Also why are these phone companies persisting SSNs in database ? Why can't they run the credit check initially and discard the SSN. There should be laws around this and enforced. It is time to hold these companies accountable. We are so tired of being worried that our ID may get stolen.
People were rightfully worried in recently emerging computer age that these credit agencies would have secret dossiers on everyone. At least this law let people look at them and in theory correct them.
It probably time to revisit that 50 year old act. I'm not sure how much lenders even use the standard scores anymore. Many calculate their own scores and probably include all sorts of info that we would be mad about them using if we knew what it was.
Possibly even more secure than that same doctor having it in their system.
Doctor's offices are so archaic at times. Only a handful let me do the forms online in advance. And even those have more paper for me to waste when I arrive.
In almost all cases, someone is entering what you hand wrote into a system; and then they discard the paper copy.
If they shred it that's great, but dumpster diving at medical offices has made the news many many times.
I hope them asking for it didn't discourage someone without an SSN from getting their shot, since immigration status isn't relevant to eligibility.
People volunteered the leaked info. Just say no.
But yes, I wish we could be as modern as some European countries. I haven't heard of these identity theft issues in France, where everyone has a national identity card.
> Deutsche Post offers a secure identity check service – to millions of users every year.
> On behalf of your contracting party
> To ensure that only identified persons have access to sensitive services
> To sensitive services including those from the financial services sector (such as opening an online bank account), telecommunications (activating a prepaid SIM card), health care (access to health information) or the mobility industry (including car sharing).
Compare this with, say, Estonia where practically everything can be handled through the keys in the ID card.
It's kind of like the feeling I get looking at somebody with a very nice car or house: "Oh, it would be neat to have such a thing but there's no way I'd ever splurge and get that." It's difficult for me to conceive of some things other countries have as just being "normal".
second, many systems of law treat individuals quite differently.. many systems that are not repeated in detail, on YNews, do not give much choice to an individual by design
It could be better in so many ways, though, too. It would be nice if younger people (say, sub-70) would (and could be permitted to) take up the mantles of leadership.
I'd really like to read a speculative fiction/scifi where every generation operates under its own system of laws, and you can opt in to a neighboring generation's laws instead once every N years or something.
For instance, when I was looking for an appartment, the State had a service to both authenticate and watermark some documents (id and proof of income, among others).
The watermark was a bunch of big bars with "this is intended for rental search" written on them. Kinda low-tech, and it feels like a creative attacker could use software to strip them out, but it's cool they did that.
In theory, we have some very good APIs for securely authenticating someone (France Connect in particular), in practice administrations are slow to adopt them.
First, let's assume the identity would be backed by a somewhat decentralized system; e.g. the identity could be backed by any state/territory's existing ID cards.
The problem is making the request signing step secure and accessible to... well, anyone, tech-savvy folks included. Software for installation to a computer is an obvious no-go. A mobile app is probably a good idea but in any case I think we can assume a website will be a necessity. You've got to be able to give that website your private key. Guess what, you've already lost - as soon you tell people to type their key into this website, people will type their private key into any old website now. (I remember when my mom, with the best of intentions but without my prior knowledge, filled out my FAFSA info, SSN and all, on a scam .com site despite how many times we were told "fafsa.gov" or whatever.)
But let's pretend that's a solvable problem, just for the same of argument. Let's assume it's a federal government provided site which you can provide with your private key on demand to do signing on your behalf and it's relatively secure actually keeping the key in your browser. And there's a mobile app option which can store the key locally with better security and do signing in memory which can actually be wiped after. Fine. Now convince the public that this site/app do not constitute a Federal database of identities. You and I know it wouldn't, as described, but I would not blame anyone who objected on those grounds one bit, because without the necessary knowledge it absolutely would seem like a Federal ID, and folks are right to be wary of a single source of identity information. After all, all that does is take the SSN problem and add to it civil liberties problems. The distinction between SSNs and a [somewhat] decentralized PKI scheme with a centralized signing app for security/anti-phishing reasons is a distinction essentially impossible to convey to any but the most tech-savvy.
Worried about "mark of the beast" based objections? Make it optional. Those who wish can retire their SSN and receive their public / private keys and then the government publishes their SSN as a trashed SSN. Everyone who still wants just a SSN can take their chances.
USA passport for my children didn't require SSN. And a passport complies with TSA id checks.
Which is exactly why it will be :(
Not recommending anyone do this as it's obviously illegal, but..
Guess who ends up footing the bill when a bank gives a loan to someone pretending to be you? Hint: It’s not you, and it’s not the fraudster either.
That could go the other way, with someone else filing their income under your SSN without any corresponding withholding. This, too, needs better authentication than a mere SSN can provide.
In that case, third parties could use a government website to get a row/col and ask you to verify, and the website could say yes/no. Yes, there is a risk of your one-time pad being stolen, but it is no greater than the current risk that any US citizen's tax documents or SS card can be stolen.
Who issues the private key? "get" implies it comes from somewhere, i.e. a CA system.
If the government is the CA system, and your private key is your identity, how do you establish your identity in the event that you lost your key?
The nice thing about SSNs being immutable is that none of these are concerns. (It's also the bad thing about SSNs being immutable.)
We do have one thing in the US that’s physical proof, and that’s your birth certificate. But I’m sure people lose them and they can be pretty easily fabricated.
This is just a knee-jerk thought and I'm sure it can be improved, but I believe asymmetric keys are the solution.
On the other hand, you can't really expect the average citizen to properly curate a private key, and a private key also doesn't work for verification purposes.
I think the problem would be easily solved without encryption or keys by using the social security number in combination with a user-selected PIN number.
Any time you apply for credit somewhere, you should have to provide the social and a PIN. There should also be an easy way to generate single-use PIN numbers that can be used when applying for credit.
They already have a lot of the infrastructure for doing this. You can already put a credit freeze on your social security number and protect the credit freeze with a PIN, for example.
Whenever I am applying for credit, I simply "thaw" out my social security number for a couple of days. This works pretty well, but it's a hassle because you have to do it for all three agencies. It also suffers from the problem that my credit could get compromised if I left it thawed out too long.
Do you mean private key? Or am I about to have a TIL moment? Because your public key is, well, public so I wonder what a compromise of that would look like.
lol. How do you think it works right now?
The party who accepted the SSN (or their insurance) is liable for footing the bill for the fraud, except in the ridiculously unlikely scenario where they’d manage to collect money from the fraudster.
Except that the problem isn't which party is legally liable. The problem is that the legal system is almost entirely inaccessible to the vast majority of people.
Give SSN. Get email txt or notification to verify. SSN service replies back with a real Id number. Real id number is used for banking.
- It's inobtrusive enough to wear all, or very nearly all of the time. Contrast cards or similar carried-but-not-worn tokens.
- It can be readily use to tap a sensor for identification purposes. Contrast cards or similar tokens (e.g., USB keys), which are far less immediate.
- It is replaceable. That is, if it's compromised, stolen, or lost, it can be replaced. If it becomes unadvisable to possess, it's readily discarded and reasonably easily destroyed. This contrasts with biometrics or permanently embedded sensors.
- Its absence is reasonably immediately determinable. Again, contrast carried-but-not-worn tokens.
- The existing prevalence of ring-wearing makes use of an NFC ring less obvious or evident (mostly a concern in early-adoption periods), or the opting-out of wearing one (which ring is the NFC ring?), without directly querying each individual, which ... might not work regardless (depending on implementations).
- There are relatively few people who would be entirely unable to use such a device. Ready alternatives for most such cases exist: wrist bands
- Unintentional validation (e.g., surveillance) is relatively easily avoided, if devices require immediate contact with a sensor/receiver. That is, a surveillance entity couldn't mass scan a crowd or region quickly, but would have to individually query rings in close proximity. (This might be achieved through high-volume transit points already, but this already raises the ante.)
- It's possible with a query/response system that multiple identities with the same root, but not immediately correlated, could be supported. (Deanonymisation or identity linking remains a significant problem, however.) Ideally, such a system could be limited to only satisfying minimum qualifying criteria (e.g., "I've paid a fare for this trip"), rather than transmitting either a full personal dossier or an absolute identity.
Key (so to speak) challenges are in agreeing on a single standard, ensuring crytpgraphic robustness, and protecting privacy, surveillance, and other concerns, as well as distributing the detector infrastructure for desired uses.
There are cases (e.g., mass-transit turnstiles) where this isn't desirable --- the intent is to maximise throughput. (The quesiton of whether or not validating or fares are a net benefit is also open.)
For a more secure facility, or payment system, tag + pin (and potentially other identifiers) would be preferred.
I believe the direct quote is "Why come you got no tattoo?"
As an aside: When it comes to an authentication source to take the place of silly shared public "secrets" I think it would be great if the United States Postal Service "pivoted" into issuing digital certificates to individuals. They already have infrastructure and procedures in place for identity verification and physical delivery. I suppose that's too much like a federally-issued ID to ever fly, though our "REAL ID" drivers licenses are, in effect, a federal ID anyway. I'd rather have a digital certificate out of the deal too.