Hacker News Reader

Comment by basch | Hacker News Reader

It’s time for attorney generals to hold permanent identity monitoring pots and funds.

The idea that someone can lose all your data and then pay for two years of identity monitoring is absurd. The people with the data can see that and can just wait two years to sell it. Social security numbers don’t reset after two years.

If you lose data, you pay a data breach tax forever. Over time, your competitors will be able to run with lower margins if they stay secure. As companies die out, the remaining breaches ones are responsible to keep footing the bill.

View on HN

It also incentivizes holding as little personal data as possible and increases the probability of coordinated adoption of systems[1][2][3][4][5] of identification/verification that minimize collateral damage.

1. https://sovrin.org/

2. https://github.com/sertoID/

3. https://www.hyperledger.org/projects/hyperledger-indy

4. https://identity.foundation/ion/

5. https://www.civic.com/

> incentivizes holding as little personal data as possible

The government does not want to incentivize that.

https://en.wikipedia.org/wiki/Third-party_doctrine

I get the impression incentivizing holding little personal data is one of the goals of GDPR

Fair enough, I should have said "The US government does not want..."

Mention of attorneys general and social security numbers in OP's posting put me in a US mindset.

Further cementing this broken idea of "identity" as something that can be stolen is most certainly not what we need! Rather we need AG's to start going after companies that attempt to collect negligently verified and other fake debts for the outright brazen fraud that it is, and a law that allow victims to procedurally recover triple damages for time/money spent defending against these companies and helping the companies clean up their own messes. Separately, we need a law like the GDPR that lets individuals audit, control, and opt out of the surveillance records being kept on us.

Exactly. The whole idea that end users are responsible for their stolen "identity" is absurd.

It was a successful tactic used by banks and credit bureaus to shed their responsibility of proper verification when opening lines of credit or other accounts.

I would go one step further, saying that proper verification is prone to fraud because of failure in government (in the US; not sure about other countries). It still baffles me that identification typically comes down to two things: social security card and driver's license, and both are managed by agencies whose primary objective is not identification. IMHO, it's time for a single agency at either the fed or state level that's in charge of just identification. That's it. Fund that agency and let them do it properly. However, inevitably someone will scream "Big Brother!", and we'll end up back where we started, with this Rube Goldberg system that basically leaves individuals to fend for themselves.

I'll go yet another step further, and say that the main opposition to having a better technical system of government identification is because we're lacking a comprehensive privacy law akin to the GDPR. As it stands if the government started say issuing smart cards for identify verification, then every business would gradually force their customers to identify themselves, for helping the commercial surveillance industry track everything they do. This is the current dynamic with mobile apps, phone numbers, and existing static identifiers, and it's only held back because one can feign not having them and/or being worried about giving out that info. Whereas with actually secure technicals, that friction basically disappears. And so the only way to prevent this dynamic (and make it so better identification isn't itself a security vulnerability) is by gaining the legal right to inspect/audit/reject the collection, use, and storage of such information in the first place.

There's also a significant constituency that believes any nationwide system of identity is the "mark of the beast" as spoken of in the Bible.

It feels like the people who literally believe this as an actual political concern is a vanishingly small contingent, especially given that the ship has already sailed with SSNs and the like, making this more of a partisan talking point strawman. Of course I do respect that the relevant political party has made their whole platform one of stirring up such tempests in teapots instead of focusing on substantive policy. But still regardless of the possible superstitious narratives that objections may end up taking, the best way to eliminate objections is to address the actual practical concerns. And that is chiefly the myriad of ways in which existing identifiers are being abused.

Phone numbers already do that.

Digital identification can be done correctly, i.e. give business one time pseudonym maybe with one time email pseudonym. Then businesses won't ask for such identification :)

Or it can require ATM, which is not frictionless.

Businesses already ask for phone numbers anyway. Can it become worse?

Phone numbers are bad, but of course it could be worse. Phone numbers have both escape hatches (VOIP, shared number burner services, or your own psuedonymous SIM + device ID), and friction (people are wary of businesses spamming them).

Pseudonyms don't work for the topic under discussion, issuing credit. And for the general case, since credit issuers would be able to require you to do a non-psuedonym identification, then any other entity can require this as well, unless there were a privacy law.

(no idea what you mean by "ATM")

>Pseudonyms don't work for the topic under discussion, issuing credit.

Because businesses want spammable addresses. That's why they won't ask for properly designed digital identification.

By ATM I mean you use ATM with your card to authenticate yourself. You can't use a smart card with thin air, can you?

Strong disagree that such a responsibility exists. I should be able to open a bank account with _nothing_, save perhaps a _de minimis_ initial deposit (one penny, or similar).

I can walk into a shop with a handful of cash, buy an item, and leave without anyone knowing who I was. That should be true of any good or service, including banking, that does not require additional data for direct practical reasons related to the provision of the service, e.g. cleaners need to know where you live. "Prevention of fraud/laundering/terrorism/whatever" is not such a reason.

That is fine for opening a deposit account. The fraud we're talking about is for obtaining credit or future financial obligations. It is wrong to let this be done with so little proof of identity and enforce the obligation in courts.

Banks have notaries of the public. After you have established a relationship with a bank, the notary may have enough evidence to authenticate you for others. If you have continued to use the bank in an anonymous manner, then you should not be authenticated to others.

I'm sympathetic to your comment, but we are talking about the issuing of credit. Surely you see that this idea is a non-starter for a bank issuing credit?

This is further complicated by US bank accounts including an intrinsic bit of credit from writing checks and other ACH debits.

This is the best comment ever. Thank you! ... The narrative around "identity theft" and "personal data" needs to change.

> two years

TWO years?

I have had my data pwn3d a couple of times. One was six months', the other was one year, and Experian used that as leverage to unendingly nag me to buy into them.

It should all be free, like getting credit reports is now. We need a robust and accessible way to manage our data personas, assuming that all of the supposed secrets are in fact public data.

As a reminder for any US Citizens, there is an official path to getting this from each of the main three for free[1] is the approved method verified by FTC [2].

1. https://annualcreditreport.com

2. https://consumer.ftc.gov/articles/free-credit-reports

This still puts the burden on the consumer of having to verify that their credit file is accurate, not to mention the even bigger burden of trying to correct it.

Furthermore it's a reactive measure. Locking credit reports and unlocking as needed can help mitigate some risks.

  > It’s time for attorney generals

Attorneys general

They are attorneys, so that is the word to pluralize. What type of attorney are they? General

This is an explanation poor of why that's the plural correct. You make it sound like that's grammar normal English.

Him forgive, programmer he Forth a is.

You thank.

Nah, it's just a convention adopted from French after the Norman Conquest.

I think its monomorphization: Attorneys::<General>().

Wouldn't that be Vector::<Attorney::<General>>() ?

SMASH EVERYTHING INTO FLAT ENGLISH, GIVING COBOL!

LIST OF GENERAL ATTORNEYS FTW!

(SEE HOW EVEN THE ACRONYM AT THE END OF THE SENTENCE FITS INTO COBOL SYNTAX, BEING IN UPPERCASE?)

COMPILE IN A FLASH, DEBUG AT LEISURE.

AND DON'T FORGET YOUR COBOL PERIODS.

I think an easier approach would be some sort of mandatory indemnity. Rather than trying to impose specific practices which very well may vary greatly depending on the domain, just levy automatic penalties for breaches and set them high enough to encourage action.

This will just make companies more litigious. They'll sue to silence leakers and deny wrongdoing. The leaking will still happen.

Or rather we should double down on aliases: everything must store aliases instead of real data.

I'm very open to government solutions, but at the same time I'm not sure they have a good track record. Despite that, this service should come from the government because anyone else has misaligned incentives. I specifically would want a privacy and security maximalist approach. What we have right now is completely unacceptable, especially given our current technology level. Though of course, the downside is also that this database becomes a big target (and that's why I want a maximalist approach). I don't know what the solution is, but I'm sure there are security experts here on HN that can lay out better paths and I'm interested in actually hearing what systems I should be advocating for (with more specificity than the generic thing I said).

I do think we should also push back against surveillance capitalism. This has been a disaster. Such data breaches are a result of this system (and clearly it isn't even unique to the western world). I think any government has the power to hold these companies accountable in at least some form or another. Big dogs like US, China, and Germany should be leaders, but clearly they aren't as this stuff keeps happening.

The government is the problem.

They issue me a single identification number that can be used anywhere at anytime without any verification or notification that it has been used, and it's next to impossible to get a new one issued.

This is madness. A state funded "insurance" system to backstop this mistake is an unworkable hack that seeks to ignore the fundamental problem.

The government only claimed to identify you with that number for one purpose. The motivation for fraud would be a lot lower if that was the way it was still.

The problem is third parties abused that number for their own purposes.

Imagine if some company somewhere started using phone numbers as identifiers, and criminals started defrauding that company by "stealing" other people's phone numbers. Would you blame the phone company for that? Of course not.

The problem is that banks and anyone else using SSNs need to do more due diligence than checking SSNs, but they don't want to because it would be expensive and add friction to signing up for their "products".

They themselves abused it as anyone in military service is well aware. Then they required you to put it on your IRS forms, even though the Social Security Administration is a wholly independent agency. Then they required banks to capture it for any customer.

It goes on.. third parties weren't the worst and they didn't start it and some are required by law.

Imagine if Credit Card companies were as blatantly incompetent and as reckless as the government? The reason they aren't is because they hold most of the liability at all times, and there's a lot of good laws that set them up for huge damages if the make a mistake. The reason the government doesn't care is because no one holds them accountable.

If you have an interest bearing account, you need to provide an SSN, and even though the regulation has since been changed, you needed it for any account for 30 years or so. Anyways, if my SSN suddenly starts being used 12 states away from where it has been the last few decades, _nobody_ notices. The government is the only agency that could and they just don't.

It seldom creates significant inconvenience or financial obligations when someone pays additional taxes in your name. It only becomes a significant problem when the fraudster is obtaining money or services in your name.

The burden of authentication is not on the entity who issued a simple ID number, it is on those who go on to use it as if it is a secret.

I think your trust in credit card companies is misplaced. The only thing that holds them back is consumer protection laws, and they fight those however they can. Jack up rates, check. Grant credit at a sales point of presence with a minimum wage sales clerk doing identification, check. Sell or trade your payment history, check.

In some moral systems, lending money to make money itself is outright wrong. If you maintain a balance on your credit card for day to day expenses, any financial advisor will tell you to stop that.

Don't we blame phone companies for being vulnerable to SIM card swapping?

The service doesn’t need to come from the government. A marketplace of services of which I can choose my own provider would work.

Until your average American suffers in some clearly identifiable way - which they currently don’t really - ain’t nothing going to change. And probably not even then.

Reply on news.ycombinator.com