8 ms·

>Social Security numbers, dates of birth and other sensitive data Dates of birth are considered sensitive data? That's pretty sad

edgesrazor 9y ago
Believe it or not, it really is. I was given this example by an attorney who specialized in HIPAA law: Say a chain store has a breach and the only thing that was stolen was a customer's name and their flu shot records - that wouldn't be that big of a deal, right? Well, say one of those customers was a fitness guru who built an empire on natural and holistic remedies. This changes the entire context of the breach. The same thing would work for age. Look at that ridiculous California law they proposed to get IMDb to stop showing actors' and actresses' birthdays. There can always be a claim of age discrimination - especially in finance.
- jacquesm 9y ago
  How on earth would that work? You're going to have to disclose your DOB at some point in the process to landing a job or applying for a loan regardless of any 'age discrimination'.
  - KekDemaga 9y ago
    Why is it required for getting a job?
    - jstarfish 9y ago
      Identity verification, background checks, etc.
    - jacquesm 9y ago
      Because, for instance you have to be over 18 to get a job, because your minimum wage could be indexed to age, because your CV will give most of that away anyway and because various official forms your employer will need to fill in accurately contain a field for 'date of birth'. You probably can't even open a bank account without specifying your DOB, let alone get a job or a loan.
      - cr1895 9y ago
        I know people stick their DOB (and photo!) on their CVs in the Netherlands. As far as I'm aware that would be quite odd to see in the US. There are some differences here in what is comfortably or preemptively shared with employers between the US and the NL.
        gyaru 9y ago
        That's pretty much de facto standard in Sweden too! Seems to be very common in Europe in general.
        maxerickson 9y ago
        It would be after the hiring decision, but the I-9 requests plenty of information. https://www.uscis.gov/i-9 https://www.uscis.gov/i-9
        MandieD 9y ago
        It's still the usual way of things in Germany. You bet I had a nice professional photo taken. You list not only your birth date, but birthplace and marital/family status. Job-hunting as a married-but-childless 30 year old woman here is awesome. Not. When I was stupid enough to make the whole "why do we list our family status on our resumes" thing a point of smalltalk towards the end of one of my first interviews here, the guy cheerfully told me, "oh, because we need to pay a family father of 3 more than we need to pay a single guy" ... and the young, childless wife of an engineer working at that small city's most generously-paying employer? The guy did not seem to believe I needed a job at all. All's well that ends well, and I'm now in a far better job that has a relatively transparent union payscale, but it stung at the time. My husband, a German, has told me that you used to also list the occupations of your parents!
        jacquesm 9y ago
        You should see the stuff the gradeschool of my kids asks me about without so much as blushing.
        cr1895 9y ago
  - edgesrazor 9y ago
    I'm just saying that just because you're willingly giving your DOB, doesn't mean it's not considered "sensitive information". An employer can use it to determine if you're old enough to work there (Arby's for example), but if it got out, someone could possibly use it against you, so it's considered sensitive.
wyldfire 9y ago
IIRC the social security number is not a globally unique identifier (only 1e9 unique values). However, in practice, the (SSN, birthdate) tuple generally is unique. This is probably why it's considered "sensitive."
- Diederich 9y ago
  To date, less than half of the total possible SSNs have been used. They are not re-used at this time. (1) 1) I worked in a large hospital in medical information systems, and the edge cases of SSN included the (required) SSN for newborns and unidentified patients. For the former, we re-used the SSN of the mother, but added a suffix. (So in our database, it wasn't just a 9 digit integer, it was a >9 character string. I can't recall how long.) When the newborn got an SSN assigned, we updated it. For John/Jane Doe folks, we used something like all zeros or some such, with an 'auto-incrementing' character suffix. These were re-used.
  - delecti 9y ago
    An estimated 40 million SSNs are associated with more than one person. https://www.pcworld.com/article/3004654/government/a-tale-of-two-women-same-birthday-same-social-security-number-same-big-data-mess.html https://www.pcworld.com/article/3004654/government/a-tale-of...
  - IncRnd 9y ago
    ID Analytics did a study in 2010 that found 40 million out of 290 million SSNs were assigned to more than one person. The conclusion is that the odds of someone else having your SSN are roughly 1:6. Other highlights of the study include: 1) How many SSNs do you have? – 6.1 percent of Americans have at least two SSNs associated with their name. More than 100,000 Americans have five or more SSNs associated with their name. 2) Some SSNs are very popular – More than 15 percent of SSNs are associated with two or more people. More than 140,000 SSNs are associated with five or more people. Significantly, more than 27,000 SSNs are associated with 10 or more people.* http://www.idanalytics.com/blog/press-releases/20-million-americans-multiple-social-security-numbers-associated-name/ http://www.idanalytics.com/blog/press-releases/20-million-am...
korethr 9y ago
One's date of birth, in isolation, may or may not be particularly sensitive. However, in combination with other information, it can help positively ID a person, and can then be used for shenanigans. Example: * Jacob Smith -- Not particularly identifying * Jacob Smith, born in 2004 -- Narrows it down, but that's the most common surname in the US, and the most popular 1st name for 2004 * Jacob Smith, born July 22 2004 -- Narrows it down a lot more. Even if you have a couple thousand Jacob Smiths born in 2004, it's unlikely that more than a few will share a single birthday * Jacob Smith, born July 22 2004, in Burbank, California -- Odds are you've identified a single individual at this point. A single datum in isolation doesn't tell you much. But the more data you have, the easier it is to use that data for good or evil. A further point, a date of birth can be used for validation of a SSN, making that SSN even more useful for shenanigans.
- paulddraper 9y ago
  Or you can go on Wikipedia, IMDB, etc. and get all sorts of names and birth dates.
  - freehunter 9y ago
    How many people have Wikipedia or IMDB pages compared to how many people have a credit card?
- dredmorbius 9y ago
  33 unique bits will narrow a search to any one living person.
  - npongratz 9y ago
    Until the population exceeds 2^33 = eight gibipeople.
Spooky23 9y ago
Date of birth is essential, because all trusted identity documents, including SSN, are anchored to your birth certificate. It’s basically the root of trust that you are you.
- IncRnd 9y ago
  +1 There is no identification that can be made that doesn't at some point reference DOB.
  - deathanatos 9y ago
    DNA? Fingerprints? Chipping people? RSA keys that are very carefully managed? Not saying that any of those are great, or even defect free, but you could certainly come up with schemes that don't involve DoB?
    - Spooky23 9y ago
      DNA, Fingerprints, footprints (captured at birth), retina patterns, etc can all identify that you are the same person that you were yesterday. Your identity is defined by that birth certificate in most cases. In corner cases, immigration, refugee or some other document may replace it. Birth is unique because it’s the moment when you become a recognized human, and there is at least one witness to the event or the immediate aftermath. You cannot be born or die more than once, so it makes sense to chronicle that moment. Here’s an example of how the state of New York identifies you. It is all tied to the record of your birth, either directly or indirectly. https://dmv.ny.gov/driver-license/prove-identity-age-permitlicense https://dmv.ny.gov/driver-license/prove-identity-age-permitl...
    - IncRnd 9y ago
      Why would you take someone's DNA or implant a chip in them for identification, if their birthdate was not already known? If you don't already know WHO the person is, you are verifying sameness of a person not relating to a known identity in identification. This is a real question. In what scenario would you chip someone or take their DNA if you didn't already know their DOB?
thephyber 9y ago
For government purposes, Name and DoB has sometimes been considered "unique enough". There was an article[1] about two women in NYC that ran into this issue; it caused one of them (the one with good credit) lots of heartache. It's stupid, but "mother's maiden name", "name of your first pet", "street that you lived on when you were young", etc are now de facto sensitive data by virtue of the fact that they can be frequently used to bypass your website passwords. In 2008, Sarah Palin's Yahoo mail account was breached because the answers to all of her security questions were effectively on her Wikipedia page. [1] https://www.theguardian.com/us-news/2017/apr/03/identity-theft-racial-justice https://www.theguardian.com/us-news/2017/apr/03/identity-the...
- yourapostasy 9y ago
  I've long since moved my family to password vaults to store nonsense strings for these password recovery questions and answers, for shielding against precisely this attack vector. Now if I could only get them to adopt 2FA for the master password of the vault.
  - duskwuff 9y ago
    Careful. If the security answers are verified by a human, they may accept "oh, I think I just put in a bunch of random characters" as an answer.
    - colejohnson66 9y ago
      Yep. I'd recommend the xkcd[0] approach with Diceware[1]. [0]: https://xkcd.com/936/ https://xkcd.com/936/ [1]: http://world.std.com/~reinhold/diceware.html http://world.std.com/~reinhold/diceware.html
      - yourapostasy 9y ago
        Thanks so much for pointing me to that. If I had an always-air-gapped ORWL, I'd probably put a generator on it to be able to quickly generate them; I generate an absurd number of accounts each week, since I don't tie into SSO offers over public sites. Only concern I need to solve for is sifting these lists for confusing words like homophones that are difficult to clearly say the words over an audio-only connection. This drives down the convenience and increases the time to call out the passphrase, since I then revert to the phonetic alphabet. Unfortunately, I've only found various lists [1], but not something that grabs the list, looks up the ExtIPA pronunciation [2] for each word, then applies rules to rank the clarity of each word when spoken over the phone. That last part is where I am stumbling. I can't find the rules that govern what we know about clarity over telephone links, though AT&T must have has studied this at some point. I can come close, with this article [3] about factors that explain why the sounds “f”, “th”, and “s” are difficult for hearing-impaired to hear. Ideally, a ranking of not just individual words in a selected Diceware list, but also ranking of the clarity of a selected passphrase as well, would come out of such a systematic categorization. [1] http://www.stlcc.edu/Student_Resources/Academic_Resources/Writing_Resources/Grammar_Handouts/commonly_confused_words.pdf http://www.stlcc.edu/Student_Resources/Academic_Resources/Wr... [2] https://en.wikipedia.org/wiki/Extensions_to_the_International_Phonetic_Alphabet https://en.wikipedia.org/wiki/Extensions_to_the_Internationa... [3] https://www.hearingaidknow.com/words-difficult-to-understand-with-hearing-loss https://www.hearingaidknow.com/words-difficult-to-understand...

edgesrazor 9y ago

Believe it or not, it really is. I was given this example by an attorney who specialized in HIPAA law: Say a chain store has a breach and the only thing that was stolen was a customer's name and their flu shot records - that wouldn't be that big of a deal, right? Well, say one of those customers was a fitness guru who built an empire on natural and holistic remedies. This changes the entire context of the breach. The same thing would work for age. Look at that ridiculous California law they proposed to get IMDb to stop showing actors' and actresses' birthdays. There can always be a claim of age discrimination - especially in finance.

jacquesm 9y ago
How on earth would that work? You're going to have to disclose your DOB at some point in the process to landing a job or applying for a loan regardless of any 'age discrimination'.
- KekDemaga 9y ago
  Why is it required for getting a job?
  - jstarfish 9y ago
    Identity verification, background checks, etc.
  - jacquesm 9y ago
    Because, for instance you have to be over 18 to get a job, because your minimum wage could be indexed to age, because your CV will give most of that away anyway and because various official forms your employer will need to fill in accurately contain a field for 'date of birth'. You probably can't even open a bank account without specifying your DOB, let alone get a job or a loan.
    - cr1895 9y ago
      I know people stick their DOB (and photo!) on their CVs in the Netherlands. As far as I'm aware that would be quite odd to see in the US. There are some differences here in what is comfortably or preemptively shared with employers between the US and the NL.
      - gyaru 9y ago
        That's pretty much de facto standard in Sweden too! Seems to be very common in Europe in general.
      - maxerickson 9y ago
        It would be after the hiring decision, but the I-9 requests plenty of information. https://www.uscis.gov/i-9 https://www.uscis.gov/i-9
      - MandieD 9y ago
        It's still the usual way of things in Germany. You bet I had a nice professional photo taken. You list not only your birth date, but birthplace and marital/family status. Job-hunting as a married-but-childless 30 year old woman here is awesome. Not. When I was stupid enough to make the whole "why do we list our family status on our resumes" thing a point of smalltalk towards the end of one of my first interviews here, the guy cheerfully told me, "oh, because we need to pay a family father of 3 more than we need to pay a single guy" ... and the young, childless wife of an engineer working at that small city's most generously-paying employer? The guy did not seem to believe I needed a job at all. All's well that ends well, and I'm now in a far better job that has a relatively transparent union payscale, but it stung at the time. My husband, a German, has told me that you used to also list the occupations of your parents!
        jacquesm 9y ago
        You should see the stuff the gradeschool of my kids asks me about without so much as blushing.
        cr1895 9y ago
- edgesrazor 9y ago
  I'm just saying that just because you're willingly giving your DOB, doesn't mean it's not considered "sensitive information". An employer can use it to determine if you're old enough to work there (Arby's for example), but if it got out, someone could possibly use it against you, so it's considered sensitive.

wyldfire 9y ago

IIRC the social security number is not a globally unique identifier (only 1e9 unique values). However, in practice, the (SSN, birthdate) tuple generally is unique. This is probably why it's considered "sensitive."

Diederich 9y ago
To date, less than half of the total possible SSNs have been used. They are not re-used at this time. (1) 1) I worked in a large hospital in medical information systems, and the edge cases of SSN included the (required) SSN for newborns and unidentified patients. For the former, we re-used the SSN of the mother, but added a suffix. (So in our database, it wasn't just a 9 digit integer, it was a >9 character string. I can't recall how long.) When the newborn got an SSN assigned, we updated it. For John/Jane Doe folks, we used something like all zeros or some such, with an 'auto-incrementing' character suffix. These were re-used.
- delecti 9y ago
  An estimated 40 million SSNs are associated with more than one person. https://www.pcworld.com/article/3004654/government/a-tale-of-two-women-same-birthday-same-social-security-number-same-big-data-mess.html https://www.pcworld.com/article/3004654/government/a-tale-of...
- IncRnd 9y ago
  ID Analytics did a study in 2010 that found 40 million out of 290 million SSNs were assigned to more than one person. The conclusion is that the odds of someone else having your SSN are roughly 1:6. Other highlights of the study include: 1) How many SSNs do you have? – 6.1 percent of Americans have at least two SSNs associated with their name. More than 100,000 Americans have five or more SSNs associated with their name. 2) Some SSNs are very popular – More than 15 percent of SSNs are associated with two or more people. More than 140,000 SSNs are associated with five or more people. Significantly, more than 27,000 SSNs are associated with 10 or more people.* http://www.idanalytics.com/blog/press-releases/20-million-americans-multiple-social-security-numbers-associated-name/ http://www.idanalytics.com/blog/press-releases/20-million-am...

korethr 9y ago

One's date of birth, in isolation, may or may not be particularly sensitive. However, in combination with other information, it can help positively ID a person, and can then be used for shenanigans. Example: * Jacob Smith -- Not particularly identifying * Jacob Smith, born in 2004 -- Narrows it down, but that's the most common surname in the US, and the most popular 1st name for 2004 * Jacob Smith, born July 22 2004 -- Narrows it down a lot more. Even if you have a couple thousand Jacob Smiths born in 2004, it's unlikely that more than a few will share a single birthday * Jacob Smith, born July 22 2004, in Burbank, California -- Odds are you've identified a single individual at this point. A single datum in isolation doesn't tell you much. But the more data you have, the easier it is to use that data for good or evil. A further point, a date of birth can be used for validation of a SSN, making that SSN even more useful for shenanigans.

paulddraper 9y ago
Or you can go on Wikipedia, IMDB, etc. and get all sorts of names and birth dates.
- freehunter 9y ago
  How many people have Wikipedia or IMDB pages compared to how many people have a credit card?
dredmorbius 9y ago
33 unique bits will narrow a search to any one living person.
- npongratz 9y ago
  Until the population exceeds 2^33 = eight gibipeople.

Spooky23 9y ago

Date of birth is essential, because all trusted identity documents, including SSN, are anchored to your birth certificate. It’s basically the root of trust that you are you.

IncRnd 9y ago
+1 There is no identification that can be made that doesn't at some point reference DOB.
- deathanatos 9y ago
  DNA? Fingerprints? Chipping people? RSA keys that are very carefully managed? Not saying that any of those are great, or even defect free, but you could certainly come up with schemes that don't involve DoB?
  - Spooky23 9y ago
    DNA, Fingerprints, footprints (captured at birth), retina patterns, etc can all identify that you are the same person that you were yesterday. Your identity is defined by that birth certificate in most cases. In corner cases, immigration, refugee or some other document may replace it. Birth is unique because it’s the moment when you become a recognized human, and there is at least one witness to the event or the immediate aftermath. You cannot be born or die more than once, so it makes sense to chronicle that moment. Here’s an example of how the state of New York identifies you. It is all tied to the record of your birth, either directly or indirectly. https://dmv.ny.gov/driver-license/prove-identity-age-permitlicense https://dmv.ny.gov/driver-license/prove-identity-age-permitl...
  - IncRnd 9y ago
    Why would you take someone's DNA or implant a chip in them for identification, if their birthdate was not already known? If you don't already know WHO the person is, you are verifying sameness of a person not relating to a known identity in identification. This is a real question. In what scenario would you chip someone or take their DNA if you didn't already know their DOB?

thephyber 9y ago

For government purposes, Name and DoB has sometimes been considered "unique enough". There was an article[1] about two women in NYC that ran into this issue; it caused one of them (the one with good credit) lots of heartache. It's stupid, but "mother's maiden name", "name of your first pet", "street that you lived on when you were young", etc are now de facto sensitive data by virtue of the fact that they can be frequently used to bypass your website passwords. In 2008, Sarah Palin's Yahoo mail account was breached because the answers to all of her security questions were effectively on her Wikipedia page. [1] https://www.theguardian.com/us-news/2017/apr/03/identity-theft-racial-justice https://www.theguardian.com/us-news/2017/apr/03/identity-the...

yourapostasy 9y ago
I've long since moved my family to password vaults to store nonsense strings for these password recovery questions and answers, for shielding against precisely this attack vector. Now if I could only get them to adopt 2FA for the master password of the vault.
- duskwuff 9y ago
  Careful. If the security answers are verified by a human, they may accept "oh, I think I just put in a bunch of random characters" as an answer.
  - colejohnson66 9y ago
    Yep. I'd recommend the xkcd[0] approach with Diceware[1]. [0]: https://xkcd.com/936/ https://xkcd.com/936/ [1]: http://world.std.com/~reinhold/diceware.html http://world.std.com/~reinhold/diceware.html
    - yourapostasy 9y ago
      Thanks so much for pointing me to that. If I had an always-air-gapped ORWL, I'd probably put a generator on it to be able to quickly generate them; I generate an absurd number of accounts each week, since I don't tie into SSO offers over public sites. Only concern I need to solve for is sifting these lists for confusing words like homophones that are difficult to clearly say the words over an audio-only connection. This drives down the convenience and increases the time to call out the passphrase, since I then revert to the phonetic alphabet. Unfortunately, I've only found various lists [1], but not something that grabs the list, looks up the ExtIPA pronunciation [2] for each word, then applies rules to rank the clarity of each word when spoken over the phone. That last part is where I am stumbling. I can't find the rules that govern what we know about clarity over telephone links, though AT&T must have has studied this at some point. I can come close, with this article [3] about factors that explain why the sounds “f”, “th”, and “s” are difficult for hearing-impaired to hear. Ideally, a ranking of not just individual words in a selected Diceware list, but also ranking of the clarity of a selected passphrase as well, would come out of such a systematic categorization. [1] http://www.stlcc.edu/Student_Resources/Academic_Resources/Writing_Resources/Grammar_Handouts/commonly_confused_words.pdf http://www.stlcc.edu/Student_Resources/Academic_Resources/Wr... [2] https://en.wikipedia.org/wiki/Extensions_to_the_International_Phonetic_Alphabet https://en.wikipedia.org/wiki/Extensions_to_the_Internationa... [3] https://www.hearingaidknow.com/words-difficult-to-understand-with-hearing-loss https://www.hearingaidknow.com/words-difficult-to-understand...