10 ms·

Loophole Ends the Privacy of Social Security Numbers

114 points by endswapper 10y ago

criddell 10y ago
I don't understand how people can pretend that a SSN isn't a national ID number. Of course it is. If a state wants to show that it isn't, then make changes that make the number unsuited to being a national ID number. Let people pick their own number or reduce it to a 4 digit number.
- MichaelGG 10y ago
  It's federal isn't it? So it wouldn't be up to the state. I'd want to read the actual decision because on face value, this seems ridiculous. Basically every agency can just get around the Privacy Act saying "uh child support!". It should be up to the child support or taxation authorities to go around and find people not paying and deal with them appropriately. Unfortunately, especially with people used to modern databases, I don't think many people are used to thinking that the government's job should sometimes be a bit more difficult.
  - fredgrott 10y ago
    Yes, it would be up to the state.. LOOK AT YOUR DL from your state, does it show your SSN? In some USA States we still can have our SSN not listed on our DL in some other states we cannot
    - logfromblammo 10y ago
      In the states where the DL number is not identical to the SSN, it may still be possible to reconstruct the SSN from the DL number. The SSN may also be encoded in the 2D barcode on the back, without appearing on the face. There may be a few states that have to query a central database in order to link a DL number to a SSN. But rest assured that every state will attempt to maintain such a link, and will sell access to it for the right price. That's why you should treat every request for your driver's license number as a request for your social security number, even though it is probably not governed by the privacy protection laws as it might be if the request was for a SSN directly.
      - FT_intern 10y ago
        Do you have sources on this? I remember doing research on this and concluding that most states phased out basing driver's license numbers on SSNs
        jandrese 10y ago
        I thought it was a provision of the RealID act that states couldn't use your SSN as your driver's license number anymore. IMHO, the idea that it's a secret number has been shot for years now. Fretting over who can find your SSN is pointless because the answer is anybody. It's ok as long as you don't give any special privileges to someone just because they know another person's SSN. It's no more special than your full name.
        logfromblammo 10y ago
        I'm not entirely certain whether all states have decided to comply with the requirements of RealID for their drivers' licenses. Last time I checked, there were still some holdouts, but that was quite some time ago.
    - smhenderson 10y ago
      Mine's not listed on my DL but I did have to give it to DOT when I received my license. Well, I didn't _have_ to; the gentleman asked me for a single proof of residence and my SSN. When I said "I don't want to give out my SSN, you can't ask for that as ID" he replied, "yes, you're correct. In that case I'll need three proof of residence documents from this list and two identification documents from this other list". I had a passport, a mortgage and a phone bill so I just caved and gave him my SSN.
  - criddell 10y ago
    > It's federal isn't it? Of course. You're right. My point still stands though. It is a federal ID number and I don't really get the opposition to it (other than the religious objection). If the feds want to deny that it's an ID number, they should take steps to ensure that no number is linked to a single individual.
    - sverige 10y ago
      > I don't really get the opposition to it (other than the religious objection). Read some history of how national ID was used and abused by Nazi Germany and Soviet Russia to find reasons other than (but also including) religion as the basis for objection.
      - criddell 10y ago
        Sure, but we are so far beyond what was available 1930's and 1940's already, what's the problem with the bar association seeing your SSN? There's no going back now and even if we could, I'm not sure we should. My big objections with SSN is that they are a quasi-secret thing. They are the key to so many things yet they really are public.
- moron4hire 10y ago
  SSNs are not unique.
  - deathanatos 10y ago
    In what sense? They're only ever assigned to a single individual, and they are not reused[1]. The number uniquely IDs the individual. The Wikipedia article makes the same point as the parent poster: "the Social Security number has become a de facto national identification number". [1]: https://en.wikipedia.org/wiki/Social_Security_number#Exhaustion_and_re-use https://en.wikipedia.org/wiki/Social_Security_number#Exhaust...
    - cjg 10y ago
      At least in the sense that there's no 1-1 mapping from SSNs to individuals. http://www.witn.com/home/headlines/Duplicate__111371029.html http://www.witn.com/home/headlines/Duplicate__111371029.html
      - divbit 10y ago
        nitpick: based on the example you linked, you probably mean 1-1 in the opposite direction, or something like, "no well-defined function" in that direction.
    - Spooky23 10y ago
      That's a technically accurate, but weasely answer from the SSA. Realistically, there are many loopholes and exceptions. - People born in various New England states have social security number overlap with number ranges issued by the social security systems in Micronesia, Palau and the Marshall islands. Those territories get services from Federal programs which causes issues. - EINs and SSNs are issued by different departments and can overlap. People in various scenarios will provide the number in the wrong context. - Millions of people use the wrong SSN without fraudulent intent. - People frequently and fraudulently use the SSNs of children and older people. - Hundreds of thousands/low millions of people have multiple valid SSNs. - 40,000 people used a real SSN included as a sample in a wallet in the 1930's. - Some populations have a higher incidence of mistakes, fraud, multiple valid SSNs or other problems. One dataset that I was acquainted with had IIRC a 7% known exception rate for SSNs.
- nxzero 10y ago
  ID fraud already makes a lot of SSN non-unique; one in seven SSN has been used more than once, though the SSA doesn't report this to the owner of the SSN.
- morganvachon 10y ago
  It's not only your SSN that is a national ID number, thanks to the Real ID Act your driver's license/state ID number is your true national ID number. At least, that was the plan, but literally half the states and territories are holding out and stalling it, so the SSN continues to be that default ID number for anything federal. I don't know which is worse: The cock-up that is the Real ID Act or the stupidity surrounding the SSN being a de facto ID number for anything and everything.
libeclipse 10y ago
How is it decided if one law supersedes another? It seems pretty strange to have contradicting laws, especially since the federal privacy act is very broad in its statement.
- sbuttgereit 10y ago
  Given the volume of law that we have, it's not surprising at all that there are laws which contradict other laws. Decisions of which law supersedes another are more often than not up to judges, and sometimes juries, in cases like this. Other laws can be written which try to settle the questions, too, but by and large it's the court cases which settle precedent. This is why who gets to be a judge is such an important question. At the end of the day, the decisions of individual people who are judges can hold an incredible amount of power... and so long as their decisions are well reasoned (or well rationalized)... they can determine how we can live (or not live) our lives. (edited for clarity)
- razwall 10y ago
  In general, a more specific law trumps a more general law, and a later law trumps an earlier enacted law. So the more specific rule of "States may ask for SSN's for tax purposes" would override the general rule of "States may not ask for SSN's". And the exception was presumably enacted after the general rule, since otherwise there would have been no need to make an exception.
- flubert 10y ago
  >It seems pretty strange to have contradicting laws I think you might enjoy: THE MYTH OF THE RULE OF LAW http://faculty.msb.edu/hasnasj/GTWebSite/MythWeb.htm http://faculty.msb.edu/hasnasj/GTWebSite/MythWeb.htm
- nkrisc 10y ago
  This is one of the reasons we (the U.S.) have judges and an appeals process. The legislature can then also act to clarify the laws such that they work in harmony or repeal one of the conflicting ones.
pravda 10y ago
In some states, you have to give your SSN to get a driver's licence.
- protomyth 10y ago
  North Dakota once used the SSN as the driver's license number. That's been corrected.
InclinedPlane 10y ago
What's fun about SSNs is that proof of them having been leaked isn't sufficient to get a new one, you have to become the victim of fraud based on your SSN having leaked to get a replacement.
- deleted 10y ago
  [deleted]
- jdmichal 10y ago
  Honestly, that's somewhat understandable. Otherwise, there would be plenty of advice that you should rotate your SSN every year, just in case... While that would be an ideal final state, in our current state that's probably not a great idea. I suppose ideal final state would be some combination of a cryptographic certificate and a rotating security token ala RSA SecurID. The token is enough to verify that you possess the certificate, but has no unique value in-and-of itself.
  - InclinedPlane 10y ago
    Right. But remember, this applies to cases where you can prove that your SSN has been stolen, which isn't enough to get a new one (if it were about 2/3 of Americans would be able to get one, most likely). The big problem is that the SSN is completely, utterly a bad idea in the 21st century, but nobody is working on a superior replacement because things aren't "that bad yet".
- pmoney 10y ago
  And even then, proof of fraudulent activity does not guarantee the issuance of a new number. It's a case-by-case basis.
danso 10y ago
I wonder how much of the desire to hang on to SSN as a private identifier is rooted in the fact that SSN's contain a bit of personal data. Until 1972, the first 3 digits represented where you were born or where the card was issued. Afterwards they represent the mailing address for the application for the card. And because of that design decision, some states were fairly close to running out of SSNs: https://www.ssa.gov/policy/docs/ssb/v69n2/v69n2p55.html https://www.ssa.gov/policy/docs/ssb/v69n2/v69n2p55.html Today, SSNs are randomized: https://www.ssa.gov/employer/randomization.html https://www.ssa.gov/employer/randomization.html Considering the numbering system was created in the 1930s, their idea of what constitutes a unique, private (i.e. hard to remember) number is a bit less relevant today.
- mindslight 10y ago
  IMHO it's just about trying to hold onto it being less generally useful, as was initially promised. The government pulled the same "limited scope" bullshit they did for all the recent "terrorism" "laws". Enumerating and precisely identifying citizens is the basis of mass surveillance. For most every societal use, a name and a birthday is good enough identification. Individuals should not be perfectly legible to the government, because then the rulers are further tempted into demanding that reality conform to their whims. Of course now that government-cum-computer has entrenched and precessed, there are many areas where precise identification will help preserve one's rights. If one shared a name and birthdate with a wanted criminal, they certainly would want to be distinguishable! But such situations are really due to the system asserting that its abstractions are airtight. For example if someone applies for credit in my name, the crime that has occurred is fraud and I am not involved. But the system (within-abstraction) diagnoses the situation as me being a victim of "identity theft", transferring blame to the individuals affected by its own shortcomings! Further cementing the abstractions further strengthens belief in them, making these failure modes even harsher. Another practical problem in the US is that the government fails to prohibit the use of such identifiers for private purposes, under a half-applied theory of private contract (or really just money talks). So we end up with the double-edged sword of the free market combined with a government mandate, which destroys individuals' sole power of exit versus otherwise unaccountable corporate entities.
quotemstr 10y ago
The entire SSN system is a disgrace. We've had the cryptographic tools for decades to do it right, but we instead treat SSNs as both identifier and some sort of awful bearer token. In any sane system, knowing an actor's precise identity should not permit impersonating that actor!
- jimktrains2 10y ago
  I always wondered why we didn't at least have a "full access" number the user would never shared but on their taxes, a "write only" number to give employers, and a "read only" number for background checks, banks, &c.
  - blacksmith_tb 10y ago
    Ideally I'd think the private (key) version wouldn't be human-readable at all, you'd need to physically possess the card to use it, while the public number could be carelessly used like we do SSNs now...
    - deleted 10y ago
      [deleted]
    - jimktrains2 10y ago
      Sure, but I was thinking of something that could have been implemented 50 years ago.
  - dv_dt 10y ago
    I would suspect it's because there's a certain political segment that stands in the way of improving programs for which they would prefer would just be ended.
    - jdminhbg 10y ago
      The political segment of the US that would like Social Security to just be ended is statistically equivalent to zero people.
protomyth 10y ago
I wonder if it would be possible to have private, certified identity providers for people.
- ceejayoz 10y ago
  Notaries public?
  - protomyth 10y ago
    I mean more in the sense of issuing an acceptable id number. It would probably be a stretch to get a Notaries public to do that.
- deleted 10y ago
  [deleted]
jedberg 10y ago
Anyone who thinks an SSN is a secret is naive at best. Back in the day, your student ID at California State schools was your SSN. It was on your ID card, which you had to present to do anything at the school.
- cgusto 10y ago
  Wasn't even that long ago. In 2006, the CSU I was at still used your SSN for everything - including logging into the computers. This particular school has since changed this, but I wouldn't be surprised if the practice is still used elsewhere.
  - jedberg 10y ago
    Wow. I know at CSULA it was SSNs in the early 90s, but they were already phasing it out.
- undersuit 10y ago
  Montana, and I bet a number of other states, used to use the SSN as part of your driver license number.
etjossem 10y ago
> "The whole point of the federal privacy law is to prevent states from making the Social Security number into a nationally mandated identification number of the kind that’s common in Europe. The practice goes back to the immediate post-World War II era, when Sweden became the first country to assign every citizen a personal identity number that follows you throughout your life and must be used in essentially every interaction with state. Every Swede memorizes the number in childhood. And notably, the tax authority makes everyone’s number publicly available to anyone who asks for it." This wouldn't be a bad thing if we didn't also use the SSN as proof of identity. Numbers as "usernames" for individuals are fine. But they should not also serve as "passwords." That particular cat is already out of the bag. The list of people who know or have access to your social security number includes dozens of bank personnel, medical professionals, standardized testing agencies, previous employers, and government employees. It is entirely possible for malicious actors, given any other personal identifier (a unique full name, or any full name plus address), to find the associated social security number. We simply cannot expect any SSN - let alone its last 4 digits - to be known only by the person to which it was issued.
- bsimpson 10y ago
  For many people, the last 4 digits are the only ones that aren't easily deduced if you know the city a person was born in and the person's approximate birthdate.
  - etjossem 10y ago
    And for this reason, many SSN verifiers (banks, government agencies, etc) ask for the last 4 digits. Then they store them in a dusty database somewhere and forget about them until they have to verify identity again, or there's a major breach. That last part is the part that keeps me up at night.
    - Iv 10y ago
      Even if they didn't, given the number of state-level administrations, I am sure I can get close to the 9999 attempts I need to brute force a code. I wonder how many automated attempts are possible.
int_19h 10y ago
The opposition to the national ID in US is really, really weird. Especially when it comes from many of the same people who insist on photo ID when voting, because they're afraid of non-citizens going to vote. Since the federal government is the one that keeps track of things such as immigration status, it stands to reason that it should be the one issuing IDs that are used for voting purposes - and at that point you might as well use it for everything else. And, of course, SSNs are already a de facto national ID system. It just happens to be one that wasn't designed for ID purposes, and so it's very suboptimal (but any government abuses you could do with a proper ID, you can also do with SSN).
- deleted 10y ago
  [deleted]
- mturmon 10y ago
  Opposition to using the SSN as an identifier started out as a privacy thing. It's also the reason that the Social Security Card itself is so flimsy and bare-bones. They did not want it to become a national ID card. I used to respect this, but as time has passed, I think crooks and scammers get more benefit out of the lack of ID than most of the public gets out of these rudimentary guards. Anyone remotely serious (nation-states and bigcorps) can ID me if they want.
  - PhantomGremlin 10y ago
    They did not want it to become a national ID card. I laminated my card because it was flimsy. It's still OK over 40 years later. My card has the following words on it: FOR SOCIAL SECURITY AND TAX PURPOSES -- NOT FOR IDENTIFICATION time has passed Yes you are right. That ship sailed way back in 1972 when the SSA removed those words.[1] [1] https://www.ssa.gov/history/hfaq.html https://www.ssa.gov/history/hfaq.html
    - marcosdumay 10y ago
      If the government issues a number for each citizen, it will be used for identification. The same way that government debit will be used as money. Lawering it away is like making gravity illegal. The only way to stop the practice is issuing a more convenient identification.
ourmandave 10y ago
Haven't we moved on from pretending SSNs are secret or useful in any way? Now there's two factor authentication ("what's your favorite color?"), etc. When I read that The Hackers have my SSN again I'm not really that worried having lost count. But if we had a Federally issued Secure ID, when (not if) that got hacked I would worry a lot.
- JadeNB 10y ago
  > Now there's two factor authentication ("what's your favorite color?") Not so great an example of secret information …. TFA is useless, I think, unless you are allowed to pick the question. (Or, of course, you can give site-specific nonsense answers to repeated questions, but most people don't do that.)
  - WorldMaker 10y ago
    "Secret questions" are almost always not two factor, they are "Wish It Was Two Factor". The two factors are supposed to be: something only you know (a password) and something only you have (a physical key or device you keep with you). Secret questions are still just something you know, therefore not a second factor from passwords. Secret questions are often worse than two factor because they also violate the "only you" part of the security factors by often asking mostly the equivalents of public record information making them generally only about as useful as tertiary usernames/IDs. (Which is why the advice these days is to treat them as passwords and give them pseudo-randomized phrases, unconnected to actual answers of the stated question.)
    - JadeNB 10y ago
      > "Secret questions" are almost always not two factor, they are "Wish It Was Two Factor". You are right. I was going along with what I perceived as my parent (https://news.ycombinator.com/item?id=12509768 https://news.ycombinator.com/item?id=12509768 )'s identification of 'secret' questions with TFA, but I shouldn't have. Thank you for the correction. (Also, although surely there aren't many such people around here, for anyone who doesn't get your reference: http://thedailywtf.com/articles/WishItWas-TwoFactor- http://thedailywtf.com/articles/WishItWas-TwoFactor- .)
simbalion 10y ago
The author is really late to this particular party. https://replacethessn.xyz/ https://replacethessn.xyz/
cloudjacker 10y ago
The ironically named Federal government should just finish subjugating the states , completely, so that these silly idiosyncrasies stop existing We would be better off if we stopped pretending there is any form of federalism here as the states contribute nothing to the aggregate whims of the national government as it continues to tolerate their mentally challenged courts, useless evolving body of opaque case law, and patch work of redundant executive departments. Literally the only things states do is adversely affect interstate commerce. The national government has complete leverage over every state, and will just as well sanction any one financially just as fast as it would sanction a foreign nation state, when it becomes interested in an outcome such that the 10th amendment is null and moot. The consequences, politically, are very minimal, as these bankrupt states are reliant on the teet of the national government that long ago granted itself the authority to regulate all nuances everywhere.
alkonaut 10y ago
How about just make the SSN a proper national ID, issue everyone with proper photo + SSN Id cards? The SSN is a username, not a secret password. I fail to see how it can be more of a privacy concern that authorities (or other people) know your SSN, than that they know your middle name?
norea-armozel 10y ago
I really wish we would just standardize identification in the US but it's likely that such a standardization will result in 50 "standards" which don't talk to each other and are vulnerable to all kinds of attacks. I say this mostly because I've seen some of the crap that passes for IT in my home state (Kansas). And it's a mess. I can only imagine it gets worse the bigger the state government.
deleted 10y ago
[deleted]

114 points by endswapper 10y ago

I don't understand how people can pretend that a SSN isn't a national ID number. Of course it is. If a state wants to show that it isn't, then make changes that make the number unsuited to being a national ID number. Let people pick their own number or reduce it to a 4 digit number.

MichaelGG 10y ago
It's federal isn't it? So it wouldn't be up to the state. I'd want to read the actual decision because on face value, this seems ridiculous. Basically every agency can just get around the Privacy Act saying "uh child support!". It should be up to the child support or taxation authorities to go around and find people not paying and deal with them appropriately. Unfortunately, especially with people used to modern databases, I don't think many people are used to thinking that the government's job should sometimes be a bit more difficult.
- fredgrott 10y ago
  Yes, it would be up to the state.. LOOK AT YOUR DL from your state, does it show your SSN? In some USA States we still can have our SSN not listed on our DL in some other states we cannot
  - logfromblammo 10y ago
    In the states where the DL number is not identical to the SSN, it may still be possible to reconstruct the SSN from the DL number. The SSN may also be encoded in the 2D barcode on the back, without appearing on the face. There may be a few states that have to query a central database in order to link a DL number to a SSN. But rest assured that every state will attempt to maintain such a link, and will sell access to it for the right price. That's why you should treat every request for your driver's license number as a request for your social security number, even though it is probably not governed by the privacy protection laws as it might be if the request was for a SSN directly.
    - FT_intern 10y ago
      Do you have sources on this? I remember doing research on this and concluding that most states phased out basing driver's license numbers on SSNs
      - jandrese 10y ago
        I thought it was a provision of the RealID act that states couldn't use your SSN as your driver's license number anymore. IMHO, the idea that it's a secret number has been shot for years now. Fretting over who can find your SSN is pointless because the answer is anybody. It's ok as long as you don't give any special privileges to someone just because they know another person's SSN. It's no more special than your full name.
        logfromblammo 10y ago
        I'm not entirely certain whether all states have decided to comply with the requirements of RealID for their drivers' licenses. Last time I checked, there were still some holdouts, but that was quite some time ago.
  - smhenderson 10y ago
    Mine's not listed on my DL but I did have to give it to DOT when I received my license. Well, I didn't _have_ to; the gentleman asked me for a single proof of residence and my SSN. When I said "I don't want to give out my SSN, you can't ask for that as ID" he replied, "yes, you're correct. In that case I'll need three proof of residence documents from this list and two identification documents from this other list". I had a passport, a mortgage and a phone bill so I just caved and gave him my SSN.
- criddell 10y ago
  > It's federal isn't it? Of course. You're right. My point still stands though. It is a federal ID number and I don't really get the opposition to it (other than the religious objection). If the feds want to deny that it's an ID number, they should take steps to ensure that no number is linked to a single individual.
  - sverige 10y ago
    > I don't really get the opposition to it (other than the religious objection). Read some history of how national ID was used and abused by Nazi Germany and Soviet Russia to find reasons other than (but also including) religion as the basis for objection.
    - criddell 10y ago
      Sure, but we are so far beyond what was available 1930's and 1940's already, what's the problem with the bar association seeing your SSN? There's no going back now and even if we could, I'm not sure we should. My big objections with SSN is that they are a quasi-secret thing. They are the key to so many things yet they really are public.
moron4hire 10y ago
SSNs are not unique.
- deathanatos 10y ago
  In what sense? They're only ever assigned to a single individual, and they are not reused[1]. The number uniquely IDs the individual. The Wikipedia article makes the same point as the parent poster: "the Social Security number has become a de facto national identification number". [1]: https://en.wikipedia.org/wiki/Social_Security_number#Exhaustion_and_re-use https://en.wikipedia.org/wiki/Social_Security_number#Exhaust...
  - cjg 10y ago
    At least in the sense that there's no 1-1 mapping from SSNs to individuals. http://www.witn.com/home/headlines/Duplicate__111371029.html http://www.witn.com/home/headlines/Duplicate__111371029.html
    - divbit 10y ago
      nitpick: based on the example you linked, you probably mean 1-1 in the opposite direction, or something like, "no well-defined function" in that direction.
  - Spooky23 10y ago
    That's a technically accurate, but weasely answer from the SSA. Realistically, there are many loopholes and exceptions. - People born in various New England states have social security number overlap with number ranges issued by the social security systems in Micronesia, Palau and the Marshall islands. Those territories get services from Federal programs which causes issues. - EINs and SSNs are issued by different departments and can overlap. People in various scenarios will provide the number in the wrong context. - Millions of people use the wrong SSN without fraudulent intent. - People frequently and fraudulently use the SSNs of children and older people. - Hundreds of thousands/low millions of people have multiple valid SSNs. - 40,000 people used a real SSN included as a sample in a wallet in the 1930's. - Some populations have a higher incidence of mistakes, fraud, multiple valid SSNs or other problems. One dataset that I was acquainted with had IIRC a 7% known exception rate for SSNs.
nxzero 10y ago
ID fraud already makes a lot of SSN non-unique; one in seven SSN has been used more than once, though the SSA doesn't report this to the owner of the SSN.
morganvachon 10y ago
It's not only your SSN that is a national ID number, thanks to the Real ID Act your driver's license/state ID number is your true national ID number. At least, that was the plan, but literally half the states and territories are holding out and stalling it, so the SSN continues to be that default ID number for anything federal. I don't know which is worse: The cock-up that is the Real ID Act or the stupidity surrounding the SSN being a de facto ID number for anything and everything.

libeclipse 10y ago

How is it decided if one law supersedes another? It seems pretty strange to have contradicting laws, especially since the federal privacy act is very broad in its statement.

sbuttgereit 10y ago
Given the volume of law that we have, it's not surprising at all that there are laws which contradict other laws. Decisions of which law supersedes another are more often than not up to judges, and sometimes juries, in cases like this. Other laws can be written which try to settle the questions, too, but by and large it's the court cases which settle precedent. This is why who gets to be a judge is such an important question. At the end of the day, the decisions of individual people who are judges can hold an incredible amount of power... and so long as their decisions are well reasoned (or well rationalized)... they can determine how we can live (or not live) our lives. (edited for clarity)
razwall 10y ago
In general, a more specific law trumps a more general law, and a later law trumps an earlier enacted law. So the more specific rule of "States may ask for SSN's for tax purposes" would override the general rule of "States may not ask for SSN's". And the exception was presumably enacted after the general rule, since otherwise there would have been no need to make an exception.
flubert 10y ago
>It seems pretty strange to have contradicting laws I think you might enjoy: THE MYTH OF THE RULE OF LAW http://faculty.msb.edu/hasnasj/GTWebSite/MythWeb.htm http://faculty.msb.edu/hasnasj/GTWebSite/MythWeb.htm
nkrisc 10y ago
This is one of the reasons we (the U.S.) have judges and an appeals process. The legislature can then also act to clarify the laws such that they work in harmony or repeal one of the conflicting ones.

pravda 10y ago

In some states, you have to give your SSN to get a driver's licence.

protomyth 10y ago
North Dakota once used the SSN as the driver's license number. That's been corrected.

InclinedPlane 10y ago

What's fun about SSNs is that proof of them having been leaked isn't sufficient to get a new one, you have to become the victim of fraud based on your SSN having leaked to get a replacement.

deleted 10y ago
[deleted]
jdmichal 10y ago
Honestly, that's somewhat understandable. Otherwise, there would be plenty of advice that you should rotate your SSN every year, just in case... While that would be an ideal final state, in our current state that's probably not a great idea. I suppose ideal final state would be some combination of a cryptographic certificate and a rotating security token ala RSA SecurID. The token is enough to verify that you possess the certificate, but has no unique value in-and-of itself.
- InclinedPlane 10y ago
  Right. But remember, this applies to cases where you can prove that your SSN has been stolen, which isn't enough to get a new one (if it were about 2/3 of Americans would be able to get one, most likely). The big problem is that the SSN is completely, utterly a bad idea in the 21st century, but nobody is working on a superior replacement because things aren't "that bad yet".
pmoney 10y ago
And even then, proof of fraudulent activity does not guarantee the issuance of a new number. It's a case-by-case basis.

danso 10y ago

I wonder how much of the desire to hang on to SSN as a private identifier is rooted in the fact that SSN's contain a bit of personal data. Until 1972, the first 3 digits represented where you were born or where the card was issued. Afterwards they represent the mailing address for the application for the card. And because of that design decision, some states were fairly close to running out of SSNs: https://www.ssa.gov/policy/docs/ssb/v69n2/v69n2p55.html https://www.ssa.gov/policy/docs/ssb/v69n2/v69n2p55.html Today, SSNs are randomized: https://www.ssa.gov/employer/randomization.html https://www.ssa.gov/employer/randomization.html Considering the numbering system was created in the 1930s, their idea of what constitutes a unique, private (i.e. hard to remember) number is a bit less relevant today.

mindslight 10y ago
IMHO it's just about trying to hold onto it being less generally useful, as was initially promised. The government pulled the same "limited scope" bullshit they did for all the recent "terrorism" "laws". Enumerating and precisely identifying citizens is the basis of mass surveillance. For most every societal use, a name and a birthday is good enough identification. Individuals should not be perfectly legible to the government, because then the rulers are further tempted into demanding that reality conform to their whims. Of course now that government-cum-computer has entrenched and precessed, there are many areas where precise identification will help preserve one's rights. If one shared a name and birthdate with a wanted criminal, they certainly would want to be distinguishable! But such situations are really due to the system asserting that its abstractions are airtight. For example if someone applies for credit in my name, the crime that has occurred is fraud and I am not involved. But the system (within-abstraction) diagnoses the situation as me being a victim of "identity theft", transferring blame to the individuals affected by its own shortcomings! Further cementing the abstractions further strengthens belief in them, making these failure modes even harsher. Another practical problem in the US is that the government fails to prohibit the use of such identifiers for private purposes, under a half-applied theory of private contract (or really just money talks). So we end up with the double-edged sword of the free market combined with a government mandate, which destroys individuals' sole power of exit versus otherwise unaccountable corporate entities.

quotemstr 10y ago

The entire SSN system is a disgrace. We've had the cryptographic tools for decades to do it right, but we instead treat SSNs as both identifier and some sort of awful bearer token. In any sane system, knowing an actor's precise identity should not permit impersonating that actor!

jimktrains2 10y ago
I always wondered why we didn't at least have a "full access" number the user would never shared but on their taxes, a "write only" number to give employers, and a "read only" number for background checks, banks, &c.
- blacksmith_tb 10y ago
  Ideally I'd think the private (key) version wouldn't be human-readable at all, you'd need to physically possess the card to use it, while the public number could be carelessly used like we do SSNs now...
  - deleted 10y ago
    [deleted]
  - jimktrains2 10y ago
    Sure, but I was thinking of something that could have been implemented 50 years ago.
- dv_dt 10y ago
  I would suspect it's because there's a certain political segment that stands in the way of improving programs for which they would prefer would just be ended.
  - jdminhbg 10y ago
    The political segment of the US that would like Social Security to just be ended is statistically equivalent to zero people.

protomyth 10y ago

I wonder if it would be possible to have private, certified identity providers for people.

ceejayoz 10y ago
Notaries public?
- protomyth 10y ago
  I mean more in the sense of issuing an acceptable id number. It would probably be a stretch to get a Notaries public to do that.
deleted 10y ago
[deleted]

jedberg 10y ago

Anyone who thinks an SSN is a secret is naive at best. Back in the day, your student ID at California State schools was your SSN. It was on your ID card, which you had to present to do anything at the school.

cgusto 10y ago
Wasn't even that long ago. In 2006, the CSU I was at still used your SSN for everything - including logging into the computers. This particular school has since changed this, but I wouldn't be surprised if the practice is still used elsewhere.
- jedberg 10y ago
  Wow. I know at CSULA it was SSNs in the early 90s, but they were already phasing it out.
undersuit 10y ago
Montana, and I bet a number of other states, used to use the SSN as part of your driver license number.

etjossem 10y ago

> "The whole point of the federal privacy law is to prevent states from making the Social Security number into a nationally mandated identification number of the kind that’s common in Europe. The practice goes back to the immediate post-World War II era, when Sweden became the first country to assign every citizen a personal identity number that follows you throughout your life and must be used in essentially every interaction with state. Every Swede memorizes the number in childhood. And notably, the tax authority makes everyone’s number publicly available to anyone who asks for it." This wouldn't be a bad thing if we didn't also use the SSN as proof of identity. Numbers as "usernames" for individuals are fine. But they should not also serve as "passwords." That particular cat is already out of the bag. The list of people who know or have access to your social security number includes dozens of bank personnel, medical professionals, standardized testing agencies, previous employers, and government employees. It is entirely possible for malicious actors, given any other personal identifier (a unique full name, or any full name plus address), to find the associated social security number. We simply cannot expect any SSN - let alone its last 4 digits - to be known only by the person to which it was issued.

bsimpson 10y ago
For many people, the last 4 digits are the only ones that aren't easily deduced if you know the city a person was born in and the person's approximate birthdate.
- etjossem 10y ago
  And for this reason, many SSN verifiers (banks, government agencies, etc) ask for the last 4 digits. Then they store them in a dusty database somewhere and forget about them until they have to verify identity again, or there's a major breach. That last part is the part that keeps me up at night.
  - Iv 10y ago
    Even if they didn't, given the number of state-level administrations, I am sure I can get close to the 9999 attempts I need to brute force a code. I wonder how many automated attempts are possible.

int_19h 10y ago

The opposition to the national ID in US is really, really weird. Especially when it comes from many of the same people who insist on photo ID when voting, because they're afraid of non-citizens going to vote. Since the federal government is the one that keeps track of things such as immigration status, it stands to reason that it should be the one issuing IDs that are used for voting purposes - and at that point you might as well use it for everything else. And, of course, SSNs are already a de facto national ID system. It just happens to be one that wasn't designed for ID purposes, and so it's very suboptimal (but any government abuses you could do with a proper ID, you can also do with SSN).

deleted 10y ago
[deleted]
mturmon 10y ago
Opposition to using the SSN as an identifier started out as a privacy thing. It's also the reason that the Social Security Card itself is so flimsy and bare-bones. They did not want it to become a national ID card. I used to respect this, but as time has passed, I think crooks and scammers get more benefit out of the lack of ID than most of the public gets out of these rudimentary guards. Anyone remotely serious (nation-states and bigcorps) can ID me if they want.
- PhantomGremlin 10y ago
  They did not want it to become a national ID card. I laminated my card because it was flimsy. It's still OK over 40 years later. My card has the following words on it: FOR SOCIAL SECURITY AND TAX PURPOSES -- NOT FOR IDENTIFICATION time has passed Yes you are right. That ship sailed way back in 1972 when the SSA removed those words.[1] [1] https://www.ssa.gov/history/hfaq.html https://www.ssa.gov/history/hfaq.html
  - marcosdumay 10y ago
    If the government issues a number for each citizen, it will be used for identification. The same way that government debit will be used as money. Lawering it away is like making gravity illegal. The only way to stop the practice is issuing a more convenient identification.

ourmandave 10y ago

Haven't we moved on from pretending SSNs are secret or useful in any way? Now there's two factor authentication ("what's your favorite color?"), etc. When I read that The Hackers have my SSN again I'm not really that worried having lost count. But if we had a Federally issued Secure ID, when (not if) that got hacked I would worry a lot.

JadeNB 10y ago
> Now there's two factor authentication ("what's your favorite color?") Not so great an example of secret information …. TFA is useless, I think, unless you are allowed to pick the question. (Or, of course, you can give site-specific nonsense answers to repeated questions, but most people don't do that.)
- WorldMaker 10y ago
  "Secret questions" are almost always not two factor, they are "Wish It Was Two Factor". The two factors are supposed to be: something only you know (a password) and something only you have (a physical key or device you keep with you). Secret questions are still just something you know, therefore not a second factor from passwords. Secret questions are often worse than two factor because they also violate the "only you" part of the security factors by often asking mostly the equivalents of public record information making them generally only about as useful as tertiary usernames/IDs. (Which is why the advice these days is to treat them as passwords and give them pseudo-randomized phrases, unconnected to actual answers of the stated question.)
  - JadeNB 10y ago
    > "Secret questions" are almost always not two factor, they are "Wish It Was Two Factor". You are right. I was going along with what I perceived as my parent (https://news.ycombinator.com/item?id=12509768 https://news.ycombinator.com/item?id=12509768 )'s identification of 'secret' questions with TFA, but I shouldn't have. Thank you for the correction. (Also, although surely there aren't many such people around here, for anyone who doesn't get your reference: http://thedailywtf.com/articles/WishItWas-TwoFactor- http://thedailywtf.com/articles/WishItWas-TwoFactor- .)

simbalion 10y ago

The author is really late to this particular party. https://replacethessn.xyz/ https://replacethessn.xyz/

cloudjacker 10y ago

The ironically named Federal government should just finish subjugating the states , completely, so that these silly idiosyncrasies stop existing We would be better off if we stopped pretending there is any form of federalism here as the states contribute nothing to the aggregate whims of the national government as it continues to tolerate their mentally challenged courts, useless evolving body of opaque case law, and patch work of redundant executive departments. Literally the only things states do is adversely affect interstate commerce. The national government has complete leverage over every state, and will just as well sanction any one financially just as fast as it would sanction a foreign nation state, when it becomes interested in an outcome such that the 10th amendment is null and moot. The consequences, politically, are very minimal, as these bankrupt states are reliant on the teet of the national government that long ago granted itself the authority to regulate all nuances everywhere.

alkonaut 10y ago

How about just make the SSN a proper national ID, issue everyone with proper photo + SSN Id cards? The SSN is a username, not a secret password. I fail to see how it can be more of a privacy concern that authorities (or other people) know your SSN, than that they know your middle name?

norea-armozel 10y ago

I really wish we would just standardize identification in the US but it's likely that such a standardization will result in 50 "standards" which don't talk to each other and are vulnerable to all kinds of attacks. I say this mostly because I've seen some of the crap that passes for IT in my home state (Kansas). And it's a mess. I can only imagine it gets worse the bigger the state government.

deleted 10y ago

[deleted]