A Bloomberg reporter’s account of trying to get back his name and credit rating

Re:A Bloomberg reporter’s account of trying to get back his ... by wongarsu on Monday August 12, 2019 @12:31PM (#20676991)

The German SSN is also trivial to query (if you don't have it at hand your employer can just phone the pension insurance) and is somewhat predictable. It's also only used for tax/pension purposes; if you steal mine you can basically only gift me money.

The closer equivalent in Germany is probably the Personalausweisnummer (ID card number). Basically everyone has an ID card, and sometimes the number of the ID card is used as age verification or is written down as part of identity verification at a bank or similar. Assuming you verified that the ID card is genuine it's a good unique identifier that survives name changes; however its usefulness doesn't come from secrecy but the forgery-proof piece of plastic it's printed on. Also you can change it at any time within a few weeks by just getting a new ID card, and it naturally expires every ten years or so.

I think a fundamental problem in the US is the requirement to verify identity via phone. In Germany that's just assumed to be impossible without a prearranged passphrase; when opening a bank account you verify identity by showing ID at the bank or a postal station or by waving your ID in front of a webcam during a live call.

[ Parent | on HN ]

Re:A Bloomberg reporter’s account of trying to get back his ... by lonelappde on Tuesday August 13, 2019 @07:11AM (#20684568)

How do securely obtain access to a remote system that wants you legal identity? Or do German companies allow access to any bot willing to pay?

[ Parent | on HN ]

Re:A Bloomberg reporter’s account of trying to get back his ... by wongarsu on Tuesday August 13, 2019 @11:00AM (#20686464)

I can't think of a use case where this happens here?

- If you want to pay bills you just do a bank transfer (they are free and fast within the EU), transferring the money to a published bank account with my invoice id or similar in the subject. If somebody else wants to pay my invoice neither I nor the company will have any objections, so no need for authentication.

- If I want to check a bank account or a credit account or something similar I have a password that was set up when the account was created

- If I want to set up an account I can authenticate either via webcam (showing off the security features of my ID card) or via PostIdent (where I have to go to a post office)

- When talking on the phone you have an authentication problem (unless a "phone passphrase" is prearranged, but for anything with lasting consequences you usually have to send them a written version per email or snail mail for papertrail reasons anyways, or alternatively they send you a confirmation per snail mail that you can object to in a reasonable time frame.

The new ID card has online features that in theory solve the problem completely for online systems, but few places implement that so far.

[ Parent | on HN ]

Re:A Bloomberg reporter’s account of trying to get back his ... by zaarn on Tuesday August 13, 2019 @09:55AM (#20685836)

Modern passports have an online functionality, you can unlock that plus hardware for fairly cheap (<50€ IIRC), which lets you use your passport to authenticate and you can, similar to credit cards, have the passport reported as stolen so it no longer works.

[ Parent | on HN ]