Hacker News new | ask | show | jobs
by cogman10 904 days ago
Remember when the US gov did that with a number? The SSN?

I don't know how you can make something like this "easy to recover" without introducing giant security problems.

3 comments

> Remember when the US gov did that with a number? The SSN?

The problem is that the SSN is treated as a password when it should be treated as username.

Knowing first.last at gmail.com gives you nothing much, security-wise. Knowing I'm 123456789 at ssn.usps.com wouldn't be that much different, though given the limited search space, it would be an easy target for spammers. (Perhaps expanding from nine digits to something bigger (16+, see perhaps ISO/IEC 7812) would be useful, though there'd have to be a lot of work to update systems, even though they're not short of numbers.)

> I don't know how you can make something like this "easy to recover" without introducing giant security problems.

In a similar way for instance that you would recover a lost, stolen, or accidentally destroyed US passport (but presumably cheaper).

I was thinking more along the line of walking to your local Goverment office and validate your ID.

Many countries offer digital IDs to interact with them. And a (cumbersome vs digital but fast Vs traditional government processes) way of unlocking it. It would be just offering a email inbox linked to it.

In Spain we have an Inbox from the DMV for fines, one with the Tax authority, one with local government… these are messaging boards inboxes. The move to a single digital inbox could help streamline many government processes.

Yes, I agree. In fact I'm also Spanish and the solution felt as obvious as it would be in Spain. The reason I suggested the (US) passport analogy was to make it as relatable as possible to the American audience of HN :-)
Yeah it was so much better keeping a book of letters from creditors that you showed to any future creditor to show trustworthy-ness.

Whatever mess you think SSNs have caused by their unintended use outweighs the previous system. The simple test for that is, why do people use SSNs as it's not legally required for anything but USG interactions.

> The simple test for that is, why do people use SSNs as it's not legally required for anything but USG interactions.

Because if I want to open a bank account, rent an apartment, or get a mortgage, the other party requires me to give them my SSN, on the assumption that it is a valid unique key for tracking debt payment reliability.

It doesn’t matter that the SSN is only legally required for interactions with the US government. When housing is a human necessity, and all sources of housing require a SSN, then using a SSN is not a choice from which one can infer preferences.

Companies ask for the SSN because its so much more efficient than their previous systems.

They already did debt repayment without SSNs; it's just easier with one. The existence of fraud with a SSN doesn't mean there wasn't fraud without one; and if there was more fraud now then companies would abandon asking for SSNs.

You might not like SSNs but their existence has been a benefit not a detriment to the USA.

All that test confirms is that when every company requires them to do business, one can no longer accomplish anything financial without submitting an SSN to a third party. I guess one could choose to only ever be self-employed, take no loans, and use Mattress Bank.
The purpose of an LLC/Corporation (the Company) is to provide a corporate veil from the managing directors. In such situation, an SSN is not required, but most businesses will then require the Company's Tax Identification Number (TIN) which effectively provides the same identification value as an SSN. Going down that route, the Company itself can take loans and transact with both domestic and international banks.
Because companies require them.