White House wants to end Social Security numbers as a national ID
arstechnica.com
arstechnica.com
Generate a private key on the card, have the government sign it, keep it locked up with a PIN/password (and self destruct after X number of invalid attempts). You can verify authenticity offline as long as you can request the card to sign a response and verify the signature, problem solved.
Society seems to function just fine. It's totally not necessarily to give each person an identifier.
Problems may arise:
1) What if you don't want an ID? Ok give them the number, skip the ID and photo, and go forth. 2) What about people who don't want to be know and forego identification? I'd say you have little choice, it's extremely hard to remain off of SOME database. 3) ID's cost money. Whose going to pay? That's a good federal grant question. Each state gets refunded for the trouble.
You’d be asking businesses to get set up with every single state and territory for the purposes of identity management, and giving fraudulent folks fifty-four opportunities to defraud national businesses rather than N social security numbers. I can do the OMB analysis on your bill: 54x growth in consulting fees, billions in lost productivity forcing every system to switch to a new fifty-four jurisdiction unique identifier, etc. etc.
Ideal would be a number that fits in the same space as an SSN but can be rotated. This limits significant changes to national company systems, but means you only have a billion not-so-secure numbers to play with, so you’d have to strongly disincentivize rotations to about 2 or 3 per lifetime modulo American death rate. If we are going to disrupt extensively, let’s focus on one American system rather than fifty-four systems for no net benefit; if state-level identification was useful for this purpose, we would already be using the ones we have. We don’t.
That's the problem. It doesn't cost much, but a Social Security number costs nothing and takes nothing to get. Something is infinitely more than nothing. Passports also require a lot of paperwork and identification to get that people may not have.
I don't see how making it a state prerogative makes it easier tbh. The federal level seems appropriate for that.
Just because you do not share such beliefs does not mean they do not exist, or can be dismissed.
As for UUID, so now I need to remember a 64 character UUID?
People on HN make jabs at things like fingerprint / facial recognition as passwords all the time, but if you have something you need to keep private it's easy to forgo them and use a proper password instead (even if it's more inconvenient). Even if we replace SSN's with a 1024-character identifier leaks will still happen, because we continue to use the wrong tool for the job - leaving us no better off and just more inconvenienced.
We need a national ID system, ID numbers need to be no more than identifiers, if you need to validate your identity proper two-factor authentication - possession of your national ID card with your private key, and a password only you know - is the only safe way to do so.
It’s one that needs to be addressed, but sacrificing security isn’t the way to go about it. The number one issue here will be verifying identity for welfare programs and employment, which is already problematic (if you can’t carry an ID card you probably aren’t carrying your social security card and birth certificate either).
A smart card handles everything pretty well, it acts as a normal physical ID but can also be used to electronically sign things as well (plug it into a terminal at the bank and enter a PIN to verify your identity when opening an account, or use a card reader at home).