The article goes a bit off the rails at the end, with all the focus on using a changeable identifier ("And if this new identifier were easy enough to change (unlike SSNs), breaches, leaks, and other unintended exposures would be less consequential.")
There's no reason not to keep SSN as an identifier. Just the same as I wouldn't change my name if I suffered identity theft. Instead there needs to be authentication (eg via a method such as a token, 2FA or whatever) - and it's that which needs to be resettable.
Simply making use of SSN alone illegal in certain industries would be a reasonable approach: it would stop current problems whilst not insensing the "mark of the beast" brigade.
There's no reason not to keep SSN as an identifier. Just the same as I wouldn't change my name if I suffered identity theft. Instead there needs to be authentication (eg via a method such as a token, 2FA or whatever) - and it's that which needs to be resettable.
Simply making use of SSN alone illegal in certain industries would be a reasonable approach: it would stop current problems whilst not insensing the "mark of the beast" brigade.