71–80 of 132 posts
Earlier quoted context omitted.
or a digital signature, or a MAC. Something where we could verify against a publicly-known value safely, and without giving that secret part away to anyone else. The secret would be between the Federal Government and the citizen.
Why should the government have it at all? Just let private citizens manage their own private key.
I never realised till now that American's SSNs were supposed to be kept secret. That's absolutely ridiculous. The idea of trying to keep the UK equivalent (National Insurance Number) secret is laughable. How can anything function when an important id number is also supposed to be known by very few people?
The scheme was designed in 1935 as a way of identifying people enrolled in the then-new Social Security program (hence the name), and was gradually made a de facto national ID number over the intervening decades as the increasing scale of national population and economic activity prompted a desire for greater legibility to facilitate management and taxation. Greater legibility, management, and taxation are values not…
Earlier quoted context omitted.
I moved from the US to the UK last year. I have seen two paper cheques in that time. It is much more common over here to pay electronically, though both Direct Debit (receiver pull) and Standing Orders (payer push) require one person giving their bank details to someone.
FWIW paper checks are not nearly as popular in the US as they once were. Especially hand written. They are ironically useful as a "secure" form of receiving payment because ACH is such a big gaping security hole. Receiving paper isolates you from handing out an account number.
Earlier quoted context omitted.
I believe that all EU has a similar approach, it is just the US that misuse the SSN. The way it is done in Italy (it is called "Codice Fiscale") it is composed through a public algorithm from name, surname, place and date of birth with a final "control" character (derived by the preceding characters) so - with the exception of the very few cases of total homonimy - it can be recreated "on the spot". Nowadays it is ho…
> I believe that all EU has a similar approach Not at all. At least Finland and Sweden do have a social security number assigned at birth (or immigration). They can be seen as a primary key in many contexts, not only when dealing with social security or the public sector. I guess there could be more such countries. In Finland the official recommendation these days is that you should be very cautious with your social…
Maybe we are misunderstanding each other, the Codice Fiscale in Italy is the same, assigned at birth (or immigration). The difference is that it is not on the ID card (as it is - say - in Finland or Sweden or Denmark or Spain), but on a separate card.
It is a "generic" identifying number with all public administration offices besides tax use, but of course it is always directly or indirectly connected with taxes.
As an example if you sign a rent contract for a house (between privates), or if you sign a contract for utilities, or you buy a SIM card you need that number, if you ask for some specific kind of receipt (fattura) you need it, when you buy medicines (that may be partially deducted from taxes) you need it at the chemist/pharmacy.
Fun fact: if you want to buy some cigarettes at a vending machine, you need the card to prove that you are 16 or older. .
Of course each country will have its own uses (or non uses) for the thing, that is generically (EU) called TIN:
https://ec.europa.eu/taxation_customs/business/tax-cooperati...
Here is the list with documentation about each country: https://ec.europa.eu/taxation_customs/tin/tinByCountry.html?...
Germany has it alright (and it is assigned at birth) though it is not on a card (ID card or otherwise) and is used only for Tax purposes:
http://www.bzst.de/DE/Steuern_National/Steuerliche_Identifik...
It has been introduced only relatively recently, 2011 I believe, to give you a reference in Italy it was introduced in 1976.
Any rational system needs to be able to: 1) Identify someone and 2) Authenticate someone. A moment's thought will suggest that the mechanism used to identify someone has different and at least somewhat conflicting goals to what the mechanism used to authenticate someone has, and these must be different systems. For example: The identification token should be shareable, globally unique, and probably mostly immutable.…
The only option is the second because SSNs are already widely distributed so have lost their use for authentication.
I never realised till now that American's SSNs were supposed to be kept secret. That's absolutely ridiculous. The idea of trying to keep the UK equivalent (National Insurance Number) secret is laughable. How can anything function when an important id number is also supposed to be known by very few people?
> were supposed to be kept secret It's especially laughable because you have to give it to -everybody-. Phone service, cable service, schools, employers, etc etc etc.
I was astonished, to put it mildly, both at the professor's cluelessness and the willingness of my fellow students to do it.
Earlier quoted context omitted.
Ability to execute data as code is present in many languages. Almost all of them these days. I think you are saying that banks should only use C or C++ ??
I don't know Java well, but at least in .NET it's possible to set a flag that disable execution of dynamically emitted code. Obvs, you should do this on every box that accepts connections from the outside world. Obvs, it's no easier to get people to do this in practice than it is to get people to quit using string formatting to get parameters into their SQL queries.
Coming from another country I really have difficulties understanding why e.g., utilities would want to have your SSN. What do they get that they otherwise won’t get? Isn’t a validated address and a credit card number enough for them? What is the scenario that they try to protect against? That someone misses his 30 USD utility payment and has a CC that is not covered? That seems like a rather weak argument
These databases are there essentially to punish you. If you don't pay your utility bill, they report that to the credit agency, and reduces your chances of getting credit elsewhere. These credit information don't give much benefit to Americans, it gives benefits to businesses[1]. It's essentially just a global black list where business can communicate who not to do business with. This business is there for other busi…
Americans own, work at and consume the products of businesses. If there is a class American law generally holds above investors, in terms of protection, it's consumers.
I would also argue consumers benefit from our credit rating agency system, shitty as it is--it allows more people to get cheaper credit faster and more easily than if we had to establish trust at every commercial interaction.
Earlier quoted context omitted.
> were supposed to be kept secret It's especially laughable because you have to give it to -everybody-. Phone service, cable service, schools, employers, etc etc etc.
In a college class ~20 years ago the professor passed around a sign-in sheet expecting everyone to fill in their names and SSNs. I was astonished, to put it mildly, both at the professor's cluelessness and the willingness of my fellow students to do it.
Many education institutions 20 years ago used SSNs as a unique identifier for students. On the first day of class, the only way to determine if a body present in a class was actually enrolled was to confirm SSN.
Confirming identity in an education context is crucial in the first few weeks of class because being officially enrolled in a course affects student loans, work study, graduation paperwork, health insurance, etc. Additionally, many educational institutions have a policy that students not present for a class's first X meetings will be dropped from the course, a mechanism which allows students physically present to enroll in enrollment-capped courses (especially important for required courses).
One of the most straightforward ways educators had of verifying that a body was in fact who that body said he or she was--was to ask for SSN because many educational institutions used SSNs as unique identifiers (but not necessarily verifiers).
In other words, asking for verifying information enabled the educator to complete the institution's academic mission and to facilitate the educational needs of students.
It is not the fault of educators that financial institutions also use SSNs as both means of identification and verification.
As "clueless" as an educator might have been, he or she might be partially absolved for requesting PII in the context of educational bureaucracy. Granted, it would be better if each information context had unique identifiers that are not SSNs since SSNs are used by financial institutions.
EDIT: readability, grammar, clarity.
I never realised till now that American's SSNs were supposed to be kept secret. That's absolutely ridiculous. The idea of trying to keep the UK equivalent (National Insurance Number) secret is laughable. How can anything function when an important id number is also supposed to be known by very few people?
The scheme was designed in 1935 as a way of identifying people enrolled in the then-new Social Security program (hence the name), and was gradually made a de facto national ID number over the intervening decades as the increasing scale of national population and economic activity prompted a desire for greater legibility to facilitate management and taxation. Greater legibility, management, and taxation are values not…
Get SSN, name, place and time of birth, and birth name of mother. In theory 1 SSN maps to 1 (name, place and time of birth + mother's name) tuple, unless you have a twin and you are both called John. (Also, identity verification should could also use biometric data.)
Banks already issue PINs to users, they should issue one for regular non-ATM interaction too.