6 ms·

I think the true error in process is that a SSN is considered to be a secret, unique ID, and many (many!) institutions allow you to use it as a proof of identit

I think the true error in process is that a SSN is considered to be a secret, unique ID, and many (many!) institutions allow you to use it as a proof of identity. It's short, guessable, would fail all of their own password requirements, and yet somehow it gets a free pass. I just consider my SSN to be public, and move about my digital life with that assumption. I don't go plastering it on walls, but if I encounter a business or process that uses by SSN instead of proper two-factor authentication (...a large number of credit-based companies and financial institutions, sadly) my trust in them simply plummets, the same as it would for the login I use on less secure forum sites.

eterm 9y ago
Exactly. In the UK we have a National Insurance number, but it's stated over and over again that: This is not proof of identity. Anywhere it is referenced it is repeated that it should not be used as proof of identity and not given to anyone as such. SSNs should be treated the same way, but that would require a culture change. Perhaps having 150m of them 'leaked' will bring about that change. Such a change could also be brought about through legislation making it not legal to ask for SSN as proof of ID (i.e. can only ask for SSN when required for the purposes it is intended for), but legislating such things is likely even further from your culture.
- noja 9y ago
  > This is not proof of identity. What is it then? I've seen it used as a quasi-password by car hire companies to access driving license history.
  - maxerickson 9y ago
    They can use it as a key to the database without treating it as proof of identity. (I don't know that they do, it's just that the one doesn't necessarily follow from the other)
  - DINKDINK 9y ago
    >What is it then? It is the username you are issued by the government. It is solely used to identify you.
    - thephyber 9y ago
      > It is solely used to identify you. Not exactly. It's used to map your Social Security account to other records they have about you. It's not, by itself, identification.
    - emodendroket 9y ago
      In practice it is not solely used for that.
  - nightcracker 9y ago
    Do you see that thing above your post? "noja"? That's your identity. Your SSN on Hacker News. What proves that it is you to Hacker News is what you type into the password field when you log in.
    - noja 9y ago
      My username isn't a semi-secret number that I have to guard.
- CamperBob2 9y ago
  Exactly. In the UK we have a National Insurance number, but it's stated over and over again that: This is not proof of identity. Here in the US, our Social Security Act said exactly the same thing. Guess what. It got used as a proof of identity.
  - ensignavenger 9y ago
    Social Security cards used to say they weren't to be used as identification. They took that off because everyone ignored it and did what they wanted to anyway.
- PeterisP 9y ago
  The problem is that you need a replacement, something that can actually be used as a solid proof of identity. The countries that don't have comparable identity theft problems have done so mostly by using an ubiquitous government issued ID that's hard to forge and hard to obtain by someone claiming to be you. In USA there seems to be a strong opposition and a legal barrier for the government to make such an ID. Not much else can be done - a simple test of a decent identity system is to ask if my spouse, mother or brother would be able to impersonate me - it's clear that nothing that relies on "something you know" can ever be sufficient, it must be "something you are", possibly together with "something you have", i.e., biometrics or a trusted photo ID.
  - wtmt 9y ago
    Can you expand on the systems that are "hard to obtain by someone claiming to be you" and biometrics? In my readings, I've found that biometrics is not unique across a large population, it changes over one's life span (which means you wouldn't know when it has changed enough to update the system that stores it), changes with one's profession (like physical labor) and health, and that the error rates across a huge population even for iris scans are quite high. For reference, India has a unique ID called Aadhaar that collects ten fingerprints and two iris scans to deduplicate across 1.3 billion people. It uses flawed technology (relying on a fingerprint for authentication or in very rare cases, an iris scan), insecure devices, and generally has a high failure rate due to poor infrastructure. Combined with poor technology, the privacy and security policies and measures are inadequate too. There have been plenty of personal information leaked in the last few years because of the government's obstinate stand that this ID be linked to everything - phone numbers, tax ID, bank accounts, and many more. I don't think there is any solution, including biometrics, that will work to uniquely and unambiguously identify individuals across large populations. I also see more dangers for the populace with such schemes because submitted biometrics, once compromised, cannot be revoked or reissued (this is how the Aadhaar system works - it stores the biometrics as-is).
    - PeterisP 9y ago
      Biometrics alone aren't sufficient, but they're a reliable way to prevent identity theft if you have a secure record linking the identity to the biometrics - there will be people with similar faces and may be fingerprint matches, but fraudsters aren't going to easily find a thief that happens to look similar to you, match your fingerprints, and forge a document just to get a small loan or some electronics on your credit. The point is that biometrics can't be treated as "something you know", and the system should be designed in a way that these biometrics getting compromised isn't a big problem; I mean, my EU ID card has a chip with my fingerprints on it, but getting a copy of my fingerprints won't really risk "my identity", all they're good for is to prevent someone else using my documents if they steal it even if their face looks similar. Getting such a secure record, though, generally requires a decent level of gov't infrastructure throughout all areas, and can't be built up quickly. Size alone isn't an issue - if it works for half a billion people in EU, then it'd work for a billion people elsewhere, but the infrastructure needs to be there. I.e., you need a population where all or nearly all births have been properly tracked and reliably registered for a long time, so you can't build it faster than decades if it wasn't the case; you need a general low corruption environment where mass issuing of fake IDs by corrupt officials won't happen (a limited number of fakes by organized crime might be inevitable, but they won't disrupt the system); you need an effective policing system where everyone, including the most poor, would report stolen wallets and documents to be revoked; you need effective infrastructure where it's trivial for everyone giving credit or goods "on lease" to verify online the validity of some documents. I'm not sure how it's in India, and I assume that some of these might be a problem, but for USA (as the original article) all these things are in place and such an ID would work if it was implemented.
SimbaOnSteroids 9y ago
You're right it was never meant to be a unique identifier, we need a national identification card, link to a video about it. https://youtu.be/Erp8IAUouus https://youtu.be/Erp8IAUouus
- thephyber 9y ago
  Strange that this is being downvoted. The video is very relevant. I get that many Americans are suspicious about our government, but the fact is that much of our credit / jobworthiness in the US is tied up in the Social Security card. I would rather it be something more useful, such as the Estonian National ID card -- which has smart features like digital contract signing.
- goialoq 9y ago
  Americans don't like National ID cards because we remember the Third Reich and the USSR.
  - krapp 9y ago
    I think it's more that Americans don't like national ID cards because they're paranoid about the Mark of the Beast and mistrust Federal power on principle.
  - maxerickson 9y ago
    I'm not sure I would proclaim that unironically in a discussion of a giant American company accidentally losing track of a database containing detailed personal information about ~1/2 the country. I mean sure, it's not in your pocket. But are you going to move house in response to this breach?
    - SimbaOnSteroids 9y ago
      The point is that your social is a fairly predictable number if you can figure out someone's birthday and hometown. I realize this wouldn't help in the case of equifax but it would help in other instances. It would also allow us to have voter ID laws that didn't constitute a poll fav but that's a totally unrelated issue.
shelbyfinally 9y ago
My brother's university student ID number was his SSN. It was a top-10 public university. That's how stupid we've collectively been about it.
XorNot 9y ago
It's pretty much the flaw in not having a national ID scheme - everyone reaches for the next closest approximation, with no funding for security systems or refreshes to address flaws. Because this is an issue the government should address seriously.
- dboreham 9y ago
  US government has been addressing this but states (which tend to issue the identity documents used widely) pushed back. Here in Montana I will shortly have to use my passport to get through airport security for this reason.
- goialoq 9y ago
  National ID has nothing to do with this. National Password is the problem here.
- robjan 9y ago
  Even with a national ID scheme, I don't know of any country who has implemented a way to validate that the holder of the ID document is the person who is the person who the ID document corresponds to without the person being present so that their biometric data can be validated.
  - dx034 9y ago
    You can use many ID cards online with the chip in the card. This means you need to have access to the physical card and the PIN. Much safer than just having a number and it will be hard to steal 50 million physical ID cards. Many banks use video chats to open accounts where you have to present the card via video. This can be even safer as you need the physical card and someone who looks like the person on the ID card. Since calls are recorded, I can imagine fraudsters are hesitant to use this process.
thephyber 9y ago
My hope is that with this breach, someone will finally be able to hit Congress over the head with a smart stick and make them realize this.
- seanp2k2 9y ago
  Good lucky. The people responsible for this will likely go on to work in the government.

eterm 9y ago

Exactly. In the UK we have a National Insurance number, but it's stated over and over again that: This is not proof of identity. Anywhere it is referenced it is repeated that it should not be used as proof of identity and not given to anyone as such. SSNs should be treated the same way, but that would require a culture change. Perhaps having 150m of them 'leaked' will bring about that change. Such a change could also be brought about through legislation making it not legal to ask for SSN as proof of ID (i.e. can only ask for SSN when required for the purposes it is intended for), but legislating such things is likely even further from your culture.

noja 9y ago
> This is not proof of identity. What is it then? I've seen it used as a quasi-password by car hire companies to access driving license history.
- maxerickson 9y ago
  They can use it as a key to the database without treating it as proof of identity. (I don't know that they do, it's just that the one doesn't necessarily follow from the other)
- DINKDINK 9y ago
  >What is it then? It is the username you are issued by the government. It is solely used to identify you.
  - thephyber 9y ago
    > It is solely used to identify you. Not exactly. It's used to map your Social Security account to other records they have about you. It's not, by itself, identification.
  - emodendroket 9y ago
    In practice it is not solely used for that.
- nightcracker 9y ago
  Do you see that thing above your post? "noja"? That's your identity. Your SSN on Hacker News. What proves that it is you to Hacker News is what you type into the password field when you log in.
  - noja 9y ago
    My username isn't a semi-secret number that I have to guard.
CamperBob2 9y ago
Exactly. In the UK we have a National Insurance number, but it's stated over and over again that: This is not proof of identity. Here in the US, our Social Security Act said exactly the same thing. Guess what. It got used as a proof of identity.
- ensignavenger 9y ago
  Social Security cards used to say they weren't to be used as identification. They took that off because everyone ignored it and did what they wanted to anyway.
PeterisP 9y ago
The problem is that you need a replacement, something that can actually be used as a solid proof of identity. The countries that don't have comparable identity theft problems have done so mostly by using an ubiquitous government issued ID that's hard to forge and hard to obtain by someone claiming to be you. In USA there seems to be a strong opposition and a legal barrier for the government to make such an ID. Not much else can be done - a simple test of a decent identity system is to ask if my spouse, mother or brother would be able to impersonate me - it's clear that nothing that relies on "something you know" can ever be sufficient, it must be "something you are", possibly together with "something you have", i.e., biometrics or a trusted photo ID.
- wtmt 9y ago
  Can you expand on the systems that are "hard to obtain by someone claiming to be you" and biometrics? In my readings, I've found that biometrics is not unique across a large population, it changes over one's life span (which means you wouldn't know when it has changed enough to update the system that stores it), changes with one's profession (like physical labor) and health, and that the error rates across a huge population even for iris scans are quite high. For reference, India has a unique ID called Aadhaar that collects ten fingerprints and two iris scans to deduplicate across 1.3 billion people. It uses flawed technology (relying on a fingerprint for authentication or in very rare cases, an iris scan), insecure devices, and generally has a high failure rate due to poor infrastructure. Combined with poor technology, the privacy and security policies and measures are inadequate too. There have been plenty of personal information leaked in the last few years because of the government's obstinate stand that this ID be linked to everything - phone numbers, tax ID, bank accounts, and many more. I don't think there is any solution, including biometrics, that will work to uniquely and unambiguously identify individuals across large populations. I also see more dangers for the populace with such schemes because submitted biometrics, once compromised, cannot be revoked or reissued (this is how the Aadhaar system works - it stores the biometrics as-is).
  - PeterisP 9y ago
    Biometrics alone aren't sufficient, but they're a reliable way to prevent identity theft if you have a secure record linking the identity to the biometrics - there will be people with similar faces and may be fingerprint matches, but fraudsters aren't going to easily find a thief that happens to look similar to you, match your fingerprints, and forge a document just to get a small loan or some electronics on your credit. The point is that biometrics can't be treated as "something you know", and the system should be designed in a way that these biometrics getting compromised isn't a big problem; I mean, my EU ID card has a chip with my fingerprints on it, but getting a copy of my fingerprints won't really risk "my identity", all they're good for is to prevent someone else using my documents if they steal it even if their face looks similar. Getting such a secure record, though, generally requires a decent level of gov't infrastructure throughout all areas, and can't be built up quickly. Size alone isn't an issue - if it works for half a billion people in EU, then it'd work for a billion people elsewhere, but the infrastructure needs to be there. I.e., you need a population where all or nearly all births have been properly tracked and reliably registered for a long time, so you can't build it faster than decades if it wasn't the case; you need a general low corruption environment where mass issuing of fake IDs by corrupt officials won't happen (a limited number of fakes by organized crime might be inevitable, but they won't disrupt the system); you need an effective policing system where everyone, including the most poor, would report stolen wallets and documents to be revoked; you need effective infrastructure where it's trivial for everyone giving credit or goods "on lease" to verify online the validity of some documents. I'm not sure how it's in India, and I assume that some of these might be a problem, but for USA (as the original article) all these things are in place and such an ID would work if it was implemented.

SimbaOnSteroids 9y ago

You're right it was never meant to be a unique identifier, we need a national identification card, link to a video about it. https://youtu.be/Erp8IAUouus https://youtu.be/Erp8IAUouus

thephyber 9y ago
Strange that this is being downvoted. The video is very relevant. I get that many Americans are suspicious about our government, but the fact is that much of our credit / jobworthiness in the US is tied up in the Social Security card. I would rather it be something more useful, such as the Estonian National ID card -- which has smart features like digital contract signing.
goialoq 9y ago
Americans don't like National ID cards because we remember the Third Reich and the USSR.
- krapp 9y ago
  I think it's more that Americans don't like national ID cards because they're paranoid about the Mark of the Beast and mistrust Federal power on principle.
- maxerickson 9y ago
  I'm not sure I would proclaim that unironically in a discussion of a giant American company accidentally losing track of a database containing detailed personal information about ~1/2 the country. I mean sure, it's not in your pocket. But are you going to move house in response to this breach?
  - SimbaOnSteroids 9y ago
    The point is that your social is a fairly predictable number if you can figure out someone's birthday and hometown. I realize this wouldn't help in the case of equifax but it would help in other instances. It would also allow us to have voter ID laws that didn't constitute a poll fav but that's a totally unrelated issue.

shelbyfinally 9y ago

My brother's university student ID number was his SSN. It was a top-10 public university. That's how stupid we've collectively been about it.

XorNot 9y ago

It's pretty much the flaw in not having a national ID scheme - everyone reaches for the next closest approximation, with no funding for security systems or refreshes to address flaws. Because this is an issue the government should address seriously.

dboreham 9y ago
US government has been addressing this but states (which tend to issue the identity documents used widely) pushed back. Here in Montana I will shortly have to use my passport to get through airport security for this reason.
goialoq 9y ago
National ID has nothing to do with this. National Password is the problem here.
robjan 9y ago
Even with a national ID scheme, I don't know of any country who has implemented a way to validate that the holder of the ID document is the person who is the person who the ID document corresponds to without the person being present so that their biometric data can be validated.
- dx034 9y ago
  You can use many ID cards online with the chip in the card. This means you need to have access to the physical card and the PIN. Much safer than just having a number and it will be hard to steal 50 million physical ID cards. Many banks use video chats to open accounts where you have to present the card via video. This can be even safer as you need the physical card and someone who looks like the person on the ID card. Since calls are recorded, I can imagine fraudsters are hesitant to use this process.

thephyber 9y ago

My hope is that with this breach, someone will finally be able to hit Congress over the head with a smart stick and make them realize this.

seanp2k2 9y ago
Good lucky. The people responsible for this will likely go on to work in the government.