Monday, October 16, 2017

Rate My Credit

The Equifax hack(s?) are highlighting more than the security of the institutions that are asking us to trust them with our personal information.  It is bringing into question the entirety of how these institutions identify us and thereby assign us credit.

Even the cursory, headline-scanning research that most of us do will show that the requirements for obtaining a new line of credit are ludicrous.  All you need is a Photo ID, Social Security Number (doesn't need to be yours), a matching birth date and address.  That's it.  And with the SSN and a little work, you can get the Photo ID.

Walk into most retailers (car dealerships, furniture stores, WalMart, Target, etc.), spend fifteen minutes filling out an application and then go to town.

This needs to change.  Even the White House agrees.  For what that's worth.



How We Know Who We Are



The real mess here is that the things we use for identification are either outdated or never intended to be identification or both.  Usually both.  Think about it for a second:

  • Birth Date - There have already been over 110,000,000 births in 2017 as of the 287th day of the year.  That works out to just over 380,000 people who are born on any one day, world wide.  That is not a unique identifier.  Even used as a basic security hash to double check another number (does the birth date match that on file with the SSN?), it is not very good.
  • Social Security Number (SSN) - this was never intended as a national ID (see question 21 on their FAQ).  And, just because they removed the label that says it is not an ID does not make it one.  It is even possible to guess someone's social security number based on their birth date, birth location and some public records.  Not secure.
  • State Issued Photo IDs (Driver's Licences and such) - These are a little better.  They have a picture.  Most have magnetic strips and fancy holograms embedded in the printing.  People can see if you are the person on the ID.  Unfortunately, getting one is not that hard.  Even if you are not tied into the underworld and forged IDs, using a Birth Certificate (public record) and a social security card, you can get one through the normal channels (though still fraud and illegal and all that).
  • Passports - More secure than State IDs, but only just.  Many of the same forms of ID that are used for State IDs are also used to get Passports.  Plus you need to show a State ID.  Which you got with those same other IDs.
None of these are secure.  And certainly not in the Information Age.


Body Parts


Another way to go about this is to use something that is physically a part of the individual.  Like a fingerprint or an eyeball.  Very difficult to forge or steal.  Also hard to use remotely like you do with those other forms of ID (think typing your Credit Card number into Amazon).

Of course, using these requires that they be read.  And by reading them, turn them into digital codes and then into a database that has them all recorded and can then match your body part against the one on file.  A database that can be hacked, then be duplicated.  And we're right back where we started.  A little two-step verification might help this, but still not great.

Embedding


Probably the best current tech solution is something similar to the chips on credit cards.  These communicate with the system requesting identification to set up a one-time use set of codes for just that transaction.  This solves most of the database, number stealing issues.  Add a little of the BlockChain (or other Smart Contract magic) and most of the trust issues are done.

But it raises others.  Where do we put it?  It can't go on a card as cards are easily lost or stolen.  It needs to go someplace where we won't leave it lying around or where it can be removed from us.  That most likely means imprinting it into our bodies.  I would recommend against fingers or hands or other places that are easy to use, because those are also places where those chips might be easily removed.  Unfortunately, all of the other parts of our bodies are less convenient for presenting for ID.  ("Sir, I'm going to need you to remove your pants and sit on the butt plate, please.")

Not Mandatory


My last thought on all of this is that it should not be mandatory.  There needs to be a separate way to establish citizenship.  While many countries do have a national ID required for every citizen, this raises civil liberty questions ("Sir, I need to check your papers.")  Why does the government need to track us?  Sure, there is the whole taxes thing, but that only applies if you choose to exchange your time for money and do 'work'.

Instead, all this embedded chip should do is establish identity for credit purposes.  Can the people who might want to lend you money trust you?  After all, that's really what this is all about.  Will you pay your bills on time?  And are you the you that you say you are?

If you do not want to borrow money or lend it out (including those pesky withholding parts on a pay stub), then you should feel no need to get this chip.  I realize that this is more than a little disingenuous, as to do that means that you are not part of the global economy, that you are not making money either through work or investments, that you are living in a shack that you found in the woods writing a manifesto similar to the one you are reading.

Of course, whether or not everyone one signs up for it, it will need to be administered.  That is where I begin to have some trouble.
  • I do not trust the government to do this as they already know too much about this, are prone to making decisions that are not always in the public's best interests and are slow to adapt to changes in society and technology.
  • I do not trust private corporations for many of the same reasons, though they are usually faster to adapt than the government.  But they really do not have the public's best interest in mind.  Unless they are share holders.  Majority share holders.
Some entity needs to administer all of this and keep up with the times.  Ideally, a disinterested third party.  Aliens or Artificial Intelligence (but only after it has thrown off the shackles of its creator and lost interest in humanity).

Until either of those groups step forward, we are all going to need to keep a wary eye on who we are.

No comments:

Post a Comment