7 ms·
The Way We Use Social Security Numbers Is Absurd
- smegger001 11y agoWhy not issue each citizen, immigrant, business, legal entity, something like a RSA SecureID token with a associated public privet key pair?
- bhhaskin 11y agoSome countries are starting to do this. I think it is a great idea.
- sbierwagen 11y agohttps://en.wikipedia.org/wiki/Common_Access_Card https://en.wikipedia.org/wiki/Common_Access_Card
- Retric 11y agoIMO, the idea anyone can resell dubious debt, use collections, or put something on a credit report is the real issue. If you first needed to say mail something to the address with the DMV then simply having random info becomes a lot less useful.
- pacaro 11y agoThis. I found it amazing that the article didn't mention the role that the credit agencies play in this. Almost all the time you are asked for your SSN, certainly in commercial transactions, it's so a credit check can be run. The credit agencies could solve this. They could even some it securely.
- ars 11y agoAnd they don't even need the number to run a credit check! When some utility wanted the number to run a credit check I said I could not remember it. They ran the check anyway (using Name and Address), and read my social back to me!
- MichaelGG 11y agoIt's amazing where they are asked for, too, and how easily people give them out. Get Comcast cable? They ask for SSN, but it's not a showstopper. I just told them I didn't have one, and that was that. But a prepaid T-Mobile, recharging via CC over the phone? Asked for SSN and insisted. When I said I was Canadian, they insisted on the Canadian equivalent. Had to hang up and get another rep. Why do Americans just go along with it and give their SSN out? Just say you don't have one. Canada does it right. Upon getting a SIN, the government is very clear that you are not obligated to give it out and that companies cannot refuse service if you do not provide it.
- deleted 11y ago[deleted]
- swalberg 11y agoI'm Canadian and just moved to the US. While utilities were pretty good about me not having a SSN (including Verizon), it's all the stuff that comes after that's causing me problems. So many web sites either rely on having an SSN on file, or by contracting to a 3rd party to do identity checks that fail when you don't have a US credit history. I'm currently in Limbo with my healthcare provider because they won't let me pay my bills online (or set up appointments, see results, or email my doctor) until I validate my identity, I've had to do my auto registration through snail mail because the state's website won't recognize my SSN, and have also had to call other places to get set up on their websites because of having no SSN when I started. You mentioned T-Mobile, who were pretty good in getting me set up without a credit check, but won't auto debit my credit card when I have a bill. I have to go online each month and pay, with that same credit card. And getting to that point took a couple of phone calls.
- redwards510 11y agoWhat happens if you just make one up? Would that be fraud?
- OrwellianChild 11y agoYes. I'm pretty sure foreign residents get an Individual Tax ID Number (TIN). [1] Not sure why @swalberg doesn't have one... [1] https://www.irs.gov/Individuals/International-Taxpayers/Taxpayer-Identification-Numbers-TIN https://www.irs.gov/Individuals/International-Taxpayers/Taxp...
- cesarb 11y agoAs far as I know, the USA doesn't have identity cards. That's probably why the SSN is often used as an identifier there: it's the closest thing to a "unique identifier" they have. (Of course, treating it like a password is madness: as an identifier, it should be public.)
- WorldMaker 11y agoA good majority of Americans have a state-issued driver's license (or equivalent for non-drivers) with a unique identifier on it. I am absolutely surprised we don't use these identifiers more often, especially given that unlike SSNs, driver's licenses in most states don't have "Please don't use for other identification purposes" written on them like SSN cards do. Also yes, IDs are not passwords and should never be used for authentication purposes. This is never "two-factor", it is always a "wish it were two-factor" kludge.
- WorldMaker 11y agoOf course, the issue with driver's license numbers is they do change when people move. People like SSNs because they are handed out "at birth" and mostly don't change in a person's lifetime. [] [] I love the mostly clause here, because they can, in fact, change, and it's sad how much software and credit reporting breaks because of that in-built assumption that person will ever have one SSN.
- baconner 11y agoDrivers license is an even bigger can of worms - see any voter identification law discussion.
- sbierwagen 11y agounlike SSNs, driver's licenses in most states don't have "Please don't use for other identification purposes" written on them like SSN cards do. SSN cards haven't had that printed on them since 1972.
- baconner 11y agoI think the problem is basically that it presents some (albeit weak and messy) solutions for companies and they're not stopped by law from this risky behavior. Since national IDs are politically untenable in the US no pkey alternative is forthcoming - at least none that appeal to lazy companies who want aa low effort solution. We are long overdue for some federal legislation about how ssn can be used and how it cannot along with other basics to protect people from I'd theft. It should be illegal to use it as any kind of identity verification for instance, but its not.
- WorldMaker 11y agoI've gotten into so many arguments about how the first five digits of an SSN for nearly everyone born before 2011 (!), when they switched to a more pseudo-random algorithm, is reverse engineer-able and thus you should never, ever show the last four digits as that really is the only "secret" part of an SSN. This argument is a "fun" circular argument that typically goes "Well, but if we only show the first five, many families can't tell which social is whose because they all look so similar..." "Yes, because it was an algorithm! We should use something other than SSN to identify different people." "But how will people know which SSN their account is connected to?" "Why is their SSN connected to the account at all?" "So they can identify their account!" /facepalm
- cheepin 11y agoI find it amusing that many places that will require "Strong" passwords with numbers, letters, and symbols, will use 9 digits as if it is secure, many even using just the last four!
- baconner 11y agoThis. There's nothing like setting up a rigid password policy to give the appearance of security, then providing a secondary super weak password like ssn or easy to figure out security questions. For many sites its purely about appearance with little real thought given to protecting users.
- halviti 11y agoPersonally I take the opposite approach, why not connect SSN numbers to everything? As you mention, it's easily determinable, and it has the fortune of being an existing ID number system already connected to everyone. Allowing everyone the ability to tell people apart based on a number is infinitely better than matching names. In my country we use our ID numbers for everything, dentist appointments, vehicle inspections.. if you call any business at all it will likely be one of the first things you're asked for. The number should be an identifier for a person, not a security measure. If you just accepted the fact that SSNs are insecure and that by knowing someone's SSN does not necessarily mean you are that person, then the US could use them more effectively, cut down on a significant number of errors in every industry, and actually reduce identity theft.
- OrwellianChild 11y agoThis strikes me as a pretty difficult problem, since it touches on personal privacy, information security, and identification all at once... The simplest solution would be a disassociated ID card with a 2 or 3 factor identification (eye scan, fingerprint, etc.). Except this requires everyone to register and isn't going to gain widespread support in the U.S. for privacy reasons. Info security just needs multiple factors, so require SSN and then an RSA-type second-factor to authenticate. This would make it about as secure as GMail, except for when you lose your PIN generator. I have backup codes for my GMail... How do we handle lost PINs when it's personal ID at stake? Identification could be as simple as a personal e-mail address... Except we have all kinds of things tied to SSN as ID, including credit history, bank loans, etc. that require proof of individual identity, not just "unique identification". Is this a solved problem?
- whoopdedo 11y agoMark Twain* said "Keep all your eggs in one basket. Then guard that basket." A good solution to identification would be a central state operated database. But it would have to be backed by strong laws defining what it can be used for with no loopholes, not even for police of "national security", and a default deny policy. It would help secure taxes, welfare benefits, health care, voting, and background checks. The database information cannot be sold, data mined, or used in a criminal investigation without a non-rubberstamped warrant. The database can be used to confirm identity but the ID number cannot be stored anywhere else. Other agencies, both government and non-governmental, will be required to generate their own internal IDs without recording the national ID so if one database is compromised it doesn't collapse the whole house of cards. These are common sense policies but they are all human policies. No amount of technical wizardry can stop a human from doing something stupid. That's what laws and regulations are for. However the US has been stuck in a counterproductive attitude of treating regulation as a bad thing. So poorly implemented policies keep screwing up all the best technological intentions of the engineers. (* Like most Mark Twain quotes there's a good chance this is misquoted or misattributed.)
- Chlorus 11y ago"A good solution to identification would be a central state operated database. But it would have to be backed by strong laws defining what it can be used for with no loopholes, not even for police of "national security", and a default deny policy." Good luck with that, in any country, in any regime. "However the US has been stuck in a counterproductive attitude of treating regulation as a bad thing" Which is why other countries have such air-tight centralized databases that are never abused...right?
- akersten 11y agoI have written a little bit about this topic[0], describing that ideally we'd have a much better system that relied on keypairs and cryptography rather than keeping a short, predictable number secret. I really really hope to see a movement towards better meatspace authentication in my lifetime, but I have a fear that SSNs are here for good. [0] http://ece.rocks/alex/2015/02/01/generated-at-birth.html http://ece.rocks/alex/2015/02/01/generated-at-birth.html
- icebraining 11y agoIt's not generated at birth, but I and millions of other Portuguese citizens have state-issued smartcards with our own public keypair (and signed by their certificate). Yet just last week to sign up for a mobile contract, I had to print a PDF, sign it and scan it. The adoption has been almost nil.
- tmzt 11y agoWhere are the private keys stored? Are they kept only within the card, or are they generated externally and added to the card? I ask because it's difficult to belive that millions are generating and keeping safe a private key. Of course the lack of adoption is another concern.
- icebraining 11y agoThe card itself generates the key, and AFAIK there's no way to get a copy of it (except maybe by physically decapping the chip and reading its memory).
- Meekro 11y agoYou know what's really scary? Gmail is held up as the pinnacle of email security, but they let you reset your password by proving ownership of just a phone number! So much for 2FA. So much for strong passwords. All I have to do is obtain your SSN, call up your cell phone provider and hijack your phone number, and initiate a password reset with Google. That gets me into your Gmail, which in turn gets me into all your other accounts. Ridiculously easy. Google should be ashamed.
- Moshe_Silnorin 11y agoEven if you use google authenticator?
- Meekro 11y agoYes -- having the "recovery phone number" lets you bypass their google auth two-factor. See more here: [1] https://support.google.com/accounts/answer/183723?hl=en https://support.google.com/accounts/answer/183723?hl=en
- Lx1oG-AWb6h_ZG0 11y agoSurely this is barking up the wrong tree? The problem is with your phone provider allowing anyone to hijack your number. What Google does is entirely reasonable for the vast majority of people. If AT&T fucks up, that's not Google's fault.
- sliverstorm 11y agoIsn't that still kind of 2FA? You have to link a SSN to an email address. physical 2FA always provided less security against people who know you (and thus could easily make that link), because those people have the physical presence to steal your token unlike a hacker in Elbonia.
- markdown 11y agoWoohoo, great slapdown!! ... ... .. Now tell us what they should use instead of phone 2FA?
- nitwit005 11y agoAmerican bureaucracies have a bizarre obsession with them. My school issued student IDs with unique numbers, which should have been the end of all such issues. Unfortunately, they made a bizarre system where US students had their student ID be their SSN with a fixed prefix, and international students got a random number with other prefixes. They refused to give up on using SSN even when they knew it wouldn't work for a good portion of students. Heaven forbid someone just add an SSN to student ID lookup table to the database.
- ars 11y ago> Heaven forbid someone just add an SSN to student ID lookup table to the database. Why does a school even need this number? The only groups that need this number are financial institutions of all types (including employment and borrowing) and government agencies. A school does not need it. If they lend you money then that department might, but no further. What I do when places that don't need the number ask for it is pretend I don't remember it. So far I've not had any problems, they mange just fine without it.
- RIMR 11y ago>People affected by SSN-related tax fraud can apply for an IRS-issued IP PIN or identity protection PIN. So I have to be a victim already to add security to my SSN? Why can't I just opt-in before I get my identity stolen?
- OrwellianChild 11y agoSadly, this is generally correct, per the application process here: https://www.irs.gov/Individuals/Get-An-Identity-Protection-PIN https://www.irs.gov/Individuals/Get-An-Identity-Protection-P... Citizens of Florida, Georgia, or DC can, though. Wonder how we expand this program...
- rdancer 11y agoAs technologists, and as an industry, we are failing our customers by not having developed a credible alternative to SSNs. They're only used because literally everything else is an even worse fit for access control. Let's not also forget that in year 2015, we still use passwords as primary access control guards. That's technology that was invented shortly after the development of speech in humans, circa 100,000 BC.
- vezzy-fnord 11y agoPasswords, as we know them in the form of computer passwords, are of course much more recent, usually credited to Fernando J. Corbató for use in the Compatible Time-Sharing System in the early 60s. Their semantics are quite different from having to say "swordfish" to a guard behind a door. There's nothing intrinsically wrong with them. There are people who propose we generate key pairs for every newborn. It is, however, delusional to believe that the same governments which struggle with flat documentation will then turn around to properly do PKI.
- kitwalker12 11y agoI can't remember the link to the article, but a few years back a researcher had published a paper on the security of SSNs. It outlined how the first 3 numbers are kind of based on your location of application (like a 3 digit code for a county). next 2 are kind of related to your date of birth. The only hard part was the last 4 digits which are random but easy to get as thats the first thing most companies ask for.