7 ms·

> approximately 143 million U.S. consumers. This was only a matter of time. We can rotate credit card numbers, but sadly not a SSN. I wish I could rotate my US

> approximately 143 million U.S. consumers. This was only a matter of time. We can rotate credit card numbers, but sadly not a SSN. I wish I could rotate my US social security number when significant exposure happens (this would be the 4th or 5th time in 24 months my data has been exposed). Assuming legislation passed that allowed you to cancel an exposed SSN and get a new one, what would it take for that to happen? Surely it's not just the one agency (SSA) that would need to make the change, but multiple agencies would need to coordinate the change? (And of course, I would be personally responsible for informing my banks, brokerages, loan agencies, etc of my new SSN) Does anyone have insight into how this could work?

tyingq 9y ago
So half the US population? Ugh.
- Balgair 9y ago
  It's about 2/3rds of 'working' Americans.
shubb 9y ago
It sounds like ssn is not fit for purpose. If the gov is going to issue a 'secret number ' why not a 2fa device?
- xur17 9y ago
  I really wish they would issue something like this. Or put a smartcard in my driver's license (I'm sure there are privacy implications to this though).
  - maxerickson 9y ago
    Even the level of standardization proposed for Real ID was met with enormous push back. The long term solution is to figure out how to make financial companies feel the pain of fraudulent accounts. Like maybe when they open an account without doing a sufficient level of verification they should have to pay the victim of the fraud $5000 (in addition to covering any damages they cause).
    - losteric 9y ago
      Plus stronger regulation of how data is stored. Personal information is valuable - banks have security requirements, why not institutions like this?
- SomeStupidPoint 9y ago
  The real problem is that SSNs are used double-duty as an identifier and authentication mechanism. This has been predictably bad for security.
- ceejayoz 9y ago
  Estonia does this. https://en.wikipedia.org/wiki/Estonian_ID_card https://en.wikipedia.org/wiki/Estonian_ID_card
- alehul 9y ago
  The SSN was never intended as a national ID. It was originally created alongside the Social Security Administration, to track what individuals put in and what they take out. People only received one upon becoming employed. Over time, the IRS realized that it could be used as a national ID, and adopted it for that purpose. They encouraged people to obtain one from a young age (even for their newborn children), and it was used to replace the original 'honor system' of 'How many children do you have?' tax discounts; now they'd need to register their child with a SSN. Companies eventually began piggybacking on the number as a national identifier (due to our lack of one), and voila. We're left with an awfully insecure identification system that shouldn't be an identification system for much in the first place. For anyone interested in more: https://www.youtube.com/watch?v=Erp8IAUouus https://www.youtube.com/watch?v=Erp8IAUouus, and the sources below the video.
  - Pyxl101 9y ago
    Not only was SSN not intended to be a national id, it was explicitly not supposed to be a national id. In the era when SSN was established, Nazi Germany and its emphasis on "papers, please" was on the public's mind. SSN was intended to be used solely for tax purposes, not as a form of national identity. There were legal constraints on when government agencies can even ask for SSN, limited to legitimate tax purposes. Sadly, these protections have been whittled down over time: https://www.bloomberg.com/view/articles/2016-09-15/this-loophole-ends-the-privacy-of-social-security-numbers https://www.bloomberg.com/view/articles/2016-09-15/this-loop... > Federal law is supposed to protect the privacy of your Social Security number from government inquiries -- but apparently that doesn’t extend to a check on whether you’ve paid back taxes and child support. In a decision with worrying implications for those who oppose a single national identification number, a divided federal appeals court has rejected a lawyer’s refusal to submit his Social Security number along with his renewal of Maryland bar membership. > The state says it needs Social Security numbers to make sure lawyers’ child support and taxes are up to date. The court’s majority said that was enough to fit the Social Security number under the federal law that allows states to use your number for tax purposes. That definition is so loose that it enables states to ask for your Social Security number pretty much whenever they want -- even when their records have been hacked. Really, the government should make it possible for citizens to create an arbitrary number of different tax ids (SSNs), as many as they want. One for every firm they do business with, one for every employer, and so on.
- dragonwriter 9y ago
  The SSN is not issued by government as a secret number, but a necessarily-shared number between you, government agencies, employers, financial institutions, and many other parties. The error is that many of the parties with which it must be shared treat it (for authentication purposes) as if it were a shared secret between that party and you (though they often don't do so for security purposes—and, as they often must share it with certain third parties, sometimes cannot do so) even though it is known to be a widely-shared non-secret.
- rocqua 9y ago
  SSNs were expressly intended not to be used as identification or authentication. Thing is, there was not alternative that people were guaranteed to have. I get it on principle, we don't like government giving us tracking numbers. It just seems totally impractical not to have this though.
- SAI_Peregrinus 9y ago
  Public-key crypto has been around since the late 1970s. Smart cards have been around since the 1990s. Two decades is nowhere near enough time for these sorts of changes to go through, you have to wait for all the past generation's lawmakers to retire/die and be replaced. Getting financial institutions to adopt new things that don't directly make them money is even harder.
zeta0134 9y ago
I think the true error in process is that a SSN is considered to be a secret, unique ID, and many (many!) institutions allow you to use it as a proof of identity. It's short, guessable, would fail all of their own password requirements, and yet somehow it gets a free pass. I just consider my SSN to be public, and move about my digital life with that assumption. I don't go plastering it on walls, but if I encounter a business or process that uses by SSN instead of proper two-factor authentication (...a large number of credit-based companies and financial institutions, sadly) my trust in them simply plummets, the same as it would for the login I use on less secure forum sites.
- eterm 9y ago
  Exactly. In the UK we have a National Insurance number, but it's stated over and over again that: This is not proof of identity. Anywhere it is referenced it is repeated that it should not be used as proof of identity and not given to anyone as such. SSNs should be treated the same way, but that would require a culture change. Perhaps having 150m of them 'leaked' will bring about that change. Such a change could also be brought about through legislation making it not legal to ask for SSN as proof of ID (i.e. can only ask for SSN when required for the purposes it is intended for), but legislating such things is likely even further from your culture.
  - noja 9y ago
    > This is not proof of identity. What is it then? I've seen it used as a quasi-password by car hire companies to access driving license history.
    - maxerickson 9y ago
      They can use it as a key to the database without treating it as proof of identity. (I don't know that they do, it's just that the one doesn't necessarily follow from the other)
    - DINKDINK 9y ago
      >What is it then? It is the username you are issued by the government. It is solely used to identify you.
andirk 9y ago
I believe you CAN change your SSN https://faq.ssa.gov/link/portal/34011/34019/article/3789/can-i-change-my-social-security-number https://faq.ssa.gov/link/portal/34011/34019/article/3789/can... . Especially if you have "cultural objections to certain numbers".
- ceejayoz 9y ago
  You can, but in very specific cases. The "cultural objections" bit requires documentation from a legitimate religious organization - you can't just say 123-45-6789 is the mark of Satan.
  - duncan_bayne 9y ago
    > legitimate religious organization I've seen variations on this for exemption from educational requirements, ID requirements, medical requirements, and the like. It's always struck me as odd that one _can't_ give as a reason "I have rationally concluded, based on the evidence I present here, that I will take X course of action." But one _can_ say "I have been advised to take X course of action by a group of people who pinky-promise that they are authorised representatives of a sky fairy who suggested X to a hallucinating man several thousand years ago."
  - tripzilch 9y ago
    > you can't just say 123-45-6789 is the mark of Satan Obviously you can't say it out loud, because you might evoke the wrath of the Old Ones. Additionally, you can just engrave the surface your ID-card with the correct symbols in charcoal, a salted circle (actual salt, not the cryptographic kind), maybe some blood, and you should really be fine for most practical purposes. I mean, this is not the Middle Ages any more. You can just Google this stuff.
elipsey 9y ago
Requiring better proof of identity would create friction to consumer credit transactions.
- PeterisP 9y ago
  Yes it would, and that (the extra friction) is exactly what should be done to fix the identity theft problem. It's far too easy to get credit in your name, so easy that it can be done by others. But the change won't happen by itself unless a shift of liability away from the users makes it so that every company doing anything on credit sees that it obviously makes business sense for them to implement the extra friction (and suffer from it) because otherwise they are paying out money to fraudsters instead of trying to collect that from the impersonated people.
  - elipsey 9y ago
    Sorry, what I meant was: that's not happening because the status quo is better for the people who make the rules. :)
- gaius 9y ago
  Well, good. People buy too much junk anyway - having to jump through a hoop or two to do it would make people think - do I really need this?
ericd 9y ago
If only someone could invent a way to verify their identity without sharing their secret key... But in all seriousness, we need to find ways to make real identity authentication user friendly, a la Yubikey, and then drive companies to replace this insane SSN-based system.

tyingq 9y ago

So half the US population? Ugh.

Balgair 9y ago
It's about 2/3rds of 'working' Americans.

shubb 9y ago

It sounds like ssn is not fit for purpose. If the gov is going to issue a 'secret number ' why not a 2fa device?

xur17 9y ago
I really wish they would issue something like this. Or put a smartcard in my driver's license (I'm sure there are privacy implications to this though).
- maxerickson 9y ago
  Even the level of standardization proposed for Real ID was met with enormous push back. The long term solution is to figure out how to make financial companies feel the pain of fraudulent accounts. Like maybe when they open an account without doing a sufficient level of verification they should have to pay the victim of the fraud $5000 (in addition to covering any damages they cause).
  - losteric 9y ago
    Plus stronger regulation of how data is stored. Personal information is valuable - banks have security requirements, why not institutions like this?
SomeStupidPoint 9y ago
The real problem is that SSNs are used double-duty as an identifier and authentication mechanism. This has been predictably bad for security.
ceejayoz 9y ago
Estonia does this. https://en.wikipedia.org/wiki/Estonian_ID_card https://en.wikipedia.org/wiki/Estonian_ID_card
alehul 9y ago
The SSN was never intended as a national ID. It was originally created alongside the Social Security Administration, to track what individuals put in and what they take out. People only received one upon becoming employed. Over time, the IRS realized that it could be used as a national ID, and adopted it for that purpose. They encouraged people to obtain one from a young age (even for their newborn children), and it was used to replace the original 'honor system' of 'How many children do you have?' tax discounts; now they'd need to register their child with a SSN. Companies eventually began piggybacking on the number as a national identifier (due to our lack of one), and voila. We're left with an awfully insecure identification system that shouldn't be an identification system for much in the first place. For anyone interested in more: https://www.youtube.com/watch?v=Erp8IAUouus https://www.youtube.com/watch?v=Erp8IAUouus, and the sources below the video.
- Pyxl101 9y ago
  Not only was SSN not intended to be a national id, it was explicitly not supposed to be a national id. In the era when SSN was established, Nazi Germany and its emphasis on "papers, please" was on the public's mind. SSN was intended to be used solely for tax purposes, not as a form of national identity. There were legal constraints on when government agencies can even ask for SSN, limited to legitimate tax purposes. Sadly, these protections have been whittled down over time: https://www.bloomberg.com/view/articles/2016-09-15/this-loophole-ends-the-privacy-of-social-security-numbers https://www.bloomberg.com/view/articles/2016-09-15/this-loop... > Federal law is supposed to protect the privacy of your Social Security number from government inquiries -- but apparently that doesn’t extend to a check on whether you’ve paid back taxes and child support. In a decision with worrying implications for those who oppose a single national identification number, a divided federal appeals court has rejected a lawyer’s refusal to submit his Social Security number along with his renewal of Maryland bar membership. > The state says it needs Social Security numbers to make sure lawyers’ child support and taxes are up to date. The court’s majority said that was enough to fit the Social Security number under the federal law that allows states to use your number for tax purposes. That definition is so loose that it enables states to ask for your Social Security number pretty much whenever they want -- even when their records have been hacked. Really, the government should make it possible for citizens to create an arbitrary number of different tax ids (SSNs), as many as they want. One for every firm they do business with, one for every employer, and so on.
dragonwriter 9y ago
The SSN is not issued by government as a secret number, but a necessarily-shared number between you, government agencies, employers, financial institutions, and many other parties. The error is that many of the parties with which it must be shared treat it (for authentication purposes) as if it were a shared secret between that party and you (though they often don't do so for security purposes—and, as they often must share it with certain third parties, sometimes cannot do so) even though it is known to be a widely-shared non-secret.
rocqua 9y ago
SSNs were expressly intended not to be used as identification or authentication. Thing is, there was not alternative that people were guaranteed to have. I get it on principle, we don't like government giving us tracking numbers. It just seems totally impractical not to have this though.
SAI_Peregrinus 9y ago
Public-key crypto has been around since the late 1970s. Smart cards have been around since the 1990s. Two decades is nowhere near enough time for these sorts of changes to go through, you have to wait for all the past generation's lawmakers to retire/die and be replaced. Getting financial institutions to adopt new things that don't directly make them money is even harder.

zeta0134 9y ago

I think the true error in process is that a SSN is considered to be a secret, unique ID, and many (many!) institutions allow you to use it as a proof of identity. It's short, guessable, would fail all of their own password requirements, and yet somehow it gets a free pass. I just consider my SSN to be public, and move about my digital life with that assumption. I don't go plastering it on walls, but if I encounter a business or process that uses by SSN instead of proper two-factor authentication (...a large number of credit-based companies and financial institutions, sadly) my trust in them simply plummets, the same as it would for the login I use on less secure forum sites.

eterm 9y ago
Exactly. In the UK we have a National Insurance number, but it's stated over and over again that: This is not proof of identity. Anywhere it is referenced it is repeated that it should not be used as proof of identity and not given to anyone as such. SSNs should be treated the same way, but that would require a culture change. Perhaps having 150m of them 'leaked' will bring about that change. Such a change could also be brought about through legislation making it not legal to ask for SSN as proof of ID (i.e. can only ask for SSN when required for the purposes it is intended for), but legislating such things is likely even further from your culture.
- noja 9y ago
  > This is not proof of identity. What is it then? I've seen it used as a quasi-password by car hire companies to access driving license history.
  - maxerickson 9y ago
    They can use it as a key to the database without treating it as proof of identity. (I don't know that they do, it's just that the one doesn't necessarily follow from the other)
  - DINKDINK 9y ago
    >What is it then? It is the username you are issued by the government. It is solely used to identify you.

andirk 9y ago

I believe you CAN change your SSN https://faq.ssa.gov/link/portal/34011/34019/article/3789/can-i-change-my-social-security-number https://faq.ssa.gov/link/portal/34011/34019/article/3789/can... . Especially if you have "cultural objections to certain numbers".

ceejayoz 9y ago
You can, but in very specific cases. The "cultural objections" bit requires documentation from a legitimate religious organization - you can't just say 123-45-6789 is the mark of Satan.
- duncan_bayne 9y ago
  > legitimate religious organization I've seen variations on this for exemption from educational requirements, ID requirements, medical requirements, and the like. It's always struck me as odd that one _can't_ give as a reason "I have rationally concluded, based on the evidence I present here, that I will take X course of action." But one _can_ say "I have been advised to take X course of action by a group of people who pinky-promise that they are authorised representatives of a sky fairy who suggested X to a hallucinating man several thousand years ago."
- tripzilch 9y ago
  > you can't just say 123-45-6789 is the mark of Satan Obviously you can't say it out loud, because you might evoke the wrath of the Old Ones. Additionally, you can just engrave the surface your ID-card with the correct symbols in charcoal, a salted circle (actual salt, not the cryptographic kind), maybe some blood, and you should really be fine for most practical purposes. I mean, this is not the Middle Ages any more. You can just Google this stuff.

elipsey 9y ago

Requiring better proof of identity would create friction to consumer credit transactions.

PeterisP 9y ago
Yes it would, and that (the extra friction) is exactly what should be done to fix the identity theft problem. It's far too easy to get credit in your name, so easy that it can be done by others. But the change won't happen by itself unless a shift of liability away from the users makes it so that every company doing anything on credit sees that it obviously makes business sense for them to implement the extra friction (and suffer from it) because otherwise they are paying out money to fraudsters instead of trying to collect that from the impersonated people.
- elipsey 9y ago
  Sorry, what I meant was: that's not happening because the status quo is better for the people who make the rules. :)
gaius 9y ago
Well, good. People buy too much junk anyway - having to jump through a hoop or two to do it would make people think - do I really need this?

ericd 9y ago

If only someone could invent a way to verify their identity without sharing their secret key... But in all seriousness, we need to find ways to make real identity authentication user friendly, a la Yubikey, and then drive companies to replace this insane SSN-based system.