Hacker News Reader

Comment by Terr_ | Hacker News Reader

> IDscan was never cryptographic proof you were who you said you were. Maybe better than “enter your name and SSN”

With the benefit of hindsight, we'd have all been better off if SSNs had been so obviously flagrantly public that nobody would ever consider them a trust-factor.

View on HN

To be fair many SS cards were printed stating right on them they aren't for ID usage.

Yep. Social Security numbers are not guaranteed to be unique, and for a very long time, were pretty easy to figure out if you knew roughly when a person was born and where.

"I know! We'll use this number that its issuing agency says is most definitely not to be used for identification purposes for identification purposes!" is real PHB thinking.

Right, I don't blame the SS administration, they knew what people shouldn't do and warned everyone about it... the problem was private companies were desperate for security-theater and were never punished as they built an entire grand opera-house of insecurity.

What should the companies have used instead? Even the government identifies you by SSN, eg taxes or voter registration. They combine that with state ID often, but the only national ID is passport which not everyone has.

But they were! My college student ID from 1980 has my SS number right on it. I have here an employee badge from the Walt Disney Company from 2000 and my SS number is in a bar code right on the bottom. Even in 2000, it would be trivial to take a photo of someone wearing the ID badge and decode the 1D bar code on it.

In some states, until the early 1990s, SSNs were also used as drivers license numbers.

Right, but somehow a bunch of companies still made them into a "prove who you are" factor, and (if we assume incompetence instead of malice) that means a bunch of decision makers still considered the a trust factor.

Reply on news.ycombinator.com