification at a bank or similar. Assuming you verified that the ID card is genuine it's a good unique identifier that survives name changes; however its usefulness doesn't come from secrecy but the forgery-proof piece of plastic it's printed on. Also you can change it at any time within a few weeks by just getting a new ID card, and it naturally expires every ten years or so.

I think a fundamental problem in the US is the requirement to verify identity via phone. In Germany that's just assumed to be impossible without a prearranged passphrase; when opening a bank account you verify identity by showing ID at the bank or a postal station or by waving your ID in front of a webcam during a live call.

How do securely obtain access to a remote system that wants you legal identity? Or do German companies allow access to any bot willing to pay?

I can't think of a use case where this happens here?

- If you want to pay bills you just do a bank transfer (they are free and fast within the EU), transferring the money to a published bank account with my invoice id or similar in the subject. If somebody else wants to pay my invoice neither I nor the company will have any objections, so no need for authentication.

- If I want to check a bank account or a credit account or something similar I have a password that was set up when the account was created

- If I want to set up an account I can authenticate either via webcam (showing off the security features of my ID card) or via PostIdent (where I have to go to a post office)

- When talking on the phone you have an authentication problem (unless a "phone passphrase" is prearranged, but for anything with lasting consequences you usually have to send them a written version per email or snail mail for papertrail reasons anyways, or alternatively they send you a confirmation per snail mail that you can object to in a reasonable time frame.

The new ID card has online features that in theory solve the problem completely for online systems, but few places implement that so far.

Modern passports have an online functionality, you can unlock that plus hardware for fairly cheap (<50€ IIRC), which lets you use your passport to authenticate and you can, similar to credit cards, have the passport reported as stolen so it no longer works.

I expect that in Germany it would also be harder to convince a bank to lend you money based on nothing but the tax number and a forged drivers license.

It's pretty much the same in Canada. I never seen it used for anything outside of the tax context.

This is because it's illegal to require a Canadian to provide their SIN, unless the use is on the list of exceptions [1].

One can still ask a Canadian for their SIN for reasons not on that list, but it is illegal to refuse service for not providing a SIN [2].

[1] https://www.canada.ca/en/employment-social-development/servi...

[2] https://www.canada.ca/en/employment-social-development/progr...

Just being able to change it would be a huge improvement.

> In Germany we too have a SSN.

Well, TIL. I guess no one ever asked me for it.

It's rare, your employer can just ask your pension insurance to get it, some do this automatically, others ask specifically.