Hacker News Reader

Comment by ourmandave | Hacker News Reader

Plenty of people began freaking out earlier this year after a breach at big-three credit bureau Equifax jeopardized the Social Security Numbers, dates of birth and other sensitive date on more than 145 million Americans. But as I have been trying to tell readers for many years, this data is broadly available for sale in the cybercrime underground on a significant portion of the American populace.

So I can rest easy now, knowing I've been fucked since forever.

View on HN

I know this is sarcastic but the answer is that this system is complete broken and should be replaced by something that is made for authentication. Maybe something that is somewhat secure and allows you to change your “secret number” ones it has been compromised.

Others already did it

https://en.wikipedia.org/wiki/Estonian_ID_card#Cryptographic...

Granted it's not foolproof but it's definitely a step forward compared to the SSN bullshit.

In the end its not the crypto that makes it more secure. Estonia still has a national identifier number, just like US has the SSN. The difference is that while I can know your name, DOB and the identifier (which actually contains your DOB in it), I cant easily pretend to be you. And this is because the process itself is different - when I got to open a bank account, I present my ID card, the bank can plug it in and pull up my profile from the central authority (ran by the government), and I need to pass the checks of being there in person, with a matching ID, which also checks out from the central system (including picture).

Combine this with for example strong proof via blockchain about who used to check your info and from where, and you are at a pretty good spot. Note that Estonia does not do that last part just yet.

As for the US, the chances of having a national ID card along with similar infrastructure are slim to none. So don't hold your breath about major changes any time soon. The best best would be to get closer to something like the above solution via private companies or maybe the credit bureaus themselves (once they are force to change their business model from aggregating and selling data without your consent).

One crazy thing was when I got my mortgage and was transferring my down payment to the mortgage company, my bank didn't require me to even show my ID. There is probably a reason for it, as the documents all matched up on the name and I had to submit a lot of information to the mortgage company. I still found it very strange making that kind of transfer of tens of thousands of dollars that I didn't have to show any kind of proof of ID.

Maybe the government could issue 100,000,000 ID Coins per person, and you would use each of them only once ... a bit like bitcoins, but for ID... You would spend 1 each time you need to prove your identity. They could be in a hardware wallet and could easily be replaced for free.

Yes, then you are shifting the security problem to securing the private keys for these identity tokens.

and they could easily be revoked... If the government wanted to delete somebody, it would be pretty easy... just revoke all tokens and don't issue new ones.

That sounds extremely dystopian. And since blockchain transactions are irreversible, it means the government can just permanently delete you.

it's just how it is when everything is digital... digital voting machines with no paper trails are just as bad... if not worst.

Well, in some sense, yeah, you probably can rest easy.

If you've been fucked since forever and nothing bad happened, why do you think anything bad will happen now?

Reply on news.ycombinator.com