Hacker News Reader

Comment by bifrost | Hacker News Reader

There are very few common identity factors available for these companies. I'd almost be willing to have the US Govt develop a "medical ID number" specifically for this purpose.

View on HN

It would have the same issues as SSN though: a number that once it leaks lets someone else have too much knowledge/power over you.

But that is THE FUNDAMENTAL problem. No one should be able to impersonate you and open up credit cards in your name simply by knowing your Name, Address, DOB, and SSN. Just as no one should be able to purchase things using your credit card account by knowing your name, credit card number, and expiration date (all of which are printed on the card, which you give to people for B&M purchases). The system is fundamentally broken, and that fact gets ignored by all the focus on "data breaches". At a minimum, we need to move to multifactor authentication and one time use "credit card numbers" generated at the time of the transaction.

> one time use "credit card numbers" generated at the time of the transaction

PayPal used to have that feature but got rid of it for some reason.

AMEX did too, I think the problem is the keyspace is small enough that it would be a serious problem.

Discover had that for a while, many years ago.

Capital One still has this feature for online transactions.

Google Pay still offers this. I have a virtual card number that is given to merchants instead of my real CC number. I don't know if this is a feature for all of Google Pay or requires special integration with my particular CC/bank.

If the healthcare industry used medical id numbers instead of SSN's that would help. Better banks should be forced to stop using SSN's completely. And forced to use 2factor. Preferably both.

And this is a function of power asymmetry. Why is it my problem that a bank issued a credit card to some guy in Romania or Russia who said they were me? It should be their problem unless they can prove it was me who opened the account. But they make it my problem through the enormous power they wield over our ability to participate in society.

If they come looking for the money I supposedly owe them on that account, I should be able to tell them to fuck off and collect from whoever they sent the card to of their own volition.

If they can't figure out whose business they took, maybe they need to reconsider their practices, otherwise they're just giving away money.

We're not solving this unless we can teach all people, even newborns and coma patients, to do 8192-bit RSA in their heads and to generate and remember suitable private keys all in their heads.

We're not solving this.

There is absolutely no technical reason why it should be the case if done properly.

With SIM cards or other hardware devices, your private key is never leaked (if "done properly")

With cryptos like BTC, you can generate many keys from one source of entropy, and treat them as disposable.

I don't see why medical records couldn't be encrypted with a disposable key, given by a hardware device which stores the seed, and only linked to the matching public key.

I wonder if it makes sense for the government (or private sector) to develop an official identity database and provide identity-as-a-service. One which has a public "username" that is unique/permanent and can be freely given out - a private "key"/password that you should never ever hand out to anyone - and physical offices that you can go to with your passport and other evidence, in order to change your password when needed. You could then develop apps or APIs on top of this, in order to authenticate your identity whenever requested by a 3rd party.

I suspect that won't happen with private industry because its unlikely to have a cost advantage and it wouldn't be mandatory.

In Germany we have identity-as-a-service provided by post offices. You go there with an ID and the form and they send that form with confirmation to where it is needed. It's quite commonly used to open an account with an online bank, for example.

https://de.wikipedia.org/wiki/Postident

(And I just see that the service is also offered by mailman as well, so they can come to you. Austria and Switzerland have similar services.)

edit: It's quite remarkable how sometimes people online say there should be something, and I'm like, yeah, we have that.. I wonder if it works the other way too. Probably.

In Sweden, we have one as well but organised by the banks, called BankID[0]. There used to be an open-source client[1] for it but it looks dead, now.

[0] - https://en.wikipedia.org/wiki/Electronic_identification#Swed...

[1] - https://git.fribid.se/fribid/

If it was separate from your SSN it could only be used for medical records tracking, thus not used for credit things. The SSN isn't supposed to be used for tracking, but it is anyways...

Exactly. At work I generate different API keys for different purposes, so when/if one gets compromised I can shut it off and generate a new one without all the integrations breaking. Right now SSN is the government's admin/root API key. One compromise and it's game over.

But if my medical ID got stolen I could turn it off and get a new one without invalidating my passport and disqualifying me from a car loan and locking me out of my college transcripts etc.

Rightly or wrongly, abuse case - drug seeker. Go to doctor, get narcotic prescription. Get new medical ID, go to new doctor, repeat.

no, that doesn't solve anything. I could get a new SSN (I can't, but you can imagine I could), but then I need to update everyone who has my old SSN. Your scheme is the same, except slightly less people to notify.

> I'd almost be willing to have the US Govt develop a "medical ID number" specifically for this purpose.

That (along with standard identifiers for health plans and providers, which survived as requirements) was originally part of HIPAA, though it was stripped out.

Reply on news.ycombinator.com