Then there is no "your social security number" or "your identity" for someone to open a bank account against. You open a bank account and they give you a bank card and you set an address and phone number. The day you open it, they shouldn't need to know who you are, because it's a new account with $0 in it. After that, the owner of the account is the person with that bank card who can be reached at the address and phone number given when the account was created.
Get rid of centralized identity and there is no centralized identity to steal.
How would you feel if an investigation stalled when a bank said “we have no idea who these people are, or where the money went”?
Any time someone attempts to use your SSN to identify themselves as you, you should be notified and your authorization should be required for that use to be allowed.
And the higher the value of the authorization, the more care should be required.
Companies are able to do this already with 2 factor authentication. And I think we SORT of have that for change of address, as the Post Office both requires ID and notifies you by mail. Maybe that's really just one factor.
Allow people to require as many additional factors as they want. Confirming my identity in 6 ways when I decide to sell my house sounds good. 4 ways when I buy a car. One or none is fine when I make a $10 purchase. Let me decide.
And let them CHOOSE what organization manages authentication. A private company might do the job a lot more effectively than the Post Office.
Add human methods too. A call from a sibling or child might be one people could set up. Require validation by a notary public.
So now the government needs a way of contacting you. Suppose they have your address and phone number on file.
Then you lose your way a while and become homeless for two years. You can't afford a phone and no longer have the same address, and have lost your ID or it expired. You finally start to turn it around and go to open a bank account. The government contacts you how? How do they know it's you?
The answer is that it's a new account and you're not trying to prove anything about whether you're the same person who lived at the old address, so you shouldn't have to.
And once you have a bank account or a mortgage or such, you and the bank can arrange for any form(s) of authentication you like. It shouldn't have anything to do with the government, and it definitely shouldn't have anything to do with how you authenticate yourself to your job or your wireless carrier.
But the rest sounds plain wrong to me.
Your phone might get stolen, your name might change due to marriage, your address might change because you moved/got evicted. What now?
If someone steals your phone and password and bank card and ability to receive mail at your home address all at once then you're pretty screwed, but you're pretty screwed then regardless, right? That's the level of screwed where somebody else can also get a government ID in your name.
And in fact, for poor people, anything that might engage their entire savings might also benefit from a more advanced identity verification.
For example my stock exchange account just takes a password. It’s a scandal.
This might work better than your proposal before.
For example
123 Main St. Apt 45-WXYZ
Where "WXYZ" is different for each business, to pollute any data mining algorithms trying to collate my address across sites. In some cases when they use address resolving functions, it also helps to spell out your address e.g.
123 Main St. Apt FOURTY_FIVE WXYZ
Now, there is absolutely no reason it could not be OTP'd (or uniquely derived for each account).
Considering your phone number is more and more being used in 2FA ... if you were to ever change your number and someone else got it, this would pose a serious security risk if you failed to change over ALL of your internet accounts 2FA to the new number.
There are plently of other places we give our phone numbers to, which might not have anywhere near the protections that Facebook say they provide.
[1] https://support.startmail.com/hc/en-us/articles/360007297457...
[2] https://www.fastmail.help/hc/en-us/articles/360060591073
Lesson: Don't use your phone number for 2FA. Get a bunch of virtual numbers and redirect their SMS to your e-mail.
If U2F or TOTP is an option, use it. And use a physical key for TOTP, not some Google or Microsoft authenticator.
I live in the EU and I do operate under the assumption that banks take reasonable measures to ensure an account is linked to a legal identity.
I appreciate the pragmatic stance you take, and we should definitely move to more robust identification methods.
But making this case for better ID tech should IMHO not be confused with giving facebook and the others a pass. This should never have happened, and the very fact that we have a data trove this big is already a problem. That they don't seem to even attempt to protect that data is another one.
Close that shop up. The fines for this kind of stuff (and the other stunts they've pulled) should make it economically no longer viable to keep it open, really. The first time you fuck up this hard, the fines should hurt. This is not their first time.
The time to shutdown Facebook has past. Now we just have to suck it up and endure them and their effects like we do Cancer.
I am not from the US, but is this really all you need to "proof" your identity?
The most common thing I have seen in the EU when companies have a KYC requirement is that during the sign up process you will have a quick video call where you have show your ID card while they verify that your ID is legit.
Yes. I think the scary part is WHAT these identifiers are connected to. EG. your email being linked to a private antifa community, pro-Taiwan communities, adulteration meetups, etc.
Even if this info wouldn't be good enough to sign for official stuff it's still private and unique enough to target you though.
So if that's the case, I think we should move beyond really even trying to think of this info as private or a marker of identity, and we need to move everyone to more secure forms of identity verification.
As has been pointed out on HN before, "identity theft" is a made-up concept to make it seem as if you had something stolen from you, when the real problem is banks and other service providers do an absolute shit job of identity verification. They're the ones at fault, and they try to shift the onus onto you to fix things when they screw up.
Indeed, a social security number is pretty much the only additional piece of data to the stuff above that one would need to open up a bank account in someone else's name, and those have been leaked plenty of times too.
The government needs to make harsher penalties for banks and others that can ruin your credit, etc. because they accept all this leaked info as "proof" of identity.