5 ms·

In the meantime a whole bunch of organizations started accepting 'usernames' as passwords

by m12k 8y ago

jrumbut 8y ago
I don't think this should be voted down, the SSN was originally designed as a sort of username for tracking earnings, before anyone realized how important it would be to have a password. An SSN was not designed to be a unique secret identifier held by every individual. But we have used it that way, and built a house of cards on it. "In 1938, a leather factory in Lockport, New York attempted to capitalize on the excitement around the country’s newly-formed social insurance program by tucking duplicate Social Security cards into its wallets. Company vice president and treasurer Douglas Patterson thought it would be cute to use the actual Social Security number of his secretary, Hilda Schrader Whitcher. Real Social Security cards had just begun circulating the year before, so many Americans were confused. Even though the display card was marked "specimen" and sold at Woolworth’s, more than 40,000 people adopted Hilda’s number as their own. According to the Social Security Administration, no fewer than 12 people were still using their Woolworth’s-issued SSN in 1977." https://www.theverge.com/2012/9/26/3384416/social-security-numbers-national-ID-identity-theft-nstic https://www.theverge.com/2012/9/26/3384416/social-security-n...
- bsimpson 8y ago
  For a long time, the last 4 digits of a SSN were the only ones with any entropy. The first 5 were determined by when and where you were issued an SSN (usually at the hospital when you were born). Suppose your number is 123-45-6789. If an attacker can uncover that you were born in Springfield in December 1989, they can deduce that the first 5 digits are likely 123-45. Now, there are only 9999 possibilities for what your full SSN might be. Moreover, the only random bits are routinely used by utility companies, hospitals, etc. as an oral password and written identifier. If someone reads or overhears that your last 4 are 6789 and knows when/where you were born, they have a frighteningly good chance of discovering your SSN.
  - jrumbut 8y ago
    That's true, also at this point a pretty substantial percentage of social security numbers have been leaked (perhaps all of them, not every hacking victim goes public).

In the meantime a whole bunch of organizations started accepting 'usernames' as passwords

by m12k 8y ago

In the meantime a whole bunch of organizations started accepting 'usernames' as passwords

I don't think this should be voted down, the SSN was originally designed as a sort of username for tracking earnings, before anyone realized how important it would be to have a password. An SSN was not designed to be a unique secret identifier held by every individual. But we have used it that way, and built a house of cards on it. "In 1938, a leather factory in Lockport, New York attempted to capitalize on the excitement around the country’s newly-formed social insurance program by tucking duplicate Social Security cards into its wallets. Company vice president and treasurer Douglas Patterson thought it would be cute to use the actual Social Security number of his secretary, Hilda Schrader Whitcher. Real Social Security cards had just begun circulating the year before, so many Americans were confused. Even though the display card was marked "specimen" and sold at Woolworth’s, more than 40,000 people adopted Hilda’s number as their own. According to the Social Security Administration, no fewer than 12 people were still using their Woolworth’s-issued SSN in 1977." https://www.theverge.com/2012/9/26/3384416/social-security-numbers-national-ID-identity-theft-nstic https://www.theverge.com/2012/9/26/3384416/social-security-n...

bsimpson 8y ago
For a long time, the last 4 digits of a SSN were the only ones with any entropy. The first 5 were determined by when and where you were issued an SSN (usually at the hospital when you were born). Suppose your number is 123-45-6789. If an attacker can uncover that you were born in Springfield in December 1989, they can deduce that the first 5 digits are likely 123-45. Now, there are only 9999 possibilities for what your full SSN might be. Moreover, the only random bits are routinely used by utility companies, hospitals, etc. as an oral password and written identifier. If someone reads or overhears that your last 4 are 6789 and knows when/where you were born, they have a frighteningly good chance of discovering your SSN.
- jrumbut 8y ago
  That's true, also at this point a pretty substantial percentage of social security numbers have been leaked (perhaps all of them, not every hacking victim goes public).