Hacker News new | ask | show | jobs
by lcnPylGDnU4H9OF 903 days ago
Not sure about where you’re from but US institutions often treat the SSN as a secret which should allow account access. Which it’s not by design but nobody wanted to make a better system; it’s why banks have claimed that they are not defrauded by people and instead the fraudsters “steal identities”.

To answer the question more directly, it’s treating the identifier like a password that is problematic.
2 comments
tuwtuwtuwtuw 903 days ago
Okay, but that is then about authorization and not about "identity". I agree that treating it as a secret is a bad idea.

The person said SSN and equivalents, so I guess it depends on what is meant by equivalents.

Where I live my personal number is used as identity, but to actually prove I am the owner of it another mechanism is used (private keys embedded in certs). The personal number is very public info by design and can't be used as a secret.

link
lcnPylGDnU4H9OF 903 days ago
If my web identity was my personal government tax identification number, I would be worried that one could use that to fraudulently and successfully claim to be me with a fair number of institutions because the authentication mechanism is lacking efficacy.
link
tuwtuwtuwtuw 903 days ago
Yes, I understand, but you mix up identity with proof of identity.

My non-web identity is my name. But me saying that my name is John Doe is not a proof that this is my name. In the same way, me saying that I have identification number 12345678 isn't proof that I actually have that number.

As I wrote, I have a government issued identification number. This number can be looked up by any citizen in the country since it's public info. You can even look it up online - it's not secret.

But someone knowing the number doesn't mean they can prove it is their number, because proof of identity is not in the number itself - for that we use public/private keys and other secure mechanisms.

I understand that this is not how it works in the US because some organization treats the SSN as secret. But that's not an issue with government issued identity number as a form of identity, it's an issue with the US system. Other countries does not have the same issue, since they didn't mix up identity with proof of identity.

link
Joker_vD 903 days ago
Many people don't want their online identities be easily connected to their offline identity (or even with each other). Hell, you yourself didn't register on HN with your G.I. ID's serial number for some reason, did you?
link
tuwtuwtuwtuw 903 days ago
Sure, but this specific part of the discussion was about it being a bad choice because "it’s treating the identifier like a password that is problematic", which I objected to.

I do agree that in many cases I would not want to use it as my web identity. (Those cases would also overlap pretty well with cases where I don't want to use my own email address, like when signing up for sites like this, reddit, Twitter and similar).

link
maxcoder4 903 days ago
Of course this is extremely stupid (basically using the "username" as a secret, something everyone in IT and itsec knows not to do). If we started using SSN-equivalent identifiers as online ID problem would solve itself because by then they're not a secret anymore.

In my country my national ID numbers are nowhere near as problematic as SSN on the US (from what I understand).

link