Capital One’s breach was inevitable, because we did nothing after Equifax

Do you really want to mandate that?

Valuing someone's personal information at $100,000 per person and then fining the snot out of companies that lose it seems like a much more "market driven" solution.

It also means that companies will work really hard to minimize any personal information at all--which is really what you want in the first place.

> This will work for a time, but what happens when the next breach occurs? How do people renew their UUID's? Expire compromised ones?

The unique identifier would be an identifier only, not something for authentication. But before you can authenticate any identity, you need a way to identify that identity. Hence I consider that a base-requirement. Then we need to build a system of authentication points around this identifier. Heck, if SSNs were unique just re-purposing those for the ID would work just fine.

> Physical authentication probably means fingerprints, face data, correct? These are already compromised. Worse yet, they cannot be changed.

No, I mean going to a physical desk and authenticating however you already can do this. This would be something like a valid government-issued ID and a birth certificate. Essentially, whatever is needed to get a passport, have the same system here. Because that is essentially your weakest link already. I added this option to appease the American fear of government tracking.

As for a proposal to fixing it, I would point to two systems.

* The Estonian system, where every citizen is given an ID-card that is also a smart-card with a public key. * The Dutch system, which I am most familiar with.

Let me expand on how the dutch system (called DigID) works. Though I should note the system has flaws, and there are valid criticisms. However, it hasn't had any big failures. The system works as follows:

Anyone can apply for an account, at which point the government will mail you instructions for setting up a simple username-password based authentication. Key behind this system is the 'Basis register of persons'. It is a national database (maintained by the municipalities) of all legal inhabitants and some info about them. Most importantly for this system, an address. This is what makes it possible for the government to send mail to a citizen.

To my mind, the above system of mail could/should be replaced by a visit to the municipal administration, where your ID-card is verified. (Notably, everyone over the age of 14 needs a valid government-issued ID)

Obviously, implementing something like this in the US would be hard. Mostly because mandated ID-cards and a government database of addresses would not be politically acceptable. I don't know the details of the Estonian system, maybe that would require less invasive tracking of citizens

I'm guessing most European countries have similar systems of government-based authentication.

Really though, these systems start with knowing who your citizens are and being able to identify them. And should this not be a basic requirement of a government?

Equifax seems to be the exception to the rule that most of the data lost in most of the breaches we hear about was given voluntarily; the customers are the ones getting screwed and they still willingly hand over their data to anyone who offers a small discount or even just a newsletter sign-up.

It seems like most people don't care about privacy, at least not enough to pay more for it.