28 ms·

Senators push to ditch social security numbers in light of Equifax hack

1126 points by Varcht 9y ago

slaymaker1907 9y ago
The Brazil idea sounds really cool to me. You can revoke identies if need be and they are more protected since they rely upon a public/private key system. Therefore, you can verify your identity without giving another party your secret info.
rangersanger 9y ago
The timing on this is interesting given our current political climate and the power the "frightful five" quietly wield and the amount of data they compile about us. I'm all for a better ID system, but I'm extremely concerned that a public/private partnership would lead to someone like facebook, google, microsoft, apple or amazon issuing said ID or being able to get anywhere near it.
maerF0x0 9y ago
Would be nice US gets something backed by crypto https://en.wikipedia.org/wiki/Tiigrih%C3%BCpe https://en.wikipedia.org/wiki/Tiigrih%C3%BCpe https://www.forbes.com/sites/kalevleetaru/2017/10/15/replacing-us-social-security-numbers-with-estonias-cryptographic-model/#5b15dc9b2aab https://www.forbes.com/sites/kalevleetaru/2017/10/15/replaci...
- AdmiralAsshat 9y ago
  Unless of course the algorithm that powers the crypto is discovered to be flawed and predictable.
  - bdamm 9y ago
    The current algorithm is demonstrably the worst. ROT13 would be stronger.
    - warent 9y ago
      My ID: anzr: jnerag cnffjbeq: cnffjbeq123 vs qrpelcgrq, cyrnfr qvfertneq naq rznvy ercbeg@frphevgl.tbi
    - adamnemecek 9y ago
      ROT13 is too weak, use ROT26 it’s twice as strong.
  - kgilden 9y ago
    This is what is actually happening right now in Estonia [1]. What's the solution? Make the card support at least 2 crypto algorithms and regenerate certificates, if a flaw in the main algorithm is found. [1]: https://arstechnica.com/information-technology/2017/11/flaw-crippling-millions-of-crypto-keys-is-worse-than-first-disclosed/ https://arstechnica.com/information-technology/2017/11/flaw-...
eggpy 9y ago
> Multiple times throughout the hearing, Brazil’s Infraestrutura de Chaves Públicas system of citizen IDs through digital certificates came up as a potential model for the U.S. as it moves forward. In this model, a certificate lasts for three years at maximum and can be used to issue a digital signature much like written signatures are used now. Unlike its counterpart in the U.S., these identity accounts can be revoked and reissued easily through an established national protocol. I believe most Americans are opposed to a national ID, so SSNs have been used as a (utterly terrible) workaround. Some reasoning for this, to quote an ACLU article on the subject[0], 'Former Senator Alan Cranston has described the national I.D. card as "a primary tool of totalitarian governments to restrict the freedom of their citizens." ' The Brazil solution mentioned seems pretty reasonable though. I like the built in expiration and ease of reissue. Anyone have experience with or thoughts about this sort of system? [0] https://www.aclu.org/other/national-identification-cards-why-does-aclu-oppose-national-id-system https://www.aclu.org/other/national-identification-cards-why...
- Spooky23 9y ago
  It would be incredibly expensive to implement. I personally would make a lot of money on it, but the complexities are almost unlimited. The GOP would never let it happen because it would make it too difficult to suppress black and poor voters by making registration unnecessary.
  - AckSyn 9y ago
    Stop spreading lies. An ID isn't about disenfranchisement.
  - tpallarino 9y ago
    Wait, I thought GOP was in support of voter ID to suppress voting?
    - Spooky23 9y ago
      If you replaced SSN with a universal ID, that would imply that anyone filing a tax return would need one. The purpose of voter ID laws is to suppress voting by poor people, especially African Americans, who lack ID because they do not drive, or have a difficult time meeting the standard of proof for getting an ID, or have difficulty going to the one DMV that supports their geography an hit away without a car. It’s the most recent of techniques used to suppress voting since the poll taxing and literacy tests of the reconstruction era. Unfortunately my comment wasn’t well-received, but that doesn’t take away from the reality. A federal ID, unencumbered by the bullshittery imposed in many states, would be opposed bitterly.
rrggrr 9y ago
Keybase.io has this problem solved in a way creditors, etc. could make good use of. Let the proofs be user/use driven.
- craftyguy 9y ago
  no, we don't need a proprietary, centralized service for this.
  - orthecreedence 9y ago
    Proprietary, no. Centralized? Yes, please. Blockchains are great and all, but if you lose your private key you should not be barred from ever opening another bank account or getting insurance. The SSA should switch to using asymmetric crypto keys and publish a web service that lets companies grab your public key based on a set of information (name, DOB, etc). Then that public key can be used to verify things signed by the private key. In the case of a lost/compromised private key, the SSA can generate a new keypair, assuming the person can verify their identity.
    - gjmacd 9y ago
      Isn't that the same as if you lost your SSI number? In all seriousness, I remember my parents lost my sisters SSI number well after she was born (1970's). The amount of BS the had to go through to get that back and prove they had one, that she was who she was, etc. It nagged them for years. Wouldn't the fix be to easily protect and recall your private key? I mean, not to get all science fiction but if you use a private key to replace an SSI, why wouldn't we move to a simple "chip" that we use with pets in case we lose it? Big brother, but I have to imagine it will certainly solve the key issue.
      - orthecreedence 9y ago
        If your private key is compromised (discovered by someone other than yourself) then it needs to be regenerated, whether it can be easily remembered or not. Getting a new key should be a huge pain in the ass, and the tests to prove that you are who you say you are should be strict. Don't lose your key. I wouldn't be opposed to a chip, but I doubt Americans are going to let that happen because they'll think big government is tracking them (which they already are, and a chip doesn't change that or expand their capabilities, but we're not talking about the most rational bunch here).
beager 9y ago
> Today, the Senate Commerce Committee questioned former Yahoo CEO Marissa Mayer, Verizon chief privacy officer Karen Zacharia and both the current and former CEOs of Equifax on how to protect consumers against major data breaches. So, ask the person who lost 3 billion accounts, the person who is stuck with the mess from losing 3 billion accounts, the person who lost 145 million SSNs, and the person who is stuck with the mess from losing 145 million SSNs how to protect against data breaches? I appreciate the relevance of those individuals to data security, but they're clearly not subject matter experts. If I wanted to secure my home against burglars, burglary victims probably wouldn't be my first consultation. That said, the mostly fixed nature of SSNs and their intrinsic potential for introspection is a huge liability and we should move away from them. [edit: Karen Zacharia may well be a subject matter expert here, it's a little unfair to group her in with my rant.]
- ProAm 9y ago
  Politicians need to look like they are doing something. It doesn't matter if they actually do anything. If they look busy, they are busy and are obviously working hard and should be kept in that position.
- burkaman 9y ago
  Burglary victims should be your first consultation, because most people who weren't burgled were probably just lucky, or were burgled but haven't realized it yet. If there are 10 houses, a burglar tries to get into all 10 but only succeeds on 2, then you should talk to the 8 owners who successfully protected their houses. If there are 1000 houses, a burglar tries to get into 10 but doesn't tell you which 10, and succeeds on 2, you should talk to those 2 owners because they know for a fact what can fail. 990 owners will just say "do what I do" without having any evidence that their strategy is actually safe.
  - ReverseCold 9y ago
    Maybe a bad analogy, but I do think that it doesn't make sense to ask "burglary victims" for computer security at least.
ykler 9y ago
Obviously it is a problem that social security numbers are often accepted as proof of identity, but the article seems to be saying that permanent id numbers are bad even apart from this. I don't understand what the argument is though
coleca 9y ago
How many million lines of mainframe COBOL would need to be updated if the SSN were to go away?
- bhhaskin 9y ago
  Ah, the real problem.
- FLUX-YOU 9y ago
  A lot less when they take the lazy route and autofill 000-000-0000 and just remove any validation in the languages that are cheaper to hire for.
- victor106 9y ago
  This would also serve as a good opportunity to replace those legacy systems
- Illniyar 9y ago
  Is there a reason why ssn numbers can't become national id numbers? It's the easiest path, all you need is to make new cards with biometric information (probably a photo). The number can remain. Even if you add a validation digit, it can be computed algorithmically so you don't need to change tje database.
swlkr 9y ago
I'd be all for user-friendly GPG keys or public/private key pairs for everyone.
donatj 9y ago
God if this comes to fruition I will be so happy. The social security number is a horrible way to prove who I am. I attended a small private college and they literally printed it on everything, it was our student ID.
Thriptic 9y ago
Is there a reason why we couldn't use state IDs for this purpose? We would just have to converge on a standard design, data structure, and set of APIs for access. It would also allow us to issue new ones easily in the event of a problem.
- JumpCrisscross 9y ago
  This seems like the best solution, not least because it avoids our American paranoia with a national ID.
- x3n0ph3n3 9y ago
  It exists already: https://www.dhs.gov/real-id https://www.dhs.gov/real-id
dawnerd 9y ago
Also important that whatever happens, they make it easier for people to revoke their id and get a new one.
njarboe 9y ago
The main problem trying to be fixed here is "identity theft". What that crime is, I think, is not clearly understood. This is when a criminal defrauds a bank or other company by getting credit using your identifying information and then defaults. The bank then misinforms the credit bureaus that you defaulted on your loan and this lie by the bank hurts you when you want to get any type of loan. This crime would be better called "bank slander" and the banks that do it should be fined heavily with some money going to the person slandered. Banks should have to know who they are loaning money to and if they make a mistake, that needs to be solely their problem. Then banks will figure out ways to confirm your identity better and people won't get into the hell that is trying to get the "bank slander" removed from their credit report.
- unabst 9y ago
  The banks should definitely be made responsible and made to pay for all the fraud they sign off on at all of their desks. We already know what happens when the banks run out of money. They get bailed out. That means they will NEVER be the victim. That means we can make them pay for bailing out fraud victims and taking the hit on their behalf. It should be a service, a duty, and an honor. But that will never happen, because this is America.
- Terr_ 9y ago
  Exactly, "identify theft" is usually just weasel-wording for "someone broke our lazy authentication system". Followed by "and we compounded our failure by falsely telling lots of other institutions that it was your fault." https://www.youtube.com/watch?v=-c57WKxeELY https://www.youtube.com/watch?v=-c57WKxeELY There won't be any improvement until the legal system creates a stronger incentive for institutions to be more secure.
  - psyc 9y ago
    The term itself is almost ambiguous. Popular interpretation: "Theft of an identity" Better interpretation: "Theft, by forging an identity"
- djsumdog 9y ago
bflesch 9y ago
How about fingerprinting and other biometrics as a replacement? This would be a solid solution, easy to implement and could be integrated with already existing storage systems?
- JumpCrisscross 9y ago
  Biometrics are not replaceable when they are stolen.
  - zamalek 9y ago
    Furthermore, they may not be unique.[1] We are also very far off from being able to trust the technologies that read biometrics, especially for the incompetents that the government usually contracts. I can't find the source, but there was a post/comment on HN linking to a bio engineering lab where they found that any fingerprint was being accepted. Your cell phone is likely light years ahead of anything a government contractor would put in place. [1]: http://www.telegraph.co.uk/science/2016/03/14/why-your-fingerprints-may-not-be-unique/ http://www.telegraph.co.uk/science/2016/03/14/why-your-finge...
nthj 9y ago
My first inclinations are that Apple and Google should be in these committee meetings. 77% of Americans own smartphones [1]. 99.6% of new smartphones run Android or iOS [2]. I would love for my iPhone to generate a private/public key pair, with the private key stored on the Secure Enclave. To register my public key, I fill out, on my phone, a bit of basic public information: full legal name, place & date of birth, and my current address and submit it. My phone suggests a nearby SSA office and proposes several appointment times, reminding me the day of. At the appointed time, I take my phone, passport, birth certificate, SSN card, driver's license and recent electric bill with my address on it to the local SSA office. [3] There, the administration manually inspects and verifies my documentation. Their systems then sign the authentication along with the current location, the time, the official's ID number, and a sha256 hash of a photo of me and the official holding up today's paper. My phone chirps, I use my passcode/Touch ID/Face ID/Dance ID to digitally counter-sign their authentication. This assures me that when the SSA's private keys are rotated because of inevitable compromise or on a routine schedule, my public key was not overwritten by the attackers. The SSA administration publishes my public key in their online directory. Private companies can download the public key directories and cache them, or pay Stripe-like vendors for just-in-time lookups. When I want to apply for a credit card, my phone chirps and I sign the credit request, just like Apple Pay. When I lose my phone, I run by the SSA office again before I apply for another credit card. Empowered by this new security layer, Congress passes a law establishing that no one can be held liable for—and credit decisions may not be made against—accounts that have not been digitally signed for any citizen who has a verified public key. And then I remember healthcare.gov and I wonder if I should even press submit. [1] http://www.pewinternet.org/fact-sheet/mobile/ http://www.pewinternet.org/fact-sheet/mobile/ [2] https://www.theverge.com/2017/2/16/14634656/android-ios-market-share-blackberry-2016 https://www.theverge.com/2017/2/16/14634656/android-ios-mark... [3] I wouldn't necessarily need to have all of these kinds of documentation, but the public directory system would be able to indicate which forms of identification I did have at time of authentication, for third parties to weigh the risk of identity theft.
- andrewflnr 9y ago
  So my legal identity is tied to proprietary hardware? Hardware that I arguably don't even meaningfully own? Running software with, especially in the case of Android, an atrocious security record? A secure enclave won't help if hackers just get the OS to call it to sign something malicious. It also kind of sucks for people who can't afford a smart phone.
matt_wulfeck 9y ago
Recently my grandmother passed away. We found her social security card (from 1932) and it says very clearly "NOT FOR IDENTIFICATION". It seems some lessons are lost.
- temporallobe 9y ago
  I was at the DMV with my daughter getting her learners permit (shows my age), and we had her passport, but they insisted on seeing her SSN card as well. Luckily we had it, but I found it absurd that a passport was not enough! Yes, my state is full dumbasses.
  - Spooky23 9y ago
    Not really. The passport seems to meet the identity proofing criteria, but it’s a little more complex. It sounds like it was in your case used as a proxy for your kids’ birth certificate. They require a second identity point when you have a document that substitutes for your birth certificate. Your passport + birth certificate would be ok in most states. Passports don’t meet all requirements because there are corner cases with certain passport types.
- tzs 9y ago
  That refers to the card, not the number. For some discussion of the history of this, see this old Straight Dope column: http://www.straightdope.com/columns/read/141/why-does-my-old-social-security-card-say-it-cant-be-used-as-id http://www.straightdope.com/columns/read/141/why-does-my-old... PS: did you typo the year? Social security numbers were first assigned in 1935, and social security cards were first issued in 1936.
  - matt_wulfeck 9y ago
    Yeah it’s a typo. She was in 1932 but her card came after.
ugh123 9y ago
Great that they're finally attempting to do something. But I get a little annoyed that congress always seems to act fast when its something that might actually affect them. Otherwise its back to partisan do-nothing.
matt_wulfeck 9y ago
What I want is control. I want to know who is accessing my credit history and for what purpose. And I want control of what accounts and business are able to access it. The government can accomplish this by providing your identify in a way that provides this control and transparently, and requiring that businesses/third-parties come through this gateway for identification.
DonHopkins 9y ago
I worry that they'll figure out that the easiest way to ditch social security numbers is to ditch social security.
cesarb 9y ago
> Multiple times throughout the hearing, Brazil’s Infraestrutura de Chaves Públicas system of citizen IDs through digital certificates came up as a potential model for the U.S. as it moves forward. That made it sound as if every Brazilian had one of these, and it were the main citizen ID. That's not the case. Here in Brazil, the main ID is the RG (Registro Geral), which is an identity card made of paper, issued by any of the 26 states (plus the Federal District). Since it's issued by the states, a single person can have more than one RG. We also have the equivalent of USA's SSN, here called the CPF. Like the SSN, it's used as the person's tax ID, and is a national number. It's also issued as a card made of paper, but unlike the RG, it cannot be used for identification, since it has no picture or fingerprint. For simplicity, if you already have a CPF number when your RG is issued (or re-issued), you can have the CPF number printed on the RG card. It's with the CPF that the "Infraestrutura de Chaves Públicas" (ICP) comes into view: you can get a certificate associated with your CPF, and use it for instance to sign your taxes. But it's not required, and most people don't have that certificate, or even know that it exists. In my opinion, the reason we don't have the same problem as the USA is not some fancy digital certificate stuff, but the simple fact that the CPF number by itself does nothing: everybody also wants to see the RG card. And for income taxes, the electronic form also requires a number found in the previous year's income tax receipt. The income tax return will be deposited into a bank account of your choice, but AFAIK it only accepts a bank account where the account owner has the same CPF, and to open a bank account you need the RG (plus other documents).
tabtab 9y ago
SSN is FINE as a simple identifier. The problem is that organizations try to use it like a PIN code or password. It should NEVER be used as proof of identity per transaction requests. Software Engineering 101: Use the right tool for the job. If an org needs a PIN code or password, make one.
tomschlick 9y ago
To me, a good solution would be a chip-based smart card with a private key on it for physical proof of identity, and an oauth api for web based stuff. The api would also power the back-end of the in person transactions and issue the vendor a token which they would use from that point forward. In this system, everything would be logged in terms of who/what accessed your data and it could be de-authorized at any point. The cards themselves could just be each state's ID/Drivers License to avoid the scare of the national id that many are opposed to for one reason or another. Replacing an ID would be as easy as visiting your DMV (shudder) and them invalidating your old private key.
- chatmasta 9y ago
  You would rather the government store 300 million identifiers instead of Equifax? There are crypto solutions to this problem, but they’re not as simple as symmetric encryption and smart cards. An ideal system will also enforce rules for storage and access. Something like your data is always encrypted with your own private key, and you can authorize bits of the data at a time to third parties.
  - tomschlick 9y ago
    No, the government wouldn't store anything other than the basic identity (which they already do) and issue verification tokens. The accessor would store their proprietary info as well as the access token to person's private info on the govt api. Full blown crypto solutions to this don't really scale well and present many problems where the accessor would need to keep asking you for info to see if it changed. My solution solves the main problem of having a universal number that can get your identity stolen. If we can fix that we have solved 90% of the problem and can work on other things like privacy of said data at a later date.
shmerl 9y ago
Long time overdue.
gumby 9y ago
How does it work in countries where the opposite is true (e.g. Sweden, where the "personnummer" is public info)? Why is there not massive identity fraud there?
- mickronome 9y ago
  For everything where identity is important there is liberal use of an ID card of decent quality, one with several counterfeiting features. Any drivers license also doubles as one. Online an electronic signature of some kind is used, exactly which varies a bit, but the one called BankID is accepted in most places. Long rambling post ahead, I'm really, really terrible at writing something mostly coherent on the phone, apologies to everyone, but the above paragraph really is the only important part of this comment :) For bigger financial transactions, if your counterpart is a company they will often do a credit check, which the credit checking provider is then by law required to inform you about through regular mail. Sensitive online services from government and other companies mostly use some version of an electronic ID, the most common is generally known as BankID, despite of its name it's simply an embodiment of an electronic ID. BankID got its name because it is provided by Bankgirot, a clearinghouse company with a long history in which most of the major Swedish banks have some ownership. Another implementation is provided by Telia AB, a formerly state owned telecommunications provider. It's not a bulletproof system by any means, but for the most part it appears to work. However, I'm not too enthusiastic about the eagerness to adopt "BankID on your mobile phone”. It feels like it's only a matter of when, rather than if, someone will manage to exploit it through som security flaw in some of the popular smart phones. Which will inconvenience a lot of people until banks - most likely - simpy roll back the transactions, as is in the digital realm it's hard to disappear money when literally everyone gets assigned an ID. Tangentially, the most common way used to create legitimate companies for illegal activities AFAIK, at least used to be to pay of some substance abuser or petty thief to use their identity, and simply have them take the fall when/if things go south. So apparently, creating fake identities would appear to be rather hard. Because the ubiquity of the personal number, and the liberal use of good quality ID cards. This number connected through tax, loans, land ownership, insurance etc, makes it somewhat hard to make money leave the digital world without trace. It would also be terrible in the hands of a competent totalitarian regime or fundamentalist (of any sort) government. Sometimes I think we subconsciously avoid that by voting for mostly uncharismatic leaders with little appeal except for them promising a little bit more money in your wallet, better social security, healthcare, child care, or school. In all cases better can be read as more available, efficient, and ecological from the left - and higher fees, stricter requirements, and lower availability from the right. But I digress. There have been some areas of law/contract where identity theft was easier, notably land ownership/property laws. IIRC in the property laws it was essentially stated that a signature on paper with two witnesses signatures was indirectly used as proof of identity. Unsurprisingly, this led to some people getting their homes sold by third parties, and having to face a rather arduous legal procedure to get back to square one. Yeah, that one was rather monumentally stupid, but it wasn't really caused by the personnummer being public.
Overtonwindow 9y ago
I think more power needs to be given to the person whose identity is stolen. Similar to how the chip and pin system was rolled out: If a fraud is committed, the entity with the least secure method of transaction pays. That pushed retailers to upgrade their systems.
Nomentatus 9y ago
I've suggested this before here, but the card companies need to give other companies like Equifax reference numbers to store that uniquely identify the card to the credit card company (or others) but don't give the credit card number and don't get anybody closer to charging anything on the card.
ActsJuvenile 9y ago
It is quite straightforward to upgrade SSN system. Social Security Administration can generate deterministic Private+Public key pairs for all citizens. Public key is your new SSN. If it gets stolen, simply generate a new public key, and give it out as a new number. All public keys are easily verified since SSA knows the private keys.
- amorphid 9y ago
  Just don't make me memorize a 4096 bit key :)
  - chrisper 9y ago
    Why do you even need to memorize something like this? In any other country you do not memorize your tax ID... You just look it up when you need it.
    - amorphid 9y ago
      It's pretty normal to memorize your 9 digit social security number, in the same way you know your phone number. Because the SSN card is a fundamental piece of identity theft, it's common practice to NOT carry the number in your wallet. You never know when you'll need the number, and very rarely need the actual card. I don't think I've ever used my physical SSN card in the last 5 years, but I need to provide the number itself quite often, especially on financial, employment, and government documents. We still use paper checks, too. Good times.
mrhappyunhappy 9y ago
Instead of creating security systems around sensitive data, make data useless to thieves.
yason 9y ago
The problem is if social security number is used not only for identification but authentication. Knowing someone's SSN shouldn't ever get you anything: SSN could as well be public information, ideally. I don't know about the US but where I live, bank account numbers are effectively public: you could publish yours on the internet and all people could do is put money on your account. The bank will then require official authentication if you wish to use the account number to withdraw money. Using an unique identification number for authentication is authentication by proxy. Yes, it's highly likely that only the right person knows his own number but never guarantees anything. Make authentication easy and solid and the bar for frauding through stolen identity goes up.
- olegkikin 9y ago
  What we really need are private keys, stored in hardware, like secure enclave. Whenever someone wants a proof of your identity, they ask you to sign a certain message with a timestamp.
njharman 9y ago
The problem isn't that we have numbers. It's that corporations have little incentive to protect them. Right now it's cheaper (i.e. more profitable) to do as little as possible and when/if they get hacked just pay extra on PR/lobbying for a couple weeks/month until someone else gets the public's attention. Enact Huge (like $1000 per person exposed) fines, corporate death penalty, jail time for people in charge. And, I can guarantee you, companies will start actually protecting their data.
- alphaalpha101 9y ago
  This is one of those cases where you have to be careful. Yes maybe putting huge fees on them gives them the 'incentives', but the market doesn't do what you expect most of the time. Put big fees on their failure, and they might just find more ways to deflect the blame. Corporations need to have strict liability. And in the meantimes, take away strict liability from actual humans, given that it's incredibly unethical to hold someone responsible for something they had no intent to do.
- castratikron 9y ago
  Senator Baldwin got Equifax to admit this in the hearing (around the 1:23:00 mark): https://www.youtube.com/watch?v=LunazYJGNXU https://www.youtube.com/watch?v=LunazYJGNXU
Yizahi 9y ago
> “The parade of high-profile data breaches seems to have no end,” said ranking committee member Bill Nelson. “We can either take action with common sense rules or we can start planning for our next hearing on the issue.” So true.
StreamBright 9y ago
It would be easy to introduce a pin protected chip card and use 2FA all the time for everything. But in the US even credit cards do not have chip and if they do it does not have a pin. The rest of the world using these security measures for almost a decade.
- opportune 9y ago
  Good luck getting Grandma to understand that
  - StreamBright 9y ago
    Should we organize the world around what grandma understands? How many grandmas are out there vs how many people who understand at the very least pin codes?
jerianasmith 9y ago
So regardless of the possibility that somebody gets simply part of your number, it can be anything but difficult to make sense of the rest. Analysts in 2009 composed a calculation that could foresee a Social Security number effectively 44 percent of the time in the United States.
ahallock 9y ago
Why were businesses ever allowed to use SSNs in the first place?
alkonaut 9y ago
On a related note: have many in the US swicthed to locked mailboxes? Without locked mailboxes, you can't even use the slow address/snail-mail 2FA that should be used for certain transactions when you don't have E.g. if I want to take a loan, I'd say who I am and the bank would send the papers to sign to my mail address. Only after I sign the papers will I get the money. Someone pretending to be me would have to stalk my mail box (time consuming and hard because it's locked), or first change identity records to associate my name with his mail address. This greatly increases the difficulty of this kind of fraud. From just needing a fake ID, to either having to commit a long stalk of my mailbox and commit physical mail theft OR having to do a multiple phase fraud where authority address records are first changed. Obviously this all hinges on a) id required to open bank account, b) central registry that maps id to mail address, separate from the bank.
nnq 9y ago
Isn't it obvious that this scandal was either provoked or amplified in order to make Americans get themselves mandatory government IDs with chips and biometrics? ...not that that would be a bad thing. Just getting in line with EU and the rest of the world, finally. Mass monitoring would at least become a few order of magnitudes cheaper hopefully spending those funds on more socially useful things. Offer a chip-less option for more privacy paranoid people, so that at least they can't be tracked remotely when they don't carry their phones (yeah, some countries have this option system). And it's all nice and dandy. As an European, I find it mind boggling when I see people without adequately secured and mandatory IDs in the US...
itissid 9y ago
I think one more thing that needs to be understood is how can one dynamically establish identity. I have never built a cryptographic system, but I thought maybe the following could be better: Lets say Alice is a person wanting to establish Bob's identity. 1. Bob must be the only person who retains control over his identity. 2. Bob can verify he is who he says by a distributed system and Alice gets only a Yes/No answer. 3. All verification can be done using a distributed fashion, something like bitcoin/blockchain. The most important thing here would be an implementation of the distributed nodes and how bob's information is authenticated. But I think all these parts already exist. Political and Business will is needed.
igorgue 9y ago
What's Yahoo doing there? Why is she still employed by anyone? LOL...
jwatte 9y ago
SSNs are fine identifiers (user names.) The problem is that people try to treat them like authenticators (passwords.) Using SSNs as identifiers everywhere would reduce lots of mistakes and bugs. Having a national ID system and modern ID documents/verification would reduce fraud. These would go very well together!
GigabyteCoin 9y ago
>Today, the Senate Commerce Committee questioned former Yahoo CEO Marissa Mayer, Verizon chief privacy officer Karen Zacharia and both the current and former CEOs of Equifax on how to protect consumers against major data breaches. That has got to be some kind of joke. Why would they ask the former leaders of two companies (Yahoo and Equifax) who have experienced perhaps the largest data breaches of all time... "how to protect consumers against major data breaches?" That is ridiculous. They should have asked the current head of security from each company instead.
franksunjin 9y ago
social security number is racist
pimmen 9y ago
In Sweden we have a national id number given at birth which can be Luhn checked just like a credit card, and we use a digital id bound to a device with an pin number. We use them both in conjunction for online banking, filing taxes and all kinds of things and we have a dramatically lower rate of identity theft than the US. The national id has been here for a long, long time and the digital id has been here for more than 10 years.
- donkeyd 9y ago
  Many Americans are just really afraid of anything being controlled by the government. It's why they keep doing stuff that us Europeans don't understand, like not having strict gun control, not having affordable health care, not having acceptable social security, etcetera. Americans tend to hate government more than they love themselves and others. Having lived in the US it really bothers me, since there are so many great, caring people there that I don't understand why they keep doing what they do.
braeckmansj 9y ago
Hi guys, My name is sarah pith i am located in USA,Texas. i will like to publish the hand work of God to the general public. God has been very grateful to me and my family. 5months ago i was seriously searching for a loan worth $90,000.00 to buy a house in the USA. And i was scammed by various lenders online, but 2weeks ago i saw a post about ATM blank cards. I doubted this but decided to give it a try by Contacting them through this email on(braeckmansj@outlook.com) they responded with their guidelines on how the card works. i’was assured that the card can withdraw $5000 instant & was credited with $500,000.00 so i requested for one & paid the purchasing fee to obtain the card. 72 hrs later, i was shock to see the DHL agent in my resident with a parcel{card} i signed and went back inside and confirmed the card works after the agent left. This is no doubts because i have the card and i have made used of the card. This hackers are europe based hackers set out to help people with financial freedom!! Contact them today on(braeckmansj@outlook.com) if you want to get rich with this card.

1126 points by Varcht 9y ago

slaymaker1907 9y ago

The Brazil idea sounds really cool to me. You can revoke identies if need be and they are more protected since they rely upon a public/private key system. Therefore, you can verify your identity without giving another party your secret info.

rangersanger 9y ago

The timing on this is interesting given our current political climate and the power the "frightful five" quietly wield and the amount of data they compile about us. I'm all for a better ID system, but I'm extremely concerned that a public/private partnership would lead to someone like facebook, google, microsoft, apple or amazon issuing said ID or being able to get anywhere near it.

maerF0x0 9y ago

Would be nice US gets something backed by crypto https://en.wikipedia.org/wiki/Tiigrih%C3%BCpe https://en.wikipedia.org/wiki/Tiigrih%C3%BCpe https://www.forbes.com/sites/kalevleetaru/2017/10/15/replacing-us-social-security-numbers-with-estonias-cryptographic-model/#5b15dc9b2aab https://www.forbes.com/sites/kalevleetaru/2017/10/15/replaci...

AdmiralAsshat 9y ago
Unless of course the algorithm that powers the crypto is discovered to be flawed and predictable.
- bdamm 9y ago
  The current algorithm is demonstrably the worst. ROT13 would be stronger.
  - warent 9y ago
    My ID: anzr: jnerag cnffjbeq: cnffjbeq123 vs qrpelcgrq, cyrnfr qvfertneq naq rznvy ercbeg@frphevgl.tbi
  - adamnemecek 9y ago
    ROT13 is too weak, use ROT26 it’s twice as strong.
- kgilden 9y ago
  This is what is actually happening right now in Estonia [1]. What's the solution? Make the card support at least 2 crypto algorithms and regenerate certificates, if a flaw in the main algorithm is found. [1]: https://arstechnica.com/information-technology/2017/11/flaw-crippling-millions-of-crypto-keys-is-worse-than-first-disclosed/ https://arstechnica.com/information-technology/2017/11/flaw-...

eggpy 9y ago

> Multiple times throughout the hearing, Brazil’s Infraestrutura de Chaves Públicas system of citizen IDs through digital certificates came up as a potential model for the U.S. as it moves forward. In this model, a certificate lasts for three years at maximum and can be used to issue a digital signature much like written signatures are used now. Unlike its counterpart in the U.S., these identity accounts can be revoked and reissued easily through an established national protocol. I believe most Americans are opposed to a national ID, so SSNs have been used as a (utterly terrible) workaround. Some reasoning for this, to quote an ACLU article on the subject[0], 'Former Senator Alan Cranston has described the national I.D. card as "a primary tool of totalitarian governments to restrict the freedom of their citizens." ' The Brazil solution mentioned seems pretty reasonable though. I like the built in expiration and ease of reissue. Anyone have experience with or thoughts about this sort of system? [0] https://www.aclu.org/other/national-identification-cards-why-does-aclu-oppose-national-id-system https://www.aclu.org/other/national-identification-cards-why...

Spooky23 9y ago
It would be incredibly expensive to implement. I personally would make a lot of money on it, but the complexities are almost unlimited. The GOP would never let it happen because it would make it too difficult to suppress black and poor voters by making registration unnecessary.
- AckSyn 9y ago
  Stop spreading lies. An ID isn't about disenfranchisement.
- tpallarino 9y ago
  Wait, I thought GOP was in support of voter ID to suppress voting?
  - Spooky23 9y ago
    If you replaced SSN with a universal ID, that would imply that anyone filing a tax return would need one. The purpose of voter ID laws is to suppress voting by poor people, especially African Americans, who lack ID because they do not drive, or have a difficult time meeting the standard of proof for getting an ID, or have difficulty going to the one DMV that supports their geography an hit away without a car. It’s the most recent of techniques used to suppress voting since the poll taxing and literacy tests of the reconstruction era. Unfortunately my comment wasn’t well-received, but that doesn’t take away from the reality. A federal ID, unencumbered by the bullshittery imposed in many states, would be opposed bitterly.

rrggrr 9y ago

Keybase.io has this problem solved in a way creditors, etc. could make good use of. Let the proofs be user/use driven.

craftyguy 9y ago
no, we don't need a proprietary, centralized service for this.
- orthecreedence 9y ago
  Proprietary, no. Centralized? Yes, please. Blockchains are great and all, but if you lose your private key you should not be barred from ever opening another bank account or getting insurance. The SSA should switch to using asymmetric crypto keys and publish a web service that lets companies grab your public key based on a set of information (name, DOB, etc). Then that public key can be used to verify things signed by the private key. In the case of a lost/compromised private key, the SSA can generate a new keypair, assuming the person can verify their identity.
  - gjmacd 9y ago
    Isn't that the same as if you lost your SSI number? In all seriousness, I remember my parents lost my sisters SSI number well after she was born (1970's). The amount of BS the had to go through to get that back and prove they had one, that she was who she was, etc. It nagged them for years. Wouldn't the fix be to easily protect and recall your private key? I mean, not to get all science fiction but if you use a private key to replace an SSI, why wouldn't we move to a simple "chip" that we use with pets in case we lose it? Big brother, but I have to imagine it will certainly solve the key issue.
    - orthecreedence 9y ago
      If your private key is compromised (discovered by someone other than yourself) then it needs to be regenerated, whether it can be easily remembered or not. Getting a new key should be a huge pain in the ass, and the tests to prove that you are who you say you are should be strict. Don't lose your key. I wouldn't be opposed to a chip, but I doubt Americans are going to let that happen because they'll think big government is tracking them (which they already are, and a chip doesn't change that or expand their capabilities, but we're not talking about the most rational bunch here).

beager 9y ago

> Today, the Senate Commerce Committee questioned former Yahoo CEO Marissa Mayer, Verizon chief privacy officer Karen Zacharia and both the current and former CEOs of Equifax on how to protect consumers against major data breaches. So, ask the person who lost 3 billion accounts, the person who is stuck with the mess from losing 3 billion accounts, the person who lost 145 million SSNs, and the person who is stuck with the mess from losing 145 million SSNs how to protect against data breaches? I appreciate the relevance of those individuals to data security, but they're clearly not subject matter experts. If I wanted to secure my home against burglars, burglary victims probably wouldn't be my first consultation. That said, the mostly fixed nature of SSNs and their intrinsic potential for introspection is a huge liability and we should move away from them. [edit: Karen Zacharia may well be a subject matter expert here, it's a little unfair to group her in with my rant.]

ProAm 9y ago
Politicians need to look like they are doing something. It doesn't matter if they actually do anything. If they look busy, they are busy and are obviously working hard and should be kept in that position.
burkaman 9y ago
Burglary victims should be your first consultation, because most people who weren't burgled were probably just lucky, or were burgled but haven't realized it yet. If there are 10 houses, a burglar tries to get into all 10 but only succeeds on 2, then you should talk to the 8 owners who successfully protected their houses. If there are 1000 houses, a burglar tries to get into 10 but doesn't tell you which 10, and succeeds on 2, you should talk to those 2 owners because they know for a fact what can fail. 990 owners will just say "do what I do" without having any evidence that their strategy is actually safe.
- ReverseCold 9y ago
  Maybe a bad analogy, but I do think that it doesn't make sense to ask "burglary victims" for computer security at least.

ykler 9y ago

Obviously it is a problem that social security numbers are often accepted as proof of identity, but the article seems to be saying that permanent id numbers are bad even apart from this. I don't understand what the argument is though

coleca 9y ago

How many million lines of mainframe COBOL would need to be updated if the SSN were to go away?

bhhaskin 9y ago
Ah, the real problem.
FLUX-YOU 9y ago
A lot less when they take the lazy route and autofill 000-000-0000 and just remove any validation in the languages that are cheaper to hire for.
victor106 9y ago
This would also serve as a good opportunity to replace those legacy systems
Illniyar 9y ago
Is there a reason why ssn numbers can't become national id numbers? It's the easiest path, all you need is to make new cards with biometric information (probably a photo). The number can remain. Even if you add a validation digit, it can be computed algorithmically so you don't need to change tje database.

swlkr 9y ago

I'd be all for user-friendly GPG keys or public/private key pairs for everyone.

donatj 9y ago

God if this comes to fruition I will be so happy. The social security number is a horrible way to prove who I am. I attended a small private college and they literally printed it on everything, it was our student ID.

Thriptic 9y ago

Is there a reason why we couldn't use state IDs for this purpose? We would just have to converge on a standard design, data structure, and set of APIs for access. It would also allow us to issue new ones easily in the event of a problem.

JumpCrisscross 9y ago
This seems like the best solution, not least because it avoids our American paranoia with a national ID.
x3n0ph3n3 9y ago
It exists already: https://www.dhs.gov/real-id https://www.dhs.gov/real-id

dawnerd 9y ago

Also important that whatever happens, they make it easier for people to revoke their id and get a new one.

njarboe 9y ago

The main problem trying to be fixed here is "identity theft". What that crime is, I think, is not clearly understood. This is when a criminal defrauds a bank or other company by getting credit using your identifying information and then defaults. The bank then misinforms the credit bureaus that you defaulted on your loan and this lie by the bank hurts you when you want to get any type of loan. This crime would be better called "bank slander" and the banks that do it should be fined heavily with some money going to the person slandered. Banks should have to know who they are loaning money to and if they make a mistake, that needs to be solely their problem. Then banks will figure out ways to confirm your identity better and people won't get into the hell that is trying to get the "bank slander" removed from their credit report.

unabst 9y ago
The banks should definitely be made responsible and made to pay for all the fraud they sign off on at all of their desks. We already know what happens when the banks run out of money. They get bailed out. That means they will NEVER be the victim. That means we can make them pay for bailing out fraud victims and taking the hit on their behalf. It should be a service, a duty, and an honor. But that will never happen, because this is America.
Terr_ 9y ago
Exactly, "identify theft" is usually just weasel-wording for "someone broke our lazy authentication system". Followed by "and we compounded our failure by falsely telling lots of other institutions that it was your fault." https://www.youtube.com/watch?v=-c57WKxeELY https://www.youtube.com/watch?v=-c57WKxeELY There won't be any improvement until the legal system creates a stronger incentive for institutions to be more secure.
- psyc 9y ago
  The term itself is almost ambiguous. Popular interpretation: "Theft of an identity" Better interpretation: "Theft, by forging an identity"
djsumdog 9y ago

bflesch 9y ago

How about fingerprinting and other biometrics as a replacement? This would be a solid solution, easy to implement and could be integrated with already existing storage systems?

JumpCrisscross 9y ago
Biometrics are not replaceable when they are stolen.
- zamalek 9y ago
  Furthermore, they may not be unique.[1] We are also very far off from being able to trust the technologies that read biometrics, especially for the incompetents that the government usually contracts. I can't find the source, but there was a post/comment on HN linking to a bio engineering lab where they found that any fingerprint was being accepted. Your cell phone is likely light years ahead of anything a government contractor would put in place. [1]: http://www.telegraph.co.uk/science/2016/03/14/why-your-fingerprints-may-not-be-unique/ http://www.telegraph.co.uk/science/2016/03/14/why-your-finge...

nthj 9y ago

My first inclinations are that Apple and Google should be in these committee meetings. 77% of Americans own smartphones [1]. 99.6% of new smartphones run Android or iOS [2]. I would love for my iPhone to generate a private/public key pair, with the private key stored on the Secure Enclave. To register my public key, I fill out, on my phone, a bit of basic public information: full legal name, place & date of birth, and my current address and submit it. My phone suggests a nearby SSA office and proposes several appointment times, reminding me the day of. At the appointed time, I take my phone, passport, birth certificate, SSN card, driver's license and recent electric bill with my address on it to the local SSA office. [3] There, the administration manually inspects and verifies my documentation. Their systems then sign the authentication along with the current location, the time, the official's ID number, and a sha256 hash of a photo of me and the official holding up today's paper. My phone chirps, I use my passcode/Touch ID/Face ID/Dance ID to digitally counter-sign their authentication. This assures me that when the SSA's private keys are rotated because of inevitable compromise or on a routine schedule, my public key was not overwritten by the attackers. The SSA administration publishes my public key in their online directory. Private companies can download the public key directories and cache them, or pay Stripe-like vendors for just-in-time lookups. When I want to apply for a credit card, my phone chirps and I sign the credit request, just like Apple Pay. When I lose my phone, I run by the SSA office again before I apply for another credit card. Empowered by this new security layer, Congress passes a law establishing that no one can be held liable for—and credit decisions may not be made against—accounts that have not been digitally signed for any citizen who has a verified public key. And then I remember healthcare.gov and I wonder if I should even press submit. [1] http://www.pewinternet.org/fact-sheet/mobile/ http://www.pewinternet.org/fact-sheet/mobile/ [2] https://www.theverge.com/2017/2/16/14634656/android-ios-market-share-blackberry-2016 https://www.theverge.com/2017/2/16/14634656/android-ios-mark... [3] I wouldn't necessarily need to have all of these kinds of documentation, but the public directory system would be able to indicate which forms of identification I did have at time of authentication, for third parties to weigh the risk of identity theft.

andrewflnr 9y ago
So my legal identity is tied to proprietary hardware? Hardware that I arguably don't even meaningfully own? Running software with, especially in the case of Android, an atrocious security record? A secure enclave won't help if hackers just get the OS to call it to sign something malicious. It also kind of sucks for people who can't afford a smart phone.

matt_wulfeck 9y ago

Recently my grandmother passed away. We found her social security card (from 1932) and it says very clearly "NOT FOR IDENTIFICATION". It seems some lessons are lost.

temporallobe 9y ago
I was at the DMV with my daughter getting her learners permit (shows my age), and we had her passport, but they insisted on seeing her SSN card as well. Luckily we had it, but I found it absurd that a passport was not enough! Yes, my state is full dumbasses.
- Spooky23 9y ago
  Not really. The passport seems to meet the identity proofing criteria, but it’s a little more complex. It sounds like it was in your case used as a proxy for your kids’ birth certificate. They require a second identity point when you have a document that substitutes for your birth certificate. Your passport + birth certificate would be ok in most states. Passports don’t meet all requirements because there are corner cases with certain passport types.
tzs 9y ago
That refers to the card, not the number. For some discussion of the history of this, see this old Straight Dope column: http://www.straightdope.com/columns/read/141/why-does-my-old-social-security-card-say-it-cant-be-used-as-id http://www.straightdope.com/columns/read/141/why-does-my-old... PS: did you typo the year? Social security numbers were first assigned in 1935, and social security cards were first issued in 1936.
- matt_wulfeck 9y ago
  Yeah it’s a typo. She was in 1932 but her card came after.

ugh123 9y ago

Great that they're finally attempting to do something. But I get a little annoyed that congress always seems to act fast when its something that might actually affect them. Otherwise its back to partisan do-nothing.

matt_wulfeck 9y ago

What I want is control. I want to know who is accessing my credit history and for what purpose. And I want control of what accounts and business are able to access it. The government can accomplish this by providing your identify in a way that provides this control and transparently, and requiring that businesses/third-parties come through this gateway for identification.

DonHopkins 9y ago

I worry that they'll figure out that the easiest way to ditch social security numbers is to ditch social security.

cesarb 9y ago

> Multiple times throughout the hearing, Brazil’s Infraestrutura de Chaves Públicas system of citizen IDs through digital certificates came up as a potential model for the U.S. as it moves forward. That made it sound as if every Brazilian had one of these, and it were the main citizen ID. That's not the case. Here in Brazil, the main ID is the RG (Registro Geral), which is an identity card made of paper, issued by any of the 26 states (plus the Federal District). Since it's issued by the states, a single person can have more than one RG. We also have the equivalent of USA's SSN, here called the CPF. Like the SSN, it's used as the person's tax ID, and is a national number. It's also issued as a card made of paper, but unlike the RG, it cannot be used for identification, since it has no picture or fingerprint. For simplicity, if you already have a CPF number when your RG is issued (or re-issued), you can have the CPF number printed on the RG card. It's with the CPF that the "Infraestrutura de Chaves Públicas" (ICP) comes into view: you can get a certificate associated with your CPF, and use it for instance to sign your taxes. But it's not required, and most people don't have that certificate, or even know that it exists. In my opinion, the reason we don't have the same problem as the USA is not some fancy digital certificate stuff, but the simple fact that the CPF number by itself does nothing: everybody also wants to see the RG card. And for income taxes, the electronic form also requires a number found in the previous year's income tax receipt. The income tax return will be deposited into a bank account of your choice, but AFAIK it only accepts a bank account where the account owner has the same CPF, and to open a bank account you need the RG (plus other documents).

tabtab 9y ago

SSN is FINE as a simple identifier. The problem is that organizations try to use it like a PIN code or password. It should NEVER be used as proof of identity per transaction requests. Software Engineering 101: Use the right tool for the job. If an org needs a PIN code or password, make one.

tomschlick 9y ago

To me, a good solution would be a chip-based smart card with a private key on it for physical proof of identity, and an oauth api for web based stuff. The api would also power the back-end of the in person transactions and issue the vendor a token which they would use from that point forward. In this system, everything would be logged in terms of who/what accessed your data and it could be de-authorized at any point. The cards themselves could just be each state's ID/Drivers License to avoid the scare of the national id that many are opposed to for one reason or another. Replacing an ID would be as easy as visiting your DMV (shudder) and them invalidating your old private key.

chatmasta 9y ago
You would rather the government store 300 million identifiers instead of Equifax? There are crypto solutions to this problem, but they’re not as simple as symmetric encryption and smart cards. An ideal system will also enforce rules for storage and access. Something like your data is always encrypted with your own private key, and you can authorize bits of the data at a time to third parties.
- tomschlick 9y ago
  No, the government wouldn't store anything other than the basic identity (which they already do) and issue verification tokens. The accessor would store their proprietary info as well as the access token to person's private info on the govt api. Full blown crypto solutions to this don't really scale well and present many problems where the accessor would need to keep asking you for info to see if it changed. My solution solves the main problem of having a universal number that can get your identity stolen. If we can fix that we have solved 90% of the problem and can work on other things like privacy of said data at a later date.

shmerl 9y ago

Long time overdue.

gumby 9y ago

How does it work in countries where the opposite is true (e.g. Sweden, where the "personnummer" is public info)? Why is there not massive identity fraud there?

mickronome 9y ago
For everything where identity is important there is liberal use of an ID card of decent quality, one with several counterfeiting features. Any drivers license also doubles as one. Online an electronic signature of some kind is used, exactly which varies a bit, but the one called BankID is accepted in most places. Long rambling post ahead, I'm really, really terrible at writing something mostly coherent on the phone, apologies to everyone, but the above paragraph really is the only important part of this comment :) For bigger financial transactions, if your counterpart is a company they will often do a credit check, which the credit checking provider is then by law required to inform you about through regular mail. Sensitive online services from government and other companies mostly use some version of an electronic ID, the most common is generally known as BankID, despite of its name it's simply an embodiment of an electronic ID. BankID got its name because it is provided by Bankgirot, a clearinghouse company with a long history in which most of the major Swedish banks have some ownership. Another implementation is provided by Telia AB, a formerly state owned telecommunications provider. It's not a bulletproof system by any means, but for the most part it appears to work. However, I'm not too enthusiastic about the eagerness to adopt "BankID on your mobile phone”. It feels like it's only a matter of when, rather than if, someone will manage to exploit it through som security flaw in some of the popular smart phones. Which will inconvenience a lot of people until banks - most likely - simpy roll back the transactions, as is in the digital realm it's hard to disappear money when literally everyone gets assigned an ID. Tangentially, the most common way used to create legitimate companies for illegal activities AFAIK, at least used to be to pay of some substance abuser or petty thief to use their identity, and simply have them take the fall when/if things go south. So apparently, creating fake identities would appear to be rather hard. Because the ubiquity of the personal number, and the liberal use of good quality ID cards. This number connected through tax, loans, land ownership, insurance etc, makes it somewhat hard to make money leave the digital world without trace. It would also be terrible in the hands of a competent totalitarian regime or fundamentalist (of any sort) government. Sometimes I think we subconsciously avoid that by voting for mostly uncharismatic leaders with little appeal except for them promising a little bit more money in your wallet, better social security, healthcare, child care, or school. In all cases better can be read as more available, efficient, and ecological from the left - and higher fees, stricter requirements, and lower availability from the right. But I digress. There have been some areas of law/contract where identity theft was easier, notably land ownership/property laws. IIRC in the property laws it was essentially stated that a signature on paper with two witnesses signatures was indirectly used as proof of identity. Unsurprisingly, this led to some people getting their homes sold by third parties, and having to face a rather arduous legal procedure to get back to square one. Yeah, that one was rather monumentally stupid, but it wasn't really caused by the personnummer being public.

Overtonwindow 9y ago

I think more power needs to be given to the person whose identity is stolen. Similar to how the chip and pin system was rolled out: If a fraud is committed, the entity with the least secure method of transaction pays. That pushed retailers to upgrade their systems.

Nomentatus 9y ago

I've suggested this before here, but the card companies need to give other companies like Equifax reference numbers to store that uniquely identify the card to the credit card company (or others) but don't give the credit card number and don't get anybody closer to charging anything on the card.

ActsJuvenile 9y ago

It is quite straightforward to upgrade SSN system. Social Security Administration can generate deterministic Private+Public key pairs for all citizens. Public key is your new SSN. If it gets stolen, simply generate a new public key, and give it out as a new number. All public keys are easily verified since SSA knows the private keys.

amorphid 9y ago
Just don't make me memorize a 4096 bit key :)
- chrisper 9y ago
  Why do you even need to memorize something like this? In any other country you do not memorize your tax ID... You just look it up when you need it.
  - amorphid 9y ago
    It's pretty normal to memorize your 9 digit social security number, in the same way you know your phone number. Because the SSN card is a fundamental piece of identity theft, it's common practice to NOT carry the number in your wallet. You never know when you'll need the number, and very rarely need the actual card. I don't think I've ever used my physical SSN card in the last 5 years, but I need to provide the number itself quite often, especially on financial, employment, and government documents. We still use paper checks, too. Good times.

mrhappyunhappy 9y ago

Instead of creating security systems around sensitive data, make data useless to thieves.

yason 9y ago

The problem is if social security number is used not only for identification but authentication. Knowing someone's SSN shouldn't ever get you anything: SSN could as well be public information, ideally. I don't know about the US but where I live, bank account numbers are effectively public: you could publish yours on the internet and all people could do is put money on your account. The bank will then require official authentication if you wish to use the account number to withdraw money. Using an unique identification number for authentication is authentication by proxy. Yes, it's highly likely that only the right person knows his own number but never guarantees anything. Make authentication easy and solid and the bar for frauding through stolen identity goes up.

olegkikin 9y ago
What we really need are private keys, stored in hardware, like secure enclave. Whenever someone wants a proof of your identity, they ask you to sign a certain message with a timestamp.

njharman 9y ago

The problem isn't that we have numbers. It's that corporations have little incentive to protect them. Right now it's cheaper (i.e. more profitable) to do as little as possible and when/if they get hacked just pay extra on PR/lobbying for a couple weeks/month until someone else gets the public's attention. Enact Huge (like $1000 per person exposed) fines, corporate death penalty, jail time for people in charge. And, I can guarantee you, companies will start actually protecting their data.

alphaalpha101 9y ago
This is one of those cases where you have to be careful. Yes maybe putting huge fees on them gives them the 'incentives', but the market doesn't do what you expect most of the time. Put big fees on their failure, and they might just find more ways to deflect the blame. Corporations need to have strict liability. And in the meantimes, take away strict liability from actual humans, given that it's incredibly unethical to hold someone responsible for something they had no intent to do.
castratikron 9y ago
Senator Baldwin got Equifax to admit this in the hearing (around the 1:23:00 mark): https://www.youtube.com/watch?v=LunazYJGNXU https://www.youtube.com/watch?v=LunazYJGNXU

Yizahi 9y ago

> “The parade of high-profile data breaches seems to have no end,” said ranking committee member Bill Nelson. “We can either take action with common sense rules or we can start planning for our next hearing on the issue.” So true.

StreamBright 9y ago

It would be easy to introduce a pin protected chip card and use 2FA all the time for everything. But in the US even credit cards do not have chip and if they do it does not have a pin. The rest of the world using these security measures for almost a decade.

opportune 9y ago
Good luck getting Grandma to understand that
- StreamBright 9y ago
  Should we organize the world around what grandma understands? How many grandmas are out there vs how many people who understand at the very least pin codes?

jerianasmith 9y ago

So regardless of the possibility that somebody gets simply part of your number, it can be anything but difficult to make sense of the rest. Analysts in 2009 composed a calculation that could foresee a Social Security number effectively 44 percent of the time in the United States.

ahallock 9y ago

Why were businesses ever allowed to use SSNs in the first place?

alkonaut 9y ago

On a related note: have many in the US swicthed to locked mailboxes? Without locked mailboxes, you can't even use the slow address/snail-mail 2FA that should be used for certain transactions when you don't have E.g. if I want to take a loan, I'd say who I am and the bank would send the papers to sign to my mail address. Only after I sign the papers will I get the money. Someone pretending to be me would have to stalk my mail box (time consuming and hard because it's locked), or first change identity records to associate my name with his mail address. This greatly increases the difficulty of this kind of fraud. From just needing a fake ID, to either having to commit a long stalk of my mailbox and commit physical mail theft OR having to do a multiple phase fraud where authority address records are first changed. Obviously this all hinges on a) id required to open bank account, b) central registry that maps id to mail address, separate from the bank.

nnq 9y ago

Isn't it obvious that this scandal was either provoked or amplified in order to make Americans get themselves mandatory government IDs with chips and biometrics? ...not that that would be a bad thing. Just getting in line with EU and the rest of the world, finally. Mass monitoring would at least become a few order of magnitudes cheaper hopefully spending those funds on more socially useful things. Offer a chip-less option for more privacy paranoid people, so that at least they can't be tracked remotely when they don't carry their phones (yeah, some countries have this option system). And it's all nice and dandy. As an European, I find it mind boggling when I see people without adequately secured and mandatory IDs in the US...

itissid 9y ago

I think one more thing that needs to be understood is how can one dynamically establish identity. I have never built a cryptographic system, but I thought maybe the following could be better: Lets say Alice is a person wanting to establish Bob's identity. 1. Bob must be the only person who retains control over his identity. 2. Bob can verify he is who he says by a distributed system and Alice gets only a Yes/No answer. 3. All verification can be done using a distributed fashion, something like bitcoin/blockchain. The most important thing here would be an implementation of the distributed nodes and how bob's information is authenticated. But I think all these parts already exist. Political and Business will is needed.

igorgue 9y ago

What's Yahoo doing there? Why is she still employed by anyone? LOL...

jwatte 9y ago

SSNs are fine identifiers (user names.) The problem is that people try to treat them like authenticators (passwords.) Using SSNs as identifiers everywhere would reduce lots of mistakes and bugs. Having a national ID system and modern ID documents/verification would reduce fraud. These would go very well together!

GigabyteCoin 9y ago

>Today, the Senate Commerce Committee questioned former Yahoo CEO Marissa Mayer, Verizon chief privacy officer Karen Zacharia and both the current and former CEOs of Equifax on how to protect consumers against major data breaches. That has got to be some kind of joke. Why would they ask the former leaders of two companies (Yahoo and Equifax) who have experienced perhaps the largest data breaches of all time... "how to protect consumers against major data breaches?" That is ridiculous. They should have asked the current head of security from each company instead.

franksunjin 9y ago

social security number is racist

pimmen 9y ago

In Sweden we have a national id number given at birth which can be Luhn checked just like a credit card, and we use a digital id bound to a device with an pin number. We use them both in conjunction for online banking, filing taxes and all kinds of things and we have a dramatically lower rate of identity theft than the US. The national id has been here for a long, long time and the digital id has been here for more than 10 years.

donkeyd 9y ago
Many Americans are just really afraid of anything being controlled by the government. It's why they keep doing stuff that us Europeans don't understand, like not having strict gun control, not having affordable health care, not having acceptable social security, etcetera. Americans tend to hate government more than they love themselves and others. Having lived in the US it really bothers me, since there are so many great, caring people there that I don't understand why they keep doing what they do.

braeckmansj 9y ago

Hi guys, My name is sarah pith i am located in USA,Texas. i will like to publish the hand work of God to the general public. God has been very grateful to me and my family. 5months ago i was seriously searching for a loan worth $90,000.00 to buy a house in the USA. And i was scammed by various lenders online, but 2weeks ago i saw a post about ATM blank cards. I doubted this but decided to give it a try by Contacting them through this email on(braeckmansj@outlook.com) they responded with their guidelines on how the card works. i’was assured that the card can withdraw $5000 instant & was credited with $500,000.00 so i requested for one & paid the purchasing fee to obtain the card. 72 hrs later, i was shock to see the DHL agent in my resident with a parcel{card} i signed and went back inside and confirmed the card works after the agent left. This is no doubts because i have the card and i have made used of the card. This hackers are europe based hackers set out to help people with financial freedom!! Contact them today on(braeckmansj@outlook.com) if you want to get rich with this card.