6 ms·

I never realised till now that American's SSNs were supposed to be kept secret. That's absolutely ridiculous. The idea of trying to keep the UK equivalent (Nati

I never realised till now that American's SSNs were supposed to be kept secret. That's absolutely ridiculous. The idea of trying to keep the UK equivalent (National Insurance Number) secret is laughable. How can anything function when an important id number is also supposed to be known by very few people?

raarts 9y ago
The same holds for bank account numbers which seems just as ridiculous to us Europeans.
- sitharus 9y ago
  I’ve recently seen inside the horror that is the US interbank clearing system. It seems crazy to me. In New Zealand we regularly share bank account numbers for payments, most obviously via TradeMe, our ebay equivalent. If you had my bank account number you could authorise a payment with an approved direct debit provider, who have to keep the approval on file in case of a dispute.
- arjie 9y ago
  Bank account numbers are on cheques. How would anyone keep them secret? By never using cheques?
  - afarrell 9y ago
    I moved from the US to the UK last year. I have seen two paper cheques in that time. It is much more common over here to pay electronically, though both Direct Debit (receiver pull) and Standing Orders (payer push) require one person giving their bank details to someone.
    - kevin_thibedeau 9y ago
      FWIW paper checks are not nearly as popular in the US as they once were. Especially hand written. They are ironically useful as a "secure" form of receiving payment because ACH is such a big gaping security hole. Receiving paper isolates you from handing out an account number.
      - eli_gottlieb 9y ago
        I still pay my rent in hand-written paper checks. It's kind of ridiculous, actually.
      - deleted 9y ago
        [deleted]
  - throwanem 9y ago
    I don't, except among family members. Any payee I don't strongly trust and who won't accept an electronic payment gets a bank check instead - I'd rather pay a few dollars to have one of those made, than save them and risk having my entire account cleaned out through lack of diligence or scruple on the receiving end.
  - esrauch 9y ago
    Anyone can make arbitrary withdrawals or transfers with only the info printed on the check (modulo fraud detection of course). People just don't know or don't think about the total lack of any technical security of their money.
gaius 9y ago
One thing I've never really understood is that as well as an NI number we also have NHS numbers. Why aren't they the same thing?!
- andy_ppp 9y ago
  Because use of the NHS and having a national insurance number are not a 100% overlap. NI just means you paid through taxes and aren’t for example a tourist or asylum seeker.
- edent 9y ago
  It's a form of decentralisation. Your doctor doesn't need to know your tax details. The tax inspector doesn't need to know your medical history.
  - arianvanp 9y ago
    So it _is_ used as a secret then? I'm confused.
    - codeulike 9y ago
      It's about as secret as your phone number I suppose. I.e. you probably won't write it on the side of your house but you will give it to lots of people. The NHS having their own number is also to do with the NHS treating people who don't have NI numbers, and various historical reasons, eg the NHS started in the 1950s and I expect it was easier to just start a new number system than persuade the treasury to wheelbarrow over all the paper.
    - jackweirdy 9y ago
      NHS numbers are typically more secret than NI numbers (though they needn't be necessarily) and many people don't know their NHS number at all
- jackweirdy 9y ago
  Because not everyone needs NHS numbers, and not everyone needs NI numbers, and neither is a subset of the other
bpicolo 9y ago
> were supposed to be kept secret It's especially laughable because you have to give it to -everybody-. Phone service, cable service, schools, employers, etc etc etc.
- macintux 9y ago
  In a college class ~20 years ago the professor passed around a sign-in sheet expecting everyone to fill in their names and SSNs. I was astonished, to put it mildly, both at the professor's cluelessness and the willingness of my fellow students to do it.
  - mistersquid 9y ago
    The article linked at the top of this thread discusses the need for different identifiers in different information contexts (education, health, tax, etc.). Many education institutions 20 years ago used SSNs as a unique identifier for students. On the first day of class, the only way to determine if a body present in a class was actually enrolled was to confirm SSN. Confirming identity in an education context is crucial in the first few weeks of class because being officially enrolled in a course affects student loans, work study, graduation paperwork, health insurance, etc. Additionally, many educational institutions have a policy that students not present for a class's first X meetings will be dropped from the course, a mechanism which allows students physically present to enroll in enrollment-capped courses (especially important for required courses). One of the most straightforward ways educators had of verifying that a body was in fact who that body said he or she was--was to ask for SSN because many educational institutions used SSNs as unique identifiers (but not necessarily verifiers). In other words, asking for verifying information enabled the educator to complete the institution's academic mission and to facilitate the educational needs of students. It is not the fault of educators that financial institutions also use SSNs as both means of identification and verification. As "clueless" as an educator might have been, he or she might be partially absolved for requesting PII in the context of educational bureaucracy. Granted, it would be better if each information context had unique identifiers that are not SSNs since SSNs are used by financial institutions. EDIT: readability, grammar, clarity.
throwanem 9y ago
The scheme was designed in 1935 as a way of identifying people enrolled in the then-new Social Security program (hence the name), and was gradually made a de facto national ID number over the intervening decades as the increasing scale of national population and economic activity prompted a desire for greater legibility to facilitate management and taxation. Greater legibility, management, and taxation are values not shared by a very sizable section of the US citizenry. Without digressing into a pointless and stupid flamewar over Humean oughts around these points of fact, we can acknowledge that every attempt thus far to implement a national ID scheme has been, and no doubt any future such attempt will be, energetically and, thus far at least, very effectively countered by those who so strongly prefer that no national ID scheme exist. Unfortunately, the US federal bureaucracy being what it is, we will have a national ID scheme whether well-designed as such or otherwise, and the wide adoption of Social Security and (generally) 1:1 mapping between SSNs and citizens made it the obvious candidate for a de facto national ID. Businesses followed government in adopting it as such. Now, instead of a proper, admitted national identification scheme which would at least have a chance of being marginally secure, we have a motley collection of the world's most hilariously shitty zero-factor authentication methods, making a wide variety of frauds so trivially simple to perform that we've had to spin them off into a new category of their own, "identity theft", which we regard as just one of those unfortunate things that happens sometimes, like cancer. Even after the Equifax breach, it'll probably still be cheaper to continue looking at the problem this way than to roll back the eight decades of technical debt that have gone into creating it. So it goes.
- codeulike 9y ago
  The UK is also heavily resistant to any sort of national ID scheme, and so National Insurance numbers (our equiv of SSN) are also a sortof proxy ID for people in work etc. But the difference is we don't pretend they are secret. In other words: we use it as a primary key, but we don't assume its a shared secret.
  - umanwizard 9y ago
    So let's say you want to apply for a bank loan or credit card online, or look up information about yourself on a government website - how do you prove you're you? Or is this simply not possible in the UK without visiting a bank branch etc.?
_Understated_ 9y ago
Over the years, I am willing to bet that the average US adult over the age of 40 will have given their SSN to hundreds of organisations already... There is no realistic way to guarantee the secrecy of an SSN at this point - Equifax's breach notwithstanding. For me, the takeway isn't that the supposedly private SSN has been leaked but that it's been leaked with so much other information that, all added together, give bad guys a fantastic haul with which to run amok. This, combined with the timing of the notification and the dodgy answers coming back from the automated online systems telling you that you "may" have suffered shows a total lack of regard for your data! You are now purely a commodity that corporates can use to their own ends. This is so glaringly obvious now. Why companies are allowed to hold so much info on us is the issue here: moreso, why are they not held to the highest of standards? Even a simple "each bit of personal data given to the wrong person will result in a $500 fine for the company" would soon add up. The danger is that these companies (I mean all the credit agencies) push this onto the consumer to "manage". In fact, now that I read this back, it's pretty much a certainty at this point. Unless someone goes to jail, or Equifax are shut down Arthur Anderson-style, then this will disappear!
Spooky23 9y ago
It's not a secret number, it's a unpublicized credential. Any meaningful identity verification gets traced to an auditable event (ie your birth, immigration, etc) and one or more tangible thing s that attest to your identity. SSN is definately important for credit, but know your customer laws are slowly making it less so.

raarts 9y ago

The same holds for bank account numbers which seems just as ridiculous to us Europeans.

sitharus 9y ago
I’ve recently seen inside the horror that is the US interbank clearing system. It seems crazy to me. In New Zealand we regularly share bank account numbers for payments, most obviously via TradeMe, our ebay equivalent. If you had my bank account number you could authorise a payment with an approved direct debit provider, who have to keep the approval on file in case of a dispute.
arjie 9y ago
Bank account numbers are on cheques. How would anyone keep them secret? By never using cheques?
- afarrell 9y ago
  I moved from the US to the UK last year. I have seen two paper cheques in that time. It is much more common over here to pay electronically, though both Direct Debit (receiver pull) and Standing Orders (payer push) require one person giving their bank details to someone.
  - kevin_thibedeau 9y ago
    FWIW paper checks are not nearly as popular in the US as they once were. Especially hand written. They are ironically useful as a "secure" form of receiving payment because ACH is such a big gaping security hole. Receiving paper isolates you from handing out an account number.
    - eli_gottlieb 9y ago
      I still pay my rent in hand-written paper checks. It's kind of ridiculous, actually.
    - deleted 9y ago
      [deleted]
- throwanem 9y ago
  I don't, except among family members. Any payee I don't strongly trust and who won't accept an electronic payment gets a bank check instead - I'd rather pay a few dollars to have one of those made, than save them and risk having my entire account cleaned out through lack of diligence or scruple on the receiving end.
- esrauch 9y ago
  Anyone can make arbitrary withdrawals or transfers with only the info printed on the check (modulo fraud detection of course). People just don't know or don't think about the total lack of any technical security of their money.

gaius 9y ago

One thing I've never really understood is that as well as an NI number we also have NHS numbers. Why aren't they the same thing?!

andy_ppp 9y ago
Because use of the NHS and having a national insurance number are not a 100% overlap. NI just means you paid through taxes and aren’t for example a tourist or asylum seeker.
edent 9y ago
It's a form of decentralisation. Your doctor doesn't need to know your tax details. The tax inspector doesn't need to know your medical history.
- arianvanp 9y ago
  So it _is_ used as a secret then? I'm confused.
  - codeulike 9y ago
    It's about as secret as your phone number I suppose. I.e. you probably won't write it on the side of your house but you will give it to lots of people. The NHS having their own number is also to do with the NHS treating people who don't have NI numbers, and various historical reasons, eg the NHS started in the 1950s and I expect it was easier to just start a new number system than persuade the treasury to wheelbarrow over all the paper.
  - jackweirdy 9y ago
    NHS numbers are typically more secret than NI numbers (though they needn't be necessarily) and many people don't know their NHS number at all
jackweirdy 9y ago
Because not everyone needs NHS numbers, and not everyone needs NI numbers, and neither is a subset of the other

bpicolo 9y ago

> were supposed to be kept secret It's especially laughable because you have to give it to -everybody-. Phone service, cable service, schools, employers, etc etc etc.

macintux 9y ago
In a college class ~20 years ago the professor passed around a sign-in sheet expecting everyone to fill in their names and SSNs. I was astonished, to put it mildly, both at the professor's cluelessness and the willingness of my fellow students to do it.
- mistersquid 9y ago
  The article linked at the top of this thread discusses the need for different identifiers in different information contexts (education, health, tax, etc.). Many education institutions 20 years ago used SSNs as a unique identifier for students. On the first day of class, the only way to determine if a body present in a class was actually enrolled was to confirm SSN. Confirming identity in an education context is crucial in the first few weeks of class because being officially enrolled in a course affects student loans, work study, graduation paperwork, health insurance, etc. Additionally, many educational institutions have a policy that students not present for a class's first X meetings will be dropped from the course, a mechanism which allows students physically present to enroll in enrollment-capped courses (especially important for required courses). One of the most straightforward ways educators had of verifying that a body was in fact who that body said he or she was--was to ask for SSN because many educational institutions used SSNs as unique identifiers (but not necessarily verifiers). In other words, asking for verifying information enabled the educator to complete the institution's academic mission and to facilitate the educational needs of students. It is not the fault of educators that financial institutions also use SSNs as both means of identification and verification. As "clueless" as an educator might have been, he or she might be partially absolved for requesting PII in the context of educational bureaucracy. Granted, it would be better if each information context had unique identifiers that are not SSNs since SSNs are used by financial institutions. EDIT: readability, grammar, clarity.

throwanem 9y ago

The scheme was designed in 1935 as a way of identifying people enrolled in the then-new Social Security program (hence the name), and was gradually made a de facto national ID number over the intervening decades as the increasing scale of national population and economic activity prompted a desire for greater legibility to facilitate management and taxation. Greater legibility, management, and taxation are values not shared by a very sizable section of the US citizenry. Without digressing into a pointless and stupid flamewar over Humean oughts around these points of fact, we can acknowledge that every attempt thus far to implement a national ID scheme has been, and no doubt any future such attempt will be, energetically and, thus far at least, very effectively countered by those who so strongly prefer that no national ID scheme exist. Unfortunately, the US federal bureaucracy being what it is, we will have a national ID scheme whether well-designed as such or otherwise, and the wide adoption of Social Security and (generally) 1:1 mapping between SSNs and citizens made it the obvious candidate for a de facto national ID. Businesses followed government in adopting it as such. Now, instead of a proper, admitted national identification scheme which would at least have a chance of being marginally secure, we have a motley collection of the world's most hilariously shitty zero-factor authentication methods, making a wide variety of frauds so trivially simple to perform that we've had to spin them off into a new category of their own, "identity theft", which we regard as just one of those unfortunate things that happens sometimes, like cancer. Even after the Equifax breach, it'll probably still be cheaper to continue looking at the problem this way than to roll back the eight decades of technical debt that have gone into creating it. So it goes.

codeulike 9y ago
The UK is also heavily resistant to any sort of national ID scheme, and so National Insurance numbers (our equiv of SSN) are also a sortof proxy ID for people in work etc. But the difference is we don't pretend they are secret. In other words: we use it as a primary key, but we don't assume its a shared secret.
- umanwizard 9y ago
  So let's say you want to apply for a bank loan or credit card online, or look up information about yourself on a government website - how do you prove you're you? Or is this simply not possible in the UK without visiting a bank branch etc.?

_Understated_ 9y ago

Over the years, I am willing to bet that the average US adult over the age of 40 will have given their SSN to hundreds of organisations already... There is no realistic way to guarantee the secrecy of an SSN at this point - Equifax's breach notwithstanding. For me, the takeway isn't that the supposedly private SSN has been leaked but that it's been leaked with so much other information that, all added together, give bad guys a fantastic haul with which to run amok. This, combined with the timing of the notification and the dodgy answers coming back from the automated online systems telling you that you "may" have suffered shows a total lack of regard for your data! You are now purely a commodity that corporates can use to their own ends. This is so glaringly obvious now. Why companies are allowed to hold so much info on us is the issue here: moreso, why are they not held to the highest of standards? Even a simple "each bit of personal data given to the wrong person will result in a $500 fine for the company" would soon add up. The danger is that these companies (I mean all the credit agencies) push this onto the consumer to "manage". In fact, now that I read this back, it's pretty much a certainty at this point. Unless someone goes to jail, or Equifax are shut down Arthur Anderson-style, then this will disappear!

Spooky23 9y ago

It's not a secret number, it's a unpublicized credential. Any meaningful identity verification gets traced to an auditable event (ie your birth, immigration, etc) and one or more tangible thing s that attest to your identity. SSN is definately important for credit, but know your customer laws are slowly making it less so.