Names and Identities Change – You Should Design for That | Hacker News Reader

Names and Identities Change – You Should Design for That

spin.atomicobject.com

48 pointsphilk1025 comments

When I worked for travel company (still exists as a captive marketing brand of someone else not a real company) booking flights was very complex as the name the user gave had to match their identity presented to the TSA exactly or they were likely to be refused entry. This was made more complex as the reservation system we had to call used EBCDIC on ancient mainframes and often failed to properly encode a person's name with non ASCII letters like Å often resulting in tickets that could not be used. The name would look fine in our booking flow and email, but the actual ticket data would be wrong leaving the customer angry at the time of flying.

So supporting names is not only an issue with changing them, but preserving the actual spelling through all systems you call. I actually spent 4 years in college (long ago) with no vowels in my name, and never could get them to fix it (even my diploma had it spelled wrong).

My vision insurance company (in the US) is awful about this. They use emails as usernames and when you log in, there's an option to change the email or password. The problem is if you change the email, it only updates where notifications go. The username is still the old email and that's where things like password reset emails are sent.

(And they don't support 2FA. Better keep the old email around indefinitely...)

I've been considering a name change in the last few years. My last name, specifically. The hard part won't be to have my name changed legally, but rather to change my name with all the organizations I belong to. My bank, my professional society, my employer, etc.

My current record is a person that had 8 separate names over the course of employment. Some that were valid at the same time. Not really an issue with e-mail, but quite a lot of systems just don't deal well with names. Never mind the idiots that think they can detect fake names.

My wife is setting up/improving marketing for her employer, a small non-profit. The previous efforts at a Facebook presence was under the name of individual employees. So she attempts to set up the account in the actual name of the company. Facebook programmers, in their wisdom, deemed "Saint" a title and not allowed to be the first name. Clearly, they're no Catholics at Facebook.

Does HN allow this? When I transitioned I made a new username and sort of started over. But it led to me disengaging from the platform.

Behind our usernames, there's user number. I'm sure dang & co, would let you rename yourself if you asked them nicely.

However adding it as a option, raises the problem of people trolling the site, and then quickly changing their username to dodge the fallout - some sites have icons to show that a user has recently changed their name, some have a username history on the profile - it's not a trivial problem to solve.

Yeah, some places have an unwritten "just write us and we'll do it" policy. It's nice to know they're up for it, but the cognitive load of reaching out is like 100x higher than just putting it in your preferences. I know there's no good solution here though, so I guess i'll just shout at the sky.

As an aside, you've got some great content on your blog btw. :)

Names as identifiers are an archaic throwback at this point. Every person on the planet should have a unique GUID assigned to them. This can then be used to refer to them independent of their preferred identity.

Names are for friends, not companies.

Disagree. The services that require a strict one-to-one mapping between accounts and a human individual is a very small subset of all services (mostly public services and legacy finance).

It would also be a privacy nightmare.

That is basically a 'super SSN'. With the same sort of issues that SSN has. It is a decent idea but even that you should be able to change if needed. Remember there are nefarious players out there.

SSN has only issues when it is used as password.

Many other national id's are not used like that and do not have any issues.

That assumes all players will use the number correctly. SSN is an example where that did not happen and is used as an authentication and authorization token at the same time.

That is true and it requires some educating by the state. Not possible when the state is using it wrong.

Education would not work that well either unfortunately. On the card it says 'not for identification' (in most cases now). Once the number was disassociated from the advice people did whatever with it. It is a thing where identity theft usually starts. It is one thing companies like to do is get whatever info they can and keep it forever and do random things with it.

Identity theft itself is an example of regulatory failure. How is it my problem that you gave someone a loan based on practically public information?

They should have to prove, beyond simply an SSN, that an individual is responsible for the debt before being able to send it to collections or report it to credit agencies.

I thought you can at least derive location and date of birth with quite a bit of accuracy from them. Also if a data set containing the SSN is leaked anyone can cross reference it with any other leaked data set. Ideally you would need a unique and completely random SSN per service.

> I thought you can at least derive location and date of birth with quite a bit of accuracy from them.

You can for numbers issued before 2011, they're random now. The first three numbers are tied to the zip code of the application and the month/year of the application can be determined by the group numbers (the two in the middle).

https://www.ssa.gov/employer/stateweb.htm

Which is why it remains hilarious that when sites block/mask out the first five digits and show only the last four, the last four are the only real "secret" parts for most SSNs before 2011.

That's often the case with Bank Account and Credit Card numbers too that the parts commonly masked are the least significant from a security entropy standpoint (are often built algorithmicly and tend to cluster; CC numbers often encode processor and bank in the first bunch of numbers). The parts left unmasked to make them easy to recognize are easy to recognize precisely because they have the most security "entropy" and are the most sensitive parts.

SSNs adapted in 2011 and CC Numbers are in the process of adapting (and I suppose Bank Numbers are adapting at a per-Bank rate), but it's almost funny how universally this "best practice" of masking these security identifiers started from the "wrong end" and have forced their own generation algorithms to move a lot more entropy into their prefixes and middles.

Yes, this is true. I do not know about SSN but the two national identifiers I have (from two different countries) do have this problem (both leak birth date and one also place and gender).

But when an real random GUID is used then this is not a problem.

> With the same sort of issues that SSN has

Only if knowledge of one's "GUID" was regarded as sufficient to authenticate as them surely?

I mean it can also be used as a universal, semi-permenant activity tracking id with almost no work, which may not be desirable depending on your feelings wrt privacy.

Maybe an ability to generate virtual IDs based on a permanent id (like with virtual credit cards) might help though this is sometimes tricky to use correctly in a privacy-preserving way.

GUID following something like rfc4122 would be definitely better than current national id implementations that tend leak personal information.

I have two national ids (from two different countries).

Both of them leak my birth date and the second one also leaks my gender and even birth place.

The main question is - who should be such authority that would actually provide such identifiers that are guaranteed to be globally unique without collisions.

Build this: an identity link.

A secure place where you put information about yourself that you want to share.

Then, you won’t have to fill in any more forms, you just put an identity link pointer that fills in the rest.

Reply on news.ycombinator.com