Hacker News Reader

Comment by sevensor | Hacker News Reader

So if everybody knows your SSN/DOB, I'd say that makes a very good identity system in the sense that we can all unambiguously refer to the same person. It's just not any use as a means of authenticating that you are the person who has that identity.

View on HN

> So if everybody knows your SSN/DOB, I'd say that makes a very good identity system in the sense that we can all unambiguously refer to the same person.

If that was all it (SSN) was used for, a "unique-id", it would work ok for that usage.

The problem is that far too many companies also make use of SSN as a "secret only you know" to authenticate that you are in fact the individual identified by the SSN. I.e, your "login name" is identical to your "password". It is this miss-use that leads to the problems around SSNs.

It could be worse. At the pharmacy, they ask you for your date of birth whenever you go pick up a prescription. That's how they verify that you can pick it up. You can send a spouse or family member or friend or personal assistant to pick up your prescriptions, too: you just tell them your date of birth and the pharmacy will just give them your prescription drugs, no questions asked. And if they have your insurance on file, they'll run it through, too.

OK, fine, whatever, except this is the same even for controlled substances. Which is quite weird considering all the other regulations around controlled substances. One time I had to get rid of some excess oxycodone after a surgery, I ended up having to go into a little booth at the sheriff's department where they had a drop box and a sheriff's deputy sitting at a desk behind a window watching me. But all my wife needed to pick it up in the first place was my name and DOB.

I do agree with you, even though SSN/DOB can be used to identify a person, it should not be used to identify a unique person [1]. As you said, Identity should not be confused with proof of identity. Hopefully it will get better with time.

[1] - https://www.pcworld.com/article/3004654/a-tale-of-two-women-...

SSN on its own is sufficient for verifying identity. SSN coupled with a phone verification step is more secure for authenticating than DOB.

> SSN on its own is sufficient for verifying identity.

No. It's sufficient for identifying someone, but not at all sufficient (not even close) for verifying someone is who they say they are.

It's the difference between a user ID (be it a small integer or a long string) and actually authenticating to perform actions AS said user.

SSN as a user identifier - to uniquely describe an entity

Actual PKI including a secure public/private key with a signature from a trusted agent (like a government ID authority), and maybe also web-of-trust signatures? THAT is what is required to securely sign things.

Reply on news.ycombinator.com