Here’s my dream plan, which would take 5 years and probably less than $5B: * We replace Social Secutity Numbers (which are like having a username with no password!) with disposable, single-use IDs of similar format, perhaps by adding letters so we have enough identifiers * People could get a new number anytime from the Social Security Admin website or app, by calling a number, or by going to a post office * Credit scores and credit info brokers are required to only have info you choose to share
The key thing here: if you are in charge of your new-style SSNs, you know which companies have which ones, and you could just give a freshly-generated SSN to (e.g.) a landlord. No history on that number? Not your problem. Experian/Equifax/TransUnion doesn’t have any data on that new SSN? Not your problem. Privacy is a human right!
@anildash Something to consider here: if creditors were no longer able to get a (mostly) complete, accurate and unbiased view of a potential borrower’s creditworthiness, they will revert to old-fashioned “manual” underwriting, where a person will make a judgement call on how they “feel” about a borrower. We know from history which communities get outsized benefits and which suffer under that regime. Current system is far from perfect, but there have been real benefits too.
@anildash it seems like there’s some sort of government OpenID-esque solution here. Unique IDs per-company, people are in control of how much info is shared, from unique ID but no actual personal info to full financial info suitable for banking etc. Gov could invalid access per-company if there’s a breach, plus the usual revolving token protections to limit damage. Requires a lot of trust the government implements it well, but at a naive first glance it seems like it could solve some problems.
@courtney that’s obviously the goal. But the transition is the tricky thing, because credit scores were an attempt as a *more* fair system than just plain “we don’t rent to your kind”. So you have to have clarity on what you’re moving towards, not just what you’re moving away from.
@anildash there is a LOT of work going on on this space, some of it based upon zero knowledge proofs, some of it snake oil. See eg iso mdocs, verifiable credentials (now happening at both W3C and ietf in different flavors), “trust exchanges” etc.
My state’s drivers license allows you to do roughly what you want; phone app shows a QR code that’s only good for two minutes, with selective disclosure of identity or age. I did a FOI for their privacy impact statement; frustratingly redacted.
@jalcine@mnot yeah the biggest challenge is not requiring everyone to have a costly device, but there are ways this has been solved for some programs like amnesty programs for migrant workers
@mnot Is there no solution that doesn't require a phone yet? Or has this yet to be done in a space where one could do it on some sort of dedicated hardware that the state can encourage adoption of?