Hacker News Reader

Comment by troyk | Hacker News Reader

And they can sell what they call the "header" of your credit report without regulation (such as the FCRA). This info includes your name, address, ssn and dob. Or at least it did when I bought it in the 90's to build a service to find dead-beat dads. I've heard they are more restrictive on the SSN, but I also would bet that's the #1 data element for the ID thefters.

View on HN

I don't understand why the U.S. is so opposed to a nationwide ID, and yet obviously need one, and end up treating other documents less suited to the task as one.

Here in Uruguay (and almost everywhere else) we have a national ID number (Cédula de Identidad). It's not supposed to be secret (although it's not a great idea to divulge it freely).

http://en.wikipedia.org/wiki/National_identification_number

An SSN is quite a good ID in that it should uniquely identify WHO is being discussed but it is a lousy authenticator to prove you ARE the person being discussed. Unfortunately in the US it seems to be regarded as a shared secret (between you, every credit reference agency, significant portions of the government, every bank you use, every employer you have and significant numbers of people working for all those groups) that they then use as authentication. What is needed is a separate authentication process.

I don't see how a new id number will solve anything. We already have a de-facto national id number, the SSN.

Because a new ID number can have security measures.

The ID number in my country has photograph, fingerprints, signature, several security measures (difficult to fake). Not so easy to steal (of course there are forgeries, but identity theft becomes much harder)

Hold on, do you mean an ID number or an ID card? As far as I can tell, the Cédula de Identidad you mention is a card, not just a number. Numbers are pretty much always trivial to duplicate. Checking a physical document kind of requires a face-to-face transaction.

Sorry, I meant ID card, you are correct. And I agree that numbers are easy to duplicate.

I'm not from the U.S., but I've read a lot of criticism about the SSN, for example:

http://www.theverge.com/2012/9/26/3384416/social-security-nu...

"In 2009, researchers developed an algorithm that could guess an individual’s SSN with up to ten percent accuracy"

"SSNs have become available through data resellers, security breaches at various companies and government agencies, unsuspecting customer service representatives, and even public records, if you know where to look. SSNs can be bought in bulk for $1 each on private online forums, and a specific person’s SSN can reportedly be had for as little as $3.80."

I've also read about duplicates ("More than 20 million Americans have more than one SSN associated with their name."), the numbers running out (in the 2050s apparently), etc.

http://www.witn.com/home/headlines/111371029.html

The REAL ID act sounds like something closer to what we have:

http://en.wikipedia.org/wiki/REAL_ID_Act

Some other advantages (from an IT point of view): you can validate an ID number against a central database, and get a person's given names in a unique format. Our ID numbers have a check digit, so you can validate if the ID number has been correctly entered :)

Certainly SSN could be improved by making them harder to guess and adding check digits. Other than that, I don't see how any other number scheme is any better. Ultimately there is some number that is associated with you, and is therefore useful for identity theft. Since it has to be used by people and not just computers it'll have to be relatively short and thus easy to steal.

Multiple identifiers per person is a feature, not a bug. People get new SSNs when they want to change their identity (eg, witness protection programs), or because someone stole their old one. That need doesn't go away just because you have a new numbering system.

Reply on news.ycombinator.com