Hacker News Reader

Comment by OrwellianChild | Hacker News Reader

This strikes me as a pretty difficult problem, since it touches on personal privacy, information security, and identification all at once...

The simplest solution would be a disassociated ID card with a 2 or 3 factor identification (eye scan, fingerprint, etc.). Except this requires everyone to register and isn't going to gain widespread support in the U.S. for privacy reasons.

Info security just needs multiple factors, so require SSN and then an RSA-type second-factor to authenticate. This would make it about as secure as GMail, except for when you lose your PIN generator. I have backup codes for my GMail... How do we handle lost PINs when it's personal ID at stake?

Identification could be as simple as a personal e-mail address... Except we have all kinds of things tied to SSN as ID, including credit history, bank loans, etc. that require proof of individual identity, not just "unique identification".

Is this a solved problem?

View on HN

A lot of it comes down to the mapping problem between the messy real world and nice-ish structured things like relational databases.

Almost all of the "identifying" objects about a person (names, emails, even fingerprints can change over time/accidents) change with time and circumstance. That's hard to encode in a database or program against, so identity is a harder problem to solve than people would like it to be.

People like 1:1 mappings because it is easy to map and report, but those are rare in the real world. There is more than one John Smith. John Smith may have more than one email address (at the same time even).

Credit Reporting Agencies are essentially tasked with doing an ad hoc mapping of the vast fuzzy cloud of identifying statistics about a person to a 1:1 report ID. It should be no great shock to anyone that the Credit Reporting Agencies will get this wrong sometimes. Sometimes I wonder if its the Credit Reporting Agencies that should just hand out identification numbers (here's your Equifax Report #, use it apply for credit from here on out; we will no longer provide results without that specific ID #) and stop trying to corral data that will always be wild and untamable.

I like the idea that the unique identifier comes from the credit agency rather than the individual... Though this requires open disclosure of credit reporting data, which might not be a bad thing, all things considered...

How do they validate you, though? You give them the unique ID, but what's to keep you from reporting someone else's with a FICO score of 800 (top of the chart, for those outside the US).

In such a hypothetical world the main thing stopping you would be that in many cases you would need to provide three such identifiers (Equifax, TransUnion, Experian) to get a full credit report. Presumably that redundancy alone would actually help catch fraud in that world.

Doesn't 2-factor solve this problem? How would registering for SSN + 2FA be any different than registering for a SSN?

Turn the SSN into a (not secret) username/uid and add a 2-factor seed that's a shared secret between the SSA and the individual. Provide an API for 3rd parties to validate (SSN, 2FA code) pairs. If things go wrong, 2FA seeds are lost, etc, there's the same fallback that exists for lost SSN cards or stolen SSNs: go to a SSA office and get it fixed in person.

The SSA could provide an online SSL-protected client-side webapp to generate 2-factor codes for those who don't have a smartphone. They could offer it as a telephone service too.

Mark Twain* said "Keep all your eggs in one basket. Then guard that basket."

A good solution to identification would be a central state operated database. But it would have to be backed by strong laws defining what it can be used for with no loopholes, not even for police of "national security", and a default deny policy. It would help secure taxes, welfare benefits, health care, voting, and background checks. The database information cannot be sold, data mined, or used in a criminal investigation without a non-rubberstamped warrant. The database can be used to confirm identity but the ID number cannot be stored anywhere else. Other agencies, both government and non-governmental, will be required to generate their own internal IDs without recording the national ID so if one database is compromised it doesn't collapse the whole house of cards.

These are common sense policies but they are all human policies. No amount of technical wizardry can stop a human from doing something stupid. That's what laws and regulations are for. However the US has been stuck in a counterproductive attitude of treating regulation as a bad thing. So poorly implemented policies keep screwing up all the best technological intentions of the engineers.

(* Like most Mark Twain quotes there's a good chance this is misquoted or misattributed.)

"A good solution to identification would be a central state operated database. But it would have to be backed by strong laws defining what it can be used for with no loopholes, not even for police of "national security", and a default deny policy."

Good luck with that, in any country, in any regime.

"However the US has been stuck in a counterproductive attitude of treating regulation as a bad thing" Which is why other countries have such air-tight centralized databases that are never abused...right?

Losing your PIN generator would actually be a lot easier with the government than with companies like Google. Most government already have a branch in every major town (post office or DMV). We already have a pretty simple system for distributing ID cards, including biometric data in the form of photos.

Agree that in-person identification (driver's license, passport) validated at government offices (department of licensing, post office) would work for most people... Aren't there objections, though, about things like voter registration since they disenfranchise the poor/minorities? I haven't thought it through, but it seems like requiring these forms of ID for verification would disenfranchise the same groups in the same way? Or is this a lesser burden? I assume that driver's license would be the most likely ID to base this on...

Line of questioning is:

    How big is the non-driving population?
    How many of these need/want access to credit, utilities, other public services?
    What is recourse when you don't drive? Seek a state ID card?
    Are there any privacy/other problems with requiring that ID be obtained?

Reply on news.ycombinator.com