Hacker News Reader

Comment by yassa9 | Hacker News Reader

in Egypt, every person is born with a universal national ID number , which is standardized everywhere here, but it created some problems, it became extremely valuable to attackers. If leaked, it can be reused across completely different services ( and you can never change it under anycase )

Having the full name + national ID was enough to bypass verification and activate various services, and many people weren't tech savvy enough to realize how dangerous it was to share or leak that info

View on HN

Clearly it was the services that weren't tech-savvy using a non-changeable non-secret ID as some kind of authentication. Can't blame the users here.

This is the SSN in the US too though.

One good reason to introduce a national ID system in the US would be in order to replace and deprecate the Social Security Number, which is a terrible system that never should have been used as a de-facto national ID system.

Something tells me the people misusing the SSN would just misuse this new national ID number too. Wasn't the issue that people were treating knowledge of the (de facto public) ID number as proof of identity? Nothing is stopping them from doing the same with any future ID number.

Ironically, a certain level of secrecy is worse than having them fully public, because it leads people to (wrongly) design systems and processes that trust it or assume something from it.

All else being equal, I'd rather see national ID numbers which are so incredibly obviously un-secret that, at least on their own, they're nothing except a tool for avoiding overlaps and collisions.

Yes, a number of countries with national ID systems have (wisely) designed the system such that there is no secrecy associated with the number, and people can and do give it out freely without worrying that someone will use it to compromise their identity. Sweden's system works this way for instance, as does Estonia's. The United States can and should create a system similar to this, which would entirely end the problem of stolen Social Security Numbers once old-style SSNs were phased out in favor of the newer, better system.

So, instead of SSN dumps on the darknet, we'd have national ID dumps, which will be stolen within months (either from the government itself, or from credit bureaus or data brokers). How did that improve anything exactly?

Right, people and organizations failing to (care to) distinguish between "highly distinctive" versus "true" is not a data design problem, it's a social/political one.

Reply on news.ycombinator.com