Hacker News Reader

Comment by AnthonyMouse | Hacker News Reader

The problem is completely the opposite. The flaw is the existence of social security numbers. Prohibit them from being used for anything but social security.

Then there is no "your social security number" or "your identity" for someone to open a bank account against. You open a bank account and they give you a bank card and you set an address and phone number. The day you open it, they shouldn't need to know who you are, because it's a new account with $0 in it. After that, the owner of the account is the person with that bank card who can be reached at the address and phone number given when the account was created.

Get rid of centralized identity and there is no centralized identity to steal.

View on HN

Money-laundering rules make it illegal for banks not to know who the customer is. Also various anti-bribery and sanctions rules.

None of those rules are worth the cost. Identity theft, created by the concept of centralized identity, costs billions of dollars. Investigations of those other crimes are still possible without government-mandated privacy invasions by banks, and the privacy invasions are a huge cost in themselves.

Maybe.

How would you feel if an investigation stalled when a bank said “we have no idea who these people are, or where the money went”?

KYC laws and governments desire to have silent complete financial surveillance stops banks from acting that way too.

Why not FIX how an SSN can be used? It was not created for this purpose but that doesn't mean how we use it can't be fixed.

Any time someone attempts to use your SSN to identify themselves as you, you should be notified and your authorization should be required for that use to be allowed.

And the higher the value of the authorization, the more care should be required.

Companies are able to do this already with 2 factor authentication. And I think we SORT of have that for change of address, as the Post Office both requires ID and notifies you by mail. Maybe that's really just one factor.

Allow people to require as many additional factors as they want. Confirming my identity in 6 ways when I decide to sell my house sounds good. 4 ways when I buy a car. One or none is fine when I make a $10 purchase. Let me decide.

And let them CHOOSE what organization manages authentication. A private company might do the job a lot more effectively than the Post Office.

Add human methods too. A call from a sibling or child might be one people could set up. Require validation by a notary public.

> Any time someone attempts to use your SSN to identify themselves as you, you should be notified and your authorization should be required for that use to be allowed.

So now the government needs a way of contacting you. Suppose they have your address and phone number on file.

Then you lose your way a while and become homeless for two years. You can't afford a phone and no longer have the same address, and have lost your ID or it expired. You finally start to turn it around and go to open a bank account. The government contacts you how? How do they know it's you?

The answer is that it's a new account and you're not trying to prove anything about whether you're the same person who lived at the old address, so you shouldn't have to.

And once you have a bank account or a mortgage or such, you and the bank can arrange for any form(s) of authentication you like. It shouldn't have anything to do with the government, and it definitely shouldn't have anything to do with how you authenticate yourself to your job or your wireless carrier.

If a new account can never used to establish your identity for other purposes, there's no problem opening such an account without government identifying you.

I stand by your SSN only for social security point.

But the rest sounds plain wrong to me.

Your phone might get stolen, your name might change due to marriage, your address might change because you moved/got evicted. What now?

Your phone gets stolen so you use your bank card and password to set a new phone number on your account. Your bank card gets stolen so you use your phone and password to get a new bank card.

If someone steals your phone and password and bank card and ability to receive mail at your home address all at once then you're pretty screwed, but you're pretty screwed then regardless, right? That's the level of screwed where somebody else can also get a government ID in your name.

For sufficient amounts or suspicious operations, banks should be in charge of authentification, ie showing up in-person for bank transfers such as a car, showing up and supplying fingerprints if the bank transfer buys a house...

And in fact, for poor people, anything that might engage their entire savings might also benefit from a more advanced identity verification.

For example my stock exchange account just takes a password. It’s a scandal.

Well, you did not mention a password before. With a password, you introduce a new 'security feature' which changes your argument in a non-trivial way.

This might work better than your proposal before.

I use a slightly different address with every business I give my address to.

For example

123 Main St. Apt 45-WXYZ

Where "WXYZ" is different for each business, to pollute any data mining algorithms trying to collate my address across sites. In some cases when they use address resolving functions, it also helps to spell out your address e.g.

123 Main St. Apt FOURTY_FIVE WXYZ

SSN is used as taxpayer ID, that is why it is needed.

Now, there is absolutely no reason it could not be OTP'd (or uniquely derived for each account).

Reply on news.ycombinator.com