5 ms·

This isn't going to stop until we stop treating SSNs like they're secret. Mine's not; it's been leaked at least once that I know of and I've given it freely to

by vec 9y ago

This isn't going to stop until we stop treating SSNs like they're secret. Mine's not; it's been leaked at least once that I know of and I've given it freely to dozens of clerks and HR staffers over the years, any of whom had ample opportunity to jot it down for personal use. I know this will never actually happen, but I sincerely wish the Social Security Administration would publish a complete official database of real name to SSN mappings. It wouldn't impede their use as Social Security Numbers, but it would make it extremely obvious how inappropriate they are as a proof of identity. Maybe then we'd finally be forced to come up with something a bit less insane.

deleted 9y ago
[deleted]
scarface74 9y ago
So as soon as you make SSN secret, companies are going to use another ID to uniquely identify people and we are right back in the same boat.
- lend000 9y ago
  They would probably pick something more secure than the government did, considering they have a vested interest in not succumbing to fraud.
  - dragontamer 9y ago
    > not succumbing to fraud. Erm... that's the entire fucking point of Experian. And yet they failed. Experian is a free-market for-profit corporation.
    - vec 9y ago
      No, the entire point of Experian et al is to reduce the number of loans that can't be collected on for any reason, including but not limited to fraud. Assume a credit rating agency can lower a lender's default rate from X% to X'% but introduces an additional Y% of fraudulent loans. If X - X' > Y, that's a good deal for lenders no matter what the absolute size of Y is.
    - lend000 9y ago
      If the government already chose a 9-digit 'secret' number that can be used to pay taxes and get tax refunds and do pretty much any other sensitive communication, is it the onus of private industry to supersede it? Experian failed, but the system was designed to fail. You can already get all of this important info with this number, so there was little incentive to create a new system and ensure that every American participated in it. Their operation was also entrenched by government credit reporting acts, pretty much setting in stone how things are and preventing innovation. This was a pseudo-government 'industry', not a free market system with new startups frequently joining.
      - dragontamer 9y ago
        Last I checked, the US Government requires: * Government Issued IDs -- Most situations. Police Tickets, Court issues, etc. etc. Usually your driver's license. This is effectively a security token, since its illegal to make illegitimate copies of a Government issued ID (although cryptography should be used in future ID efforts IMO) * Tax PIN number and Last year's tax refund -- Pay taxes and do tax refunds. There's a ton of OTHER information you need to submit with your taxes to get it processed. The SSN is purely the "username" for your taxes, it isn't the "password". ---- In the free market? People use SSN as a password, because free market doesn't give a care about you or decent security practices. Or at least, Experian doesn't (and they're a free market actor)
        lend000 9y ago
        > Tax PIN number and Last year's tax refund -- Pay taxes and do tax refunds For individuals, your TIN (Taxpayer Identification Number) defaults to your SSN, and you do not need the previous year's return to file taxes. Not sure where you are coming up with these imaginative claims, and I find it somewhat concerning how confident you feel in bureaucratic design decisions.
        dragontamer 9y ago
        https://www.irs.gov/individuals/electronic-filing-pin-request https://www.irs.gov/individuals/electronic-filing-pin-reques...
    - ksenzee 9y ago
      Do you mean Equifax? I'm having a hard time keeping Equifax, Experian, and Expedia straight. And poor Expedia didn't even do anything to deserve my confusing them with those other two.
  - audeyisaacs 9y ago
    >They would probably pick something more secure than the government did The government did NOT pick SSN's for ID. SSN cards used to have 'not to be used for identification purposes'. It was the private sector that appropriated SSN's as ID's. What the government failed in is adequately prohibiting and enforcing a prohibition of this type of use.
    - lend000 9y ago
      So the private sector picked the default Taxpayer Identification Number the IRS uses? I find that dubious at best.
- SilasX 9y ago
  No, it means a chance to do it right: to separate the part that uniquely, globally identifies you (username) from the part you use to prove that you're the owner of that ID (secret). And the SSN shouldn't be that secret.
- rando444 9y ago
  I'm not sure if you understand what a password is. Identifying a person is one thing, proving you are that person is a completely different concept.
  - scarface74 9y ago
    Yes and then people will use the same password at multiple sites with their new unique id and be right back in the same boat.
    - jchavannes 9y ago
      At least we'd have the choice to secure ourselves
    - deleted 9y ago
      [deleted]
    - rdtsc 9y ago
      I wouldn't. Currently I don't have a choice.
curun1r 9y ago
> I sincerely wish the Social Security Administration would publish a complete official database of real name to SSN mappings Given the prevalence of fraudulent tax returns and people working under fake SSNs to avoid taxes, I imagine the IRS would be very displeased with them if they were to do this. It's not just credit reporting agencies that need to reform their identification procedures, it's also government.
- Spivak 9y ago
  > people working under fake SSNs to avoid taxes Which is exactly the problem. The IRS is relying on the fact that SSNs are sorta-kinda-secret. Unless the database gets leaked there's not much impetus for change.
  - justinjlynn 9y ago
    Which is precisely why that illusion needs to be completely and utterly destroyed by releasing the database.
    - curun1r 9y ago
      Yes, but the argument that just releasing the database is responsible is based on the notion that private sector businesses have no right to use the identifier and can't complain if their usage is compromised. But extensive use by the public sector means that an alternative system needs to be put in place before releasing the database. If you think about it, there's virtually no purpose to a SSN without the IRS's current usage. The whole purpose of it is to track contributions into and benefit distributions out of the fund. The SSA tracks the benefit distributions, but the IRS's usage is squarely within the raison d'etre for the SSN existence in the first place. Releasing the mapping database would essentially break Social Security since they'd no longer have a working way of tracking contributions into the fund.
      - empath75 9y ago
        It could still be used as an identifier. It’s unique, just not secret.
rdtsc 9y ago
My university used to use SSN as student identifiers. So you'd walk down the hallways and trash bins would be full of discarded test papers and homework assignments with a nicely printed SSN and full names on all of them.
- AlephGarden 9y ago
  Likewise. I've worked with some of my university's databases that have a field for SSN, but don't contain SSNs anymore. We now call them Structural Support Numbers, or something equally silly.
fyrerise 9y ago
> I know this will never actually happen, but I sincerely wish the Social Security Administration would publish a complete official database of real name to SSN mappings. A full list might not even be necessary — a form that would allow you to trade some basic details for an SSN might be enough to scare various agencies straight. At least that way isn't quite as iterable. Honestly, this doesn't even sound all that implausible to me as long as some sort of sufficient warning was built into the announcement to give organizations a way to build alternatives. Say two years. After that, levy major fines against anyone who's not compliant with certain very basic security standards. The biggest hurdle here isn't going to be backlash as much as it is comprehension. Just like with net neutrality and encryption, most lawmakers are going to have a hard time understanding why SSNs as secrets aren't a good thing, and they'll have to be convinced.
m-p-3 9y ago
Agreed. SSNs are like trying to secure a system by only asking for a username without a password.

by vec 9y ago

deleted 9y ago

[deleted]

scarface74 9y ago

So as soon as you make SSN secret, companies are going to use another ID to uniquely identify people and we are right back in the same boat.

lend000 9y ago
They would probably pick something more secure than the government did, considering they have a vested interest in not succumbing to fraud.
- dragontamer 9y ago
  > not succumbing to fraud. Erm... that's the entire fucking point of Experian. And yet they failed. Experian is a free-market for-profit corporation.
  - vec 9y ago
    No, the entire point of Experian et al is to reduce the number of loans that can't be collected on for any reason, including but not limited to fraud. Assume a credit rating agency can lower a lender's default rate from X% to X'% but introduces an additional Y% of fraudulent loans. If X - X' > Y, that's a good deal for lenders no matter what the absolute size of Y is.
  - lend000 9y ago
    If the government already chose a 9-digit 'secret' number that can be used to pay taxes and get tax refunds and do pretty much any other sensitive communication, is it the onus of private industry to supersede it? Experian failed, but the system was designed to fail. You can already get all of this important info with this number, so there was little incentive to create a new system and ensure that every American participated in it. Their operation was also entrenched by government credit reporting acts, pretty much setting in stone how things are and preventing innovation. This was a pseudo-government 'industry', not a free market system with new startups frequently joining.
    - dragontamer 9y ago
      Last I checked, the US Government requires: * Government Issued IDs -- Most situations. Police Tickets, Court issues, etc. etc. Usually your driver's license. This is effectively a security token, since its illegal to make illegitimate copies of a Government issued ID (although cryptography should be used in future ID efforts IMO) * Tax PIN number and Last year's tax refund -- Pay taxes and do tax refunds. There's a ton of OTHER information you need to submit with your taxes to get it processed. The SSN is purely the "username" for your taxes, it isn't the "password". ---- In the free market? People use SSN as a password, because free market doesn't give a care about you or decent security practices. Or at least, Experian doesn't (and they're a free market actor)
      - lend000 9y ago
        > Tax PIN number and Last year's tax refund -- Pay taxes and do tax refunds For individuals, your TIN (Taxpayer Identification Number) defaults to your SSN, and you do not need the previous year's return to file taxes. Not sure where you are coming up with these imaginative claims, and I find it somewhat concerning how confident you feel in bureaucratic design decisions.
        dragontamer 9y ago
        https://www.irs.gov/individuals/electronic-filing-pin-request https://www.irs.gov/individuals/electronic-filing-pin-reques...
  - ksenzee 9y ago
    Do you mean Equifax? I'm having a hard time keeping Equifax, Experian, and Expedia straight. And poor Expedia didn't even do anything to deserve my confusing them with those other two.
- audeyisaacs 9y ago
  >They would probably pick something more secure than the government did The government did NOT pick SSN's for ID. SSN cards used to have 'not to be used for identification purposes'. It was the private sector that appropriated SSN's as ID's. What the government failed in is adequately prohibiting and enforcing a prohibition of this type of use.
  - lend000 9y ago
    So the private sector picked the default Taxpayer Identification Number the IRS uses? I find that dubious at best.
SilasX 9y ago
No, it means a chance to do it right: to separate the part that uniquely, globally identifies you (username) from the part you use to prove that you're the owner of that ID (secret). And the SSN shouldn't be that secret.
rando444 9y ago
I'm not sure if you understand what a password is. Identifying a person is one thing, proving you are that person is a completely different concept.
- scarface74 9y ago
  Yes and then people will use the same password at multiple sites with their new unique id and be right back in the same boat.
  - jchavannes 9y ago
    At least we'd have the choice to secure ourselves
  - deleted 9y ago
    [deleted]
  - rdtsc 9y ago
    I wouldn't. Currently I don't have a choice.

curun1r 9y ago

> I sincerely wish the Social Security Administration would publish a complete official database of real name to SSN mappings Given the prevalence of fraudulent tax returns and people working under fake SSNs to avoid taxes, I imagine the IRS would be very displeased with them if they were to do this. It's not just credit reporting agencies that need to reform their identification procedures, it's also government.

Spivak 9y ago
> people working under fake SSNs to avoid taxes Which is exactly the problem. The IRS is relying on the fact that SSNs are sorta-kinda-secret. Unless the database gets leaked there's not much impetus for change.
- justinjlynn 9y ago
  Which is precisely why that illusion needs to be completely and utterly destroyed by releasing the database.
  - curun1r 9y ago
    Yes, but the argument that just releasing the database is responsible is based on the notion that private sector businesses have no right to use the identifier and can't complain if their usage is compromised. But extensive use by the public sector means that an alternative system needs to be put in place before releasing the database. If you think about it, there's virtually no purpose to a SSN without the IRS's current usage. The whole purpose of it is to track contributions into and benefit distributions out of the fund. The SSA tracks the benefit distributions, but the IRS's usage is squarely within the raison d'etre for the SSN existence in the first place. Releasing the mapping database would essentially break Social Security since they'd no longer have a working way of tracking contributions into the fund.
    - empath75 9y ago
      It could still be used as an identifier. It’s unique, just not secret.

rdtsc 9y ago

My university used to use SSN as student identifiers. So you'd walk down the hallways and trash bins would be full of discarded test papers and homework assignments with a nicely printed SSN and full names on all of them.

AlephGarden 9y ago
Likewise. I've worked with some of my university's databases that have a field for SSN, but don't contain SSNs anymore. We now call them Structural Support Numbers, or something equally silly.

fyrerise 9y ago

> I know this will never actually happen, but I sincerely wish the Social Security Administration would publish a complete official database of real name to SSN mappings. A full list might not even be necessary — a form that would allow you to trade some basic details for an SSN might be enough to scare various agencies straight. At least that way isn't quite as iterable. Honestly, this doesn't even sound all that implausible to me as long as some sort of sufficient warning was built into the announcement to give organizations a way to build alternatives. Say two years. After that, levy major fines against anyone who's not compliant with certain very basic security standards. The biggest hurdle here isn't going to be backlash as much as it is comprehension. Just like with net neutrality and encryption, most lawmakers are going to have a hard time understanding why SSNs as secrets aren't a good thing, and they'll have to be convinced.

m-p-3 9y ago

Agreed. SSNs are like trying to secure a system by only asking for a username without a password.