6 ms·
> Emails will not come from the domain of the company that sent them and companies will call you and ask for your SSN, and often you have no choice but to compl
by giomasce 4y ago
> Emails will not come from the domain of the company that sent them and companies will call you and ask for your SSN, and often you have no choice but to comply with these or not use those services, because they simply offer no other options.
I still can't understand how it's possible that a SSN is used as a sort of password. In Italy and Belgium (the two places where I lived) there is an equivalent thing, of course, but it's not meant to be a password at all. If anything, it's akin to a username. If you want to authenticate against it you need something else (an actual password, a smart card, a 2FA app, it depends). In Italy, specifically, the so called "fiscal code" is essentially a function of you name, surname and place and date of birth.
- armchairhacker 4y agoIt would be cool if governments issued each person a “real” SSN only available to that person and the government, and an encryption tool/function. When a company asks to verify your ID they provide a “request” with the company ID with a timestamp, you encrypt it and sent it back to them, and the company can send the encrypted request to the government who decrypts it and verifies that you authorized it.
- lupire 4y agoThat's overcomplicated and unreliable. Just use an Authenticator app. But that doesn't solve the problem of needing an ID ther they can tie to everything else.
- giomasce 4y agoMy government does that: I can have a smart card that, with the appropriate protocols, can issue a cryptographic legally recognized proof that I am who I am.