Comment by mbStavola
9 months ago
It's amazing to me how just getting your name and SSN leaked opens you up to much risk. It's equally amazing how this is a decades-long problem that hasn't been addressed.
I have to wonder what systems other countries use for identifying citizens and how secure they are compared to SSNs.
In Poland you have a national ID card you carry with you if you don't have it with you won't get anything done anywhere. If you lose it/it gets stolen you have an obligation to report it. We have something like SSN number (personal id number) assigned at birth but it's not enough to get a loan or anything.
In Finland banks are the ones who usually handle the strong authentication (not necessarily just the initial one). They are required by law to know the customer. In-person authentication in the branch is required to be done via either ID card or passport, those can be requested from police and expire after 5 years. Driver's license is not official ID card. Logging into you bank account requires 2FA (I'm not sure if any bank sends codes via text messages, at least it's not very common).
It can also be done with ID card (which is a smartcard) or mobile certificate (https://mobiilivarmenne.fi/en/) if the service supports it.
Usually an identity card. In the EU this is an authentication mean but in order to be liable you must be present with the card at transaction time (i.e. a scan is not enough).
Then you have solutions of increasing robustness such as certificates for e-signature.
The national "id" (of there is one) is just to make it easier to find you. Poland has one, France does not have any for instance.
The problem isn’t the SSN but corporate responsibility shirking: they don’t want to check ID because that costs more, they want things like instant credit applications to allow impulse purchases, etc.
This seems to slowly be improving because so many people have been breached by now that they don’t enjoy the assumption of security. In the 90s, if they took you to court saying you weren’t paying a loan it’d be assumed that a crook wouldn’t have known your SSN but now it’s at least a lot more likely that nobody will believe that without additional proof.