Senators push to ditch social security numbers in light of Equifax hack
My first inclinations are that Apple and Google should be in these committee meetings. 77% of Americans own smartphones [1]. 99.6% of new smartphones run Android or iOS [2]. I would love for my iPhone to generate a private&#x2F;public key pair, with the private key stored on the Secure Enclave.<p>To register my public key, I fill out, on my phone, a bit of basic public information: full legal name, place &amp; date of birth, and my current address and submit it. My phone suggests a nearby SSA office and proposes several appointment times, reminding me the day of.<p>At the appointed time, I take my phone, passport, birth certificate, SSN card, driver&#x27;s license and recent electric bill with my address on it to the local SSA office. [3] There, the administration manually inspects and verifies my documentation. Their systems then sign the authentication along with the current location, the time, the official&#x27;s ID number, and a sha256 hash of a photo of me and the official holding up today&#x27;s paper.<p>My phone chirps, I use my passcode&#x2F;Touch ID&#x2F;Face ID&#x2F;Dance ID to digitally counter-sign their authentication. This assures me that when the SSA&#x27;s private keys are rotated because of inevitable compromise or on a routine schedule, my public key was not overwritten by the attackers.<p>The SSA administration publishes my public key in their online directory. Private companies can download the public key directories and cache them, or pay Stripe-like vendors for just-in-time lookups. When I want to apply for a credit card, my phone chirps and I sign the credit request, just like Apple Pay. When I lose my phone, I run by the SSA office again before I apply for another credit card.<p>Empowered by this new security layer, Congress passes a law establishing that no one can be held liable for—and credit decisions may not be made against—accounts that have not been digitally signed for any citizen who has a verified public key.<p>And then I remember healthcare.gov and I wonder if I should even press submit.<p>[1] <a href="http:&#x2F;&#x2F;www.pewinternet.org&#x2F;fact-sheet&#x2F;mobile&#x2F;" rel="nofollow">http:&#x2F;&#x2F;www.pewinternet.org&#x2F;fact-sheet&#x2F;mobile&#x2F;</a><p>[2] <a href="https:&#x2F;&#x2F;www.theverge.com&#x2F;2017&#x2F;2&#x2F;16&#x2F;14634656&#x2F;android-ios-market-share-blackberry-2016" rel="nofollow">https:&#x2F;&#x2F;www.theverge.com&#x2F;2017&#x2F;2&#x2F;16&#x2F;14634656&#x2F;android-ios-mark...</a><p>[3] I wouldn&#x27;t necessarily need to have all of these kinds of documentation, but the public directory system would be able to indicate which forms of identification I did have at time of authentication, for third parties to weigh the risk of identity theft.