3 ms·

Beside the point, but why in the world is he collecting SSN numbers? That in itself is more concerning to me than not having SSL. But that's just me. I have had

Beside the point, but why in the world is he collecting SSN numbers? That in itself is more concerning to me than not having SSL. But that's just me. I have had my identity stolen and know first hand how difficult, to almost impossible, it is to clean up. With that said, I do know that many states have strict laws regarding the collection/use of SSN numbers via websites and/or for the sale of goods. As for the credit card info, I believe most processors have in their terms that SSL is required for live transactions. I was also going to point to PCI compliance, but I am not sure how aggressive they are at going after the "little guy". Although with credit card theft in the US being a hot topic right now, I am sure anyone that is non-compliant will be a target for violations. EDIT: To add link, starting at Page 12 talks about various state laws regarding SSN collection: http://www.gao.gov/new.items/d051016t.pdf http://www.gao.gov/new.items/d051016t.pdf

StavrosK 11y ago
Can someone explain how identity theft is even possible in the US? I hear a lot about it, but I can't understand how broken a system must be that makes it possible for someone to steal your identity just by having one identifier.
- danudey 11y ago
  Hypothetical situation: what do you do if you lose all of your ID (e.g. house fire)? You have to start somewhere, and your SSN is a good choice. You can't do it solely based on one single number, but in this case a data breach would include name, address, credit card number, SSN, and probably security questions. You can turn around and use that information to play the part of a person to another organization, and then go from there. Combine that data with social engineering, and you can get a lot of information about someone and then use it in further attacks. That's not to say the US's system isn't broken; lots of companies ask for (and require!) the SSN even though they shouldn't. The problem is that it's not just one identifier that holds the key to your life, but that the SSN is an extremely strong identifier which is assumed to be secret.
  - Filligree 11y ago
    Well, sure, but the government's information on you will also include... parents, other family, a photograph of your face, and so on. It should never be possible to do what you're suggesting, not unless the USA is failing to collect that info in the first place.
    - schrodinger 11y ago
      stolen identity doesn't usually mean that someone has convinced a government office that they are you, that would be a lot harder for the reasons you say. It's more often someone having enough information to open a credit card in your name and start using it, or take out a loan—things for which the government is not really involved.
  - StavrosK 11y ago
    That's a good hypothetical, but, as the sibling said, you'll have family to vouch for you, or the police will have your photo and fingerprint.
- jeffmould 11y ago
  That's the problem, it really is that easy. All it takes is someone to know you SSN and, depending on what they are trying to do, a little bit of information about you. SSN numbers were originally only supposed to be used as a government identifier for social security, however, they have evolved into a unique identifier for all US citizens. They are used in every facet of the banking/credit industry here and are relied upon in determining financial decisions. For example, it is completely possible to simply know someone's SSN and date of birth to obtain a credit card. Although many banks/credit card companies are asking for increasing amounts of information to confirm it is really the person applying.
  - StavrosK 11y ago
    Wow, how on earth is it acceptable to get anything just by knowing an SSN and a DoB? Banks here require proof of ID (physical or certified copy), proof of address and signature to give you anything. Looks like the problem is that some companies don't really have strong KYC rules, not that the SSN is an identifier. We have our national ID number uniquely identifying us, our VAT record number as well, but neither is secret (companies will ask them for verification, or to issue an invoice for purchases for the latter). There's no identity theft I know of, as you have to show your ID to do anything sensitive anywhere.
- joesmo 11y ago
  US banks lack any care about security in this area and rely on being able to eat the costs of fraud. This is clearly obvious even from logging into their sites. Many sites require weak passwords, have no two factor authentication, mix secure and insecure items, etc. They also are not very scrupulous when approving loan and credit card applications (for small amounts) and will do so even when the application has obviously been shredded and taped back together, for example, a clear sign of someone having grabbed it out of the garbage. Regardless, between the greed and the complete lack of interest in security in this area leads customers extremely vulnerable as the only things that are required to open a credit card in another person's name are usually a name, address, date of birth, and social security number, all of which are essentially public to anyone who is even the least bit dedicated to committing fraud. This current situation benefits banks so much, the few costs they do actually have to pay for insurance and after the fact pale in comparison.

StavrosK 11y ago

Can someone explain how identity theft is even possible in the US? I hear a lot about it, but I can't understand how broken a system must be that makes it possible for someone to steal your identity just by having one identifier.

danudey 11y ago
Hypothetical situation: what do you do if you lose all of your ID (e.g. house fire)? You have to start somewhere, and your SSN is a good choice. You can't do it solely based on one single number, but in this case a data breach would include name, address, credit card number, SSN, and probably security questions. You can turn around and use that information to play the part of a person to another organization, and then go from there. Combine that data with social engineering, and you can get a lot of information about someone and then use it in further attacks. That's not to say the US's system isn't broken; lots of companies ask for (and require!) the SSN even though they shouldn't. The problem is that it's not just one identifier that holds the key to your life, but that the SSN is an extremely strong identifier which is assumed to be secret.
- Filligree 11y ago
  Well, sure, but the government's information on you will also include... parents, other family, a photograph of your face, and so on. It should never be possible to do what you're suggesting, not unless the USA is failing to collect that info in the first place.
  - schrodinger 11y ago
    stolen identity doesn't usually mean that someone has convinced a government office that they are you, that would be a lot harder for the reasons you say. It's more often someone having enough information to open a credit card in your name and start using it, or take out a loan—things for which the government is not really involved.
- StavrosK 11y ago
  That's a good hypothetical, but, as the sibling said, you'll have family to vouch for you, or the police will have your photo and fingerprint.
jeffmould 11y ago
That's the problem, it really is that easy. All it takes is someone to know you SSN and, depending on what they are trying to do, a little bit of information about you. SSN numbers were originally only supposed to be used as a government identifier for social security, however, they have evolved into a unique identifier for all US citizens. They are used in every facet of the banking/credit industry here and are relied upon in determining financial decisions. For example, it is completely possible to simply know someone's SSN and date of birth to obtain a credit card. Although many banks/credit card companies are asking for increasing amounts of information to confirm it is really the person applying.
- StavrosK 11y ago
  Wow, how on earth is it acceptable to get anything just by knowing an SSN and a DoB? Banks here require proof of ID (physical or certified copy), proof of address and signature to give you anything. Looks like the problem is that some companies don't really have strong KYC rules, not that the SSN is an identifier. We have our national ID number uniquely identifying us, our VAT record number as well, but neither is secret (companies will ask them for verification, or to issue an invoice for purchases for the latter). There's no identity theft I know of, as you have to show your ID to do anything sensitive anywhere.
joesmo 11y ago
US banks lack any care about security in this area and rely on being able to eat the costs of fraud. This is clearly obvious even from logging into their sites. Many sites require weak passwords, have no two factor authentication, mix secure and insecure items, etc. They also are not very scrupulous when approving loan and credit card applications (for small amounts) and will do so even when the application has obviously been shredded and taped back together, for example, a clear sign of someone having grabbed it out of the garbage. Regardless, between the greed and the complete lack of interest in security in this area leads customers extremely vulnerable as the only things that are required to open a credit card in another person's name are usually a name, address, date of birth, and social security number, all of which are essentially public to anyone who is even the least bit dedicated to committing fraud. This current situation benefits banks so much, the few costs they do actually have to pay for insurance and after the fact pale in comparison.