11 ms·

A year ago, a university that I never even applied to sent me a letter saying that my Social Security Number was among the data that was stolen in a hack. (The

A year ago, a university that I never even applied to sent me a letter saying that my Social Security Number was among the data that was stolen in a hack. (They offered a year of free "monitoring" and yes, I checked to see that it was a real event and not a phishing attempt.) Apparently a decade ago when I took the ACT, I gave the testing company my SSN. I listed this university as one to send my scores to for free. Apparently the ACT company not only gave them my scores but my SSN as well. On top of that, the university held on to my SSN for years after it was clear that I was never going to apply there. Of course now as an adult, I know better not to give out my SSN, but many others do not. Until companies see that holding on to personal information is a liability rather than an asset, nothing is going to change.

maxerickson 10y ago
SSNs just shouldn't be sensitive information. (it's great if we get organizations not to hold onto personal information too, but at the level of society, the harm due to identity fraud is largely self-inflicted, we choose to allow organizations that fail to do reasonable diligence to push consequences onto individuals)
- IndianAstronaut 10y ago
  There are hundreds of individuals at my financial services company that have access to millions of social security numbers. Very easy for that information to leak out.
- dublinben 10y ago
  Exactly, the cat is out of the bag. It's time we stopped treating an SSN as a magic key that grants any kind of significant access.
  - 1121redblackgo 10y ago
    Yup, in the same way that guns are out of the bag in the us. What do we do to limit the threat to the public at large? The solutions may seem like band-aids but they may be the best that we have.
    - grzm 10y ago
      the same way that guns are out of the bag This adds nothing to your comment. Please don't inject flamewar topics into a thread.
      - 1121redblackgo 10y ago
        Whoa. It's a metaphor, maybe a sensitive one, but one nonetheless. "Please don't inject flamewar topics into a thread." --> I think your comment is off the mark. A 'flamewar' is not my intention at all.
      - mikestew 10y ago
        And this comment adds nothing to the conversation except as an example over-zealous wannabe moderation. No one's injecting anything, it was a literary tool called a metaphor. Personally, I thought it a clever parallel.
- 69mlgsniperdad 10y ago
  If you desensitize the SSN, you are in effect granting near public access to a national database of all citizens, no? If you desensitize them, would it be an infringement on ones current rights if all state and local police and other law enforcement had access to a 3rd party collection of this national uniquely binding and certain form of id? Also, it would require a massive overhaul of credit dispersement, as well as the background check industry and many other systems. A much larger overhaul is required, if steps are not soon taken to formally regulate and monitor the storage and transfer of ssn's.
rdtsc 10y ago
I was in a school like that which used SSN as primary identifiers. That means tests scores, homeworks, papers all around campus and trash bins with everyone's SSNs easy to see. By the time I left they started to wise up and switched using a separate ID, but it took them way too long.
- kakarot 10y ago
  I went to a school once that had only just gotten a computer system. Our usernames? First initial, then full last name, then the first 4 digits of your social. The password? ...the last 5 digits of your social. I was horrified. Not a single administrator saw this as a problem.
69mlgsniperdad 10y ago
One of the biggest issues is they are not held accountable by any agency or law. For name, address, and social security number, there is no official regulation as to how they must be stored. For credit card data, there is the pci security standards. Which often subject institutions who choose to store payment information, to audits, as well as fines for violation. There still is no such standard for other personal information, SSN included.

maxerickson 10y ago

SSNs just shouldn't be sensitive information. (it's great if we get organizations not to hold onto personal information too, but at the level of society, the harm due to identity fraud is largely self-inflicted, we choose to allow organizations that fail to do reasonable diligence to push consequences onto individuals)

IndianAstronaut 10y ago
There are hundreds of individuals at my financial services company that have access to millions of social security numbers. Very easy for that information to leak out.
dublinben 10y ago
Exactly, the cat is out of the bag. It's time we stopped treating an SSN as a magic key that grants any kind of significant access.
- 1121redblackgo 10y ago
  Yup, in the same way that guns are out of the bag in the us. What do we do to limit the threat to the public at large? The solutions may seem like band-aids but they may be the best that we have.
  - grzm 10y ago
    the same way that guns are out of the bag This adds nothing to your comment. Please don't inject flamewar topics into a thread.
    - 1121redblackgo 10y ago
      Whoa. It's a metaphor, maybe a sensitive one, but one nonetheless. "Please don't inject flamewar topics into a thread." --> I think your comment is off the mark. A 'flamewar' is not my intention at all.
    - mikestew 10y ago
      And this comment adds nothing to the conversation except as an example over-zealous wannabe moderation. No one's injecting anything, it was a literary tool called a metaphor. Personally, I thought it a clever parallel.
69mlgsniperdad 10y ago
If you desensitize the SSN, you are in effect granting near public access to a national database of all citizens, no? If you desensitize them, would it be an infringement on ones current rights if all state and local police and other law enforcement had access to a 3rd party collection of this national uniquely binding and certain form of id? Also, it would require a massive overhaul of credit dispersement, as well as the background check industry and many other systems. A much larger overhaul is required, if steps are not soon taken to formally regulate and monitor the storage and transfer of ssn's.

rdtsc 10y ago

I was in a school like that which used SSN as primary identifiers. That means tests scores, homeworks, papers all around campus and trash bins with everyone's SSNs easy to see. By the time I left they started to wise up and switched using a separate ID, but it took them way too long.

kakarot 10y ago
I went to a school once that had only just gotten a computer system. Our usernames? First initial, then full last name, then the first 4 digits of your social. The password? ...the last 5 digits of your social. I was horrified. Not a single administrator saw this as a problem.

69mlgsniperdad 10y ago

One of the biggest issues is they are not held accountable by any agency or law. For name, address, and social security number, there is no official regulation as to how they must be stored. For credit card data, there is the pci security standards. Which often subject institutions who choose to store payment information, to audits, as well as fines for violation. There still is no such standard for other personal information, SSN included.