Here's yet another instance where a blockchain could possibly solve the identity crisis of Americans.
The problem is not that your SSN can be leaked, the problem is that it shouldn't be trusted in the first place.
How is it a thing that a bank can give a loan to anyone claiming to have my name and SSN, without verifying that, and then hold me legally responsible for their lack of judgment? And the court protects the bank?
The problem here is the banks are being dumb, and rather than letting them suffer the consequences of that stupidity - the court makes it my problem. The legal system has seriously failed Americans here.
The choice of db does nothing to address the underlying problems. Which was my point.
The only difference in the schemes is whether you need to trust the centralized database or not. Most people would much rather trust a large institution than have responsibility for managing their key.
They can't. That's not to say that it doesn't happen, or that it might not be a PITA to sort it out. But in court they would need to have more than a name and SSN to prove that you took out the loan.
The courts and regulators have completely failed the people here. Why do they not slap the banks and credit rating agencies down for this behavior? They are failing egregiously to protect the little guy here.
Companies who are tricked into doing things with stolen credentials should be held accountable.
Misc central authorities issue you secure enclaves. Dept of licensing, health care system, banks, github, employer, etc.
You then create key pairs as needed.
Publish those public keys to misc web's of trust, as needed.
Then use private digitally sign anything you think worth signing.
Log those transactions to the misc blockchains, as needed.
--
The alternative to authenticity is our current Freedom Speeches™ dystopia. Bots, sock puppets, identity theft industry, fraud, etc.
For all the naysayers: Would you install unsigned, untrusted code? If you answer yes, then stuff like privacy and authenticity isn't really your priority.
Choose wisely.
> Would you install unsigned, untrusted code?
Yes. I trust javascript from https://google.com the same as javascript from http://dodgywarez.example.com. Both get executed in a javascript VM, nested in a KVM VM, off of my main desktop machine. Security based on making sure that there is someone to sue just doesn't scale.
Would you bank online via HTTP (vs HTTPS)?
When I was doing nodejs work, npm artifacts still weren't being signed. Sure, some people play in traffic. Doesn't mean we all should.
People arguing against privacy & authenicity always remind me of a coworker who emphatically opposed password managers or any system whatsoever for managing secrets. Something something "single point of failure".
The thing about security is that it's inherently a multi party problem. Some party that is able to identify me is increasing their own security, but likely at the expense of decreasing my own security. You speak of authenticity, yet there is a good reason chat protocols don't stop at naive signatures, and actually increase their complexity for additional properties like repudiation.
Sure, many activities prudently require a way to reasonably identify people and have an acceptable downside. And sometimes when individuals' security is broken, society benefits (eg DKIM being used to verify leaked email authenticity). But there are many more that do not need such things, and in fact doing so would harm our freedom (the examples I gave).
You seem to be staking out the position that some sort of universal identity would be a good thing, including for casual Internet communication ("Bots, sock puppets"). I wholeheartedly disagree with this.
Nihilism. For future, maybe lead with that. Save everyone a bit of angst.