Comment by kalleboo | Hacker News Reader

Comment by kalleboo | Hacker News Reader

Parent Full thread

I'm surprised a company that already has a lot of personal info like Equifax hasn't stepped up and created an online ID system (like how you have DUNS numbers for businesses).

As a counter-example, Sweden has national personal ID number system where everyone is assigned a number at birth. This is fine as a primary key in databases but it's not exactly a secret so can't be used to authenticate someone.

The banks stepped up to this challenge and created a common digital signature system called "BankID" where you get either a certificate/private key file (PC) or app (mobile). BankID is used for online filing of taxes, filing change of address, signing up for stuff like insurance, anything that traditionally would require a physical signature. ID verification is done by bank branches when you sign up for internet banking.

They have tried! Equifax has a service where you can pay them to verify your users' identities by quizzing them on their credit history.

That said, given the equifax breach, I literally can't think of someone I'd trust less to handle it.

This is a specific instance of a more general service called dynamic knowledge-based authentication (dynamic KBA).

I recently signed into a medical-related service that used a verification system like this.

They asked three questions. All of which were multiple choice and populated with a lot of obvious wrong answers.

Two of them were the year and model of a car I (no longer) leased, and one was a direct "what county do you live in?" which is trivial from the address.

If you physically drove by my house any time when the garage door was open in the last three years, you had a decent chance of knowing the right answers. If you had access to the DMV records, you had the right answers. And on the flip side, I hate to imagine how this would have worked for, say, a scholarship student at age 20 with no credit file.

Enjoy reading my lab test results. I feel so secure.

>everyone is assigned a number at birth.

Nitpicking (but what do you expect with a board that's majority programmers): only people born Swedish get one at birth. I got mine at age 23 when I studied there :) It still used my dob though.

Reply on news.ycombinator.com