Comment by tonysdg | Hacker News Reader

Comment by tonysdg | Hacker News Reader

Parent Full thread

> That method would need to be secure, reliable, and traceable.

And that's why it will never happen. This is one of my biggest complaints about the Hacker News community: so many of us are engineers who see a problem and immediately think "here's a solution, technical or otherwise."

We can't "solve" humanity -- it's pure hubris to think otherwise. Any national ID will run the same risks the befall SSNs, passports, licenses, passwords, or any other form of identification. Which, simply put, is that the weakest link is always the person behind them. All it takes is one screw-up -- your passport falls out of your bag on a busy street, a thief breaks into your home and steals the safe with your SSN card inside, someone accidentally makes a list of password hashes public -- and the "secure, reliable, traceable" goes out the window.

I don't have a solution. But I think those of us who are engineers owe it to the general public to stop kidding ourselves into thinking we can come up with "solutions" -- technical or otherwise -- that aren't (1) flawed in some other fashion, (2) unacceptable due to societal norms, or (3) require the elimination of personal freedoms and liberties that at least we in the U.S./Canada/Europe seem to enjoy.

Yeah, but you can make it hard to fake someones identity. In the US you just need some Google skills and their SSN number.

In the EU you need to fake a plastic card that has your photo, has holograms and whatnot. If its lost I get a new one with anew number. For anything serious like opening a back account, applying for credit you need to show this card in person.

This is why identity theft crimes are more than 10 times higher in the US.

In my opinion there is a much better solution. My European id card including its number used for authentication is valid for 10 years, and I can report is as lost or stolen. The same technique is already in use for debit and credit cards across the globe. Why not use it for identification in the United States?

The weak link you present is actually one of the reasons use HAS to be public record.

Making it public record also implies that there's a Cert Revocation List check (during the submit to the central monitor(s) oracles) and also gives everyone the ability to monitor those lists FOR unauthorized use they aren't yet aware of.

And you are falling into a nirvana fallacy. Plenty of Hacker News users who propose "solutions" are also doing so, but that's no excuse.

The thing is, Social Security Numbers just suck. All I want is to add a verification digit at the end, like my credit card has, so that forms that require my SSN can throw an error if I make a typo. You don't have to "fix humanity" to do that; it's just adding one more digit and using it to tell if somebody accidentally entered a 4 when they should've entered a 5. Most identification numbers use this; the SSN is really the odd duck here.

So what should we do instead, be resigned to the current state of things?

I think it's totally unreasonable to tell us to stop trying to innovate. We have solved so many of the world's problems, why should we stop now?

Reply on news.ycombinator.com