11 ms·

> Social Security numbers are the keys to the kingdom. In this country, people get a unique number when they’re born, and the Social Security Administration tel

• PeterisP 7y ago
  Regarding all the Social Security number issues, it somehow reminds me the Onion title "‘No Way To Prevent This,’ Says Only Nation Where This Regularly Happens" (I know USA is not literally the only one, but almost) - plenty of places have something similar to that number, but USA is pretty much unique is treating simply knowing it as some kind of identity proof. "Something you (and a bunch of others) know" doesn't cut it.
  • SmellyGeekBoy 7y ago
    Indeed, here in the UK we have the very similar "National Insurance Number" for tax reasons but it's never used for identification as it's assumed to be public knowledge.
    • sokoloff 7y ago
      There are multiple meanings of the word identification. SSN and NIN could reasonably be used for identification of the form of "this person's data is different from that person's data". (identification as in primary/unique key) They can't/shouldn't be used for authentication that this person is who they claim to be. (identification as in password)
      • SmellyGeekBoy 7y ago
        > They can't/shouldn't be used for authentication that this person is who they claim to be. 100% agreed, perhaps I should have worded my comment better. My point was that this seems to be common practice in the US but not over here.
      • TheSoftwareGuy 7y ago
        You're absolutely right. SSN's were only ever meant to be used for identification (as in a username). In the beginning the worst that could happen is that someone else would file their payroll taxes with your SSN, and make you eligible for more Social Security benefits when you retired. It was never meant to be a password.
        • lonelappde 7y ago
          How would you receive benefits if not by using SSN as a password? Or to get a job when you may not have authorization to do so (noncitizen not on a worker visa)
          • sokoloff 7y ago
            You use the SSN (acting as the username [which links to authority to work or claim benefits]) combined with another piece of information that establishes your identity (acting as the password to establish that it's really you and not me who is applying). For employment, the I-9 form is what we fill out as authorized US workers and to document same. https://www.uscis.gov/i-9 https://www.uscis.gov/i-9 (the "paper version" link works best) You'll note that Social Security card is in List C "documents that establish employment authorization" and not in List B "documents that establish identity" nor in List A "documents that establish both identity and employment authorization" I guess you can look at it as a form of off-line multi-factor authentication. You are using the Social Security card as proof of eligibility for the person whose identity you have already established using another factor. In that case, it's the card that acts as the factor, not the number (which if you've ever seen a social security card, it's ridiculous to think that it's in any way secure or even durable).
  • zaarn 7y ago
    In Germany we too have a SSN. Only my employers know it, it can be changed. I've never ever had anyone but the tax office or my employer ask for it.
    • Someone1234 7y ago
      Just being able to change it would be a huge improvement.
    • Semaphor 7y ago
      > In Germany we too have a SSN. Well, TIL. I guess no one ever asked me for it.
      • zaarn 7y ago
        It's rare, your employer can just ask your pension insurance to get it, some do this automatically, others ask specifically.
    • mike_ivanov 7y ago
      It's pretty much the same in Canada. I never seen it used for anything outside of the tax context.
      • smitop 7y ago
        This is because it's illegal to require a Canadian to provide their SIN, unless the use is on the list of exceptions [1]. One can still ask a Canadian for their SIN for reasons not on that list, but it is illegal to refuse service for not providing a SIN [2]. [1] https://www.canada.ca/en/employment-social-development/services/sin/reports/code-of-practice/annex-2.html https://www.canada.ca/en/employment-social-development/servi... [2] https://www.canada.ca/en/employment-social-development/programs/sin/protect.html#a4 https://www.canada.ca/en/employment-social-development/progr...
    • wongarsu 7y ago
      The German SSN is also trivial to query (if you don't have it at hand your employer can just phone the pension insurance) and is somewhat predictable. It's also only used for tax/pension purposes; if you steal mine you can basically only gift me money. The closer equivalent in Germany is probably the Personalausweisnummer (ID card number). Basically everyone has an ID card, and sometimes the number of the ID card is used as age verification or is written down as part of identity verification at a bank or similar. Assuming you verified that the ID card is genuine it's a good unique identifier that survives name changes; however its usefulness doesn't come from secrecy but the forgery-proof piece of plastic it's printed on. Also you can change it at any time within a few weeks by just getting a new ID card, and it naturally expires every ten years or so. I think a fundamental problem in the US is the requirement to verify identity via phone. In Germany that's just assumed to be impossible without a prearranged passphrase; when opening a bank account you verify identity by showing ID at the bank or a postal station or by waving your ID in front of a webcam during a live call.
  • Bartweiss 7y ago
    On a fundamental level, it's absurd to use the same datum as a unique identifier and an identity proof. The best analogy I can think of is signing up for websites with only a password, and then having to provide that password as an identifier any time you need support. Oh, and the password is almost impossible to change, and you're required to use it to sign in on a host of other sites.
    • elliekelly 7y ago
      I recently redeemed my Amtrak points for a free ticket and then needed to change the ticket which required a phone call. The gentleman on the phone asked me for my “points PIN” that was apparently required to change any Amtrak points reservations. I had never needed to change any points reservations before so I didn’t have one. Amtrak’s solution? I could set a PIN, right then and there, verbally with the agent over the phone. No logging into my account. No email or text message confirmation. They didn’t even ask to confirm my DoB or address. Nothing. I had only given him my reservation number. And not 30 seconds after creating my new PIN the same agent was then able to “verify” my identity/account by asking me... for my PIN.
      • c1yd3i 7y ago
        Based Amtrak.
      • newsreview1 7y ago
        ridiculous
      • astura 7y ago
        Krebs wrote about this sort of problem with airline boarding passes back in 2015. https://krebsonsecurity.com/2015/10/whats-in-a-boarding-pass-barcode-a-lot/ https://krebsonsecurity.com/2015/10/whats-in-a-boarding-pass...
        • tumba 7y ago
          Internet Archive copy of the IATA publication on boarding pass barcodes referenced in the Krebs piece. https://web.archive.org/web/20120324074139/https://www.iata.org/whatwedo/stb/documents/bcbp_implementation_guidev4_jun2009.pdf https://web.archive.org/web/20120324074139/https://www.iata....
  • TazeTSchnitzel 7y ago
    Because of the Swedish constitution, everyone in Sweden's name, address, birth date and, yes, personal identity number is completely public information. Thus the systems and processes in Sweden have necessarily developed around a threat model of a potential attacker knowing all these details. The solutions Sweden has to proving identity despite this are not exactly radical: photo ID documents, and secure ID apps (encrypted certificates) on phones or smartcards.
• rtkwe 7y ago
  > To that sorry list, I would add medical providers' offices (doctors and dentists), all of which seem to request social security numbers for some reason on their patient intake forms, when all they should need is the patients' insurance information as printed on their insurance card. Insurance information changes over time though so it's simpler to just request the government issued GUID and use that to make sure you're associating the patient files correctly. I think the only real solution would be for smart cards to come back into vogue and assign everyone a unique key along with their SSN. Proofs of identity for things that matter ie loans and other financial work could then be secured without significantly interfering with it's use as a unique identifier in cases where it doesn't need to be secure. (As wrong as it is to use SSNs that way it's ingrained enough in interactions and systems that trying to cut that off would be a big pain.)
  • toomuchtodo 7y ago
    Someone, somewhere, in US government needs to push for the same system Estonia uses for their national ID card. https://e-estonia.com/solutions/e-identity/id-card/ https://e-estonia.com/solutions/e-identity/id-card/
    • rtkwe 7y ago
      Yeah it's tricky because the US is a bit shy about national IDs for vague reasons that seem loosely associated with anti-authoritarian reasons and distrust of government. Sure we can't be forced to 'show us your papers' because they don't physically exist but the government knows who 99% of citizens are if they wanted to work at it even a bit and it's not like states are going to be the bastions of fighting back and they do have IDs pretty much everyone gets.
      • toomuchtodo 7y ago
        Indeed. No one cries foul on a passport or driver's license, but a national ID card is so draconian /s Maybe if you converted passports to smartcards, and then slowly turned it into a national ID you could make this work.
• omarhaneef 7y ago
  Tip: I leave the social security number blank for medical providers, and have never been asked for it verbally except once. I told them I don't feel comfortable with it, and the person said that was fine and moved on.
  • koolba 7y ago
    An innocuous "I don't remember it" also works with the rare paperwork handler who insists on filling it out.
    • ryandrake 7y ago
      Or just a random string of digits if they won’t take no for an answer. Many ways to skin this cat.
      • koolba 7y ago
        Knowingly writing gibberish could get you in trouble for lying on an insurance related form. Better to blame a “senior moment”.
• nickjj 7y ago
  Don't forget a DVD rental card at Blockbuster. Yep, they used to ask for it just to become a member but you could of course not fill it in and they would still accept your membership. I still remember them asking me for mine. Pure jokes. Here's an article from almost 15 years ago where one of the Blockbuster locations dumped a bunch of customer forms in the street where most forms had people's SSNs on it: http://legalshred.com/east-side-new-york-blockbuster-dumps-customers-records-street/ http://legalshred.com/east-side-new-york-blockbuster-dumps-c... > The trash pile included recent membership applications, each revealing the customer’s birth date, address, phone number, driver’s license number and signature. More alarming, each application also contained a credit card number and expiration date, and many included a Social Security number. Talk about a violation of privacy and leaking sensitive information. This is why you can't trust big companies with anything sensitive.
  • deleted 7y ago
    [deleted]
  • bjornjaja 7y ago
    What is Blockbuster?
    • graedus 7y ago
      A chain of video rental stores in the US edit: US and elsewhere https://en.wikipedia.org/wiki/Blockbuster_LLC https://en.wikipedia.org/wiki/Blockbuster_LLC
    • Rychard 7y ago
      https://en.wikipedia.org/wiki/Blockbuster_LLC https://en.wikipedia.org/wiki/Blockbuster_LLC A now-defunct chain of video rental stores.
• gondo 7y ago
  Is there any harm in choosing random number as your Social Security number? Since it is supposed to be secret how can anyone verify it? Apart from special situations like filling taxes where one would use the real SSN. I am not a US citizen and I have no idea what is the real life use of SSN.
  • Tushon 7y ago
    Insurance companies may request it for verification of the identity of patient.
    • gondo 7y ago
      If you would provide the same, but still random, SSN to the insurance company and hospital, what that be a problem? How would they ever find out it is not your real SSN?
      • astura 7y ago
        First of all that would be insurance fraud, and it would be illegal. Secondly, that wouldn't work, the insurance company already knows your SSN. If your insurance is provided through your employer your employer already gave it to your insurance company when they set up your benefits. You need to give your employer your real SSN to pay taxes. If your insurance is provided through the government (medicaid, medicare, tricare) then the government already knows your SSN. You BEST not be giving the government a fake SSN to collect benefits, that's all sorts of illegal.
        • gondo 7y ago
          Thanks for the info. It seems like plenty of organizations legally know the SSN. I am amazed that US government considers SSN to be private.
        • ryanlol 7y ago
          Is it fraud without the intent to defraud? >Secondly, that wouldn't work, the insurance company already knows your SSN It could totally work, it’s really easy to get a card open with another SSN and then accurint or whatever the insurance company uses will just return multiple SSNs.
• JJMcJ 7y ago
  Old timers told me when Social Security was first started, the American people were promised that the number would never ever be used for anything but Social Security. It's interesting, in Canada and probably other countries, the corresponding ID code cannot be used as primary key, like for employment records. And somehow their societies function.
  • cgh 7y ago
    In fact, in Canada you only have to give out your SIN when it is required by law, and you should never give it out otherwise: https://www.canada.ca/en/employment-social-development/services/sin/reports/code-of-practice/section-2.html https://www.canada.ca/en/employment-social-development/servi... Unfortunately, one of those lawful uses is to give one's SIN to banks who provide accounts that pay interest. That said, I don't think it's enough to impersonate someone.
  • jandrese 7y ago
    Yep, but the US never developed any alternative form of universal identification so people gravitated towards the SSN for that purpose, even though it was explicitly not to be used for that. What other options are there? Most other potential identifiers are full of pitfalls like input error, collisions, having things change, or simply being unknown by the citizen. Even something as simple as name, birthdate, and place of birth is chock full of problems. People transcribe records wrong, or were born out of the country in a place with no recordkeeping that no longer exists to parents who have since died. SSNs are far less complex and error prone. Their only major downside is that they only work for people who have them, which means your app can only service legal citizen Americans.
    • JJMcJ 7y ago
      Canada doesn't have a universal ID. Companies have to figure out a way to keep track of employees without using the Social number, for example.
      • jandrese 7y ago
• siculars 7y ago
  If you're giving your SSN to your doctor you're doing it wrong. Just leave the field blank. End of story. You don't need to give them your SSN and the practice has been largely phased out due to HIPAA.
• ryandrake 7y ago
  > We’re asked to hand over this number again and again to institutions that have failed to guard it. You’re asked to hand over the number, but you don’t always have to provide it. Really only the government needs to identify you with this number, and only for purposes related to the social security system. You don’t have to give it to your doctor’s office or bank. Often, a simple “I’d prefer not to disclose this because of identity theft” is fine. They may press you for it, and most people are too timid to resist. If they are insistent I’ll just make up a random string of digits and that’s always been ok. All they are looking for is nine digits so the computer form they are filling out lets them move on to the next page.
• andrewla 7y ago
  In other countries with ID numbers like this, I wonder how much of a difference is made by requiring that institutions be liable for fraud, rather than shielded from such fraud, forcing them to use more secure methods of verifying identity/possession by default. Example is chip+pin, which is widespread in Europe but not really available in the US. Chip+nothing (which is still better than a 16-digit number) is become more commonplace as the liability protections that the magnetic strip enjoyed are disappearing. People react in self-interest, and the fact that you become liable for fraud if you take the strip instead of the chip mean that there's a large incentive to move away from the magnetic strip. I'm sure if you dig into it you'd see similar provisions that protect other organizations, either throw law, regulation, or just protection of "industry standard practices", from being held directly liable if they use the SSN for identity verification rather than insisting on a more reliable hard-to-exfiltrate identifier.
  • bonzini 7y ago
    The difference is that they require other information. The Italian tax ID number is just an encoded version of data that's already in the form (name, gender, date and place of birth), but the form also requires an ID or driving license number and I have to hand a copy physically with a matching number and picture.
    • andrewla 7y ago
      Out of curiosity, who, specifically, is "they" -- is it the government for government services/taxes, or is it private companies for identifying you for taxation or employment eligibility purposes, or by private organizations (banks, credit cards) as an attestation of identity?
      • bonzini 7y ago
        I was mostly referring to banks, but it's also mostly true for government offices (tax offices, retirement agencies, voting stations, also the municipalities if you need some certificate etc.). Technically public officials can authenticate you without photo id, but it's most common to provide one especially outside small towns.
• grecy 7y ago
  I don't have a SSN (I'm not an American citizen), but I've spent quite a bit of time in the US. I had a bank account, drivers license, registered a car in my name, etc. etc. What stops you from just refusing to give out your SSN, or simply saying you don't have one (even if you do?) Obviously getting a credit card might be annoying, but to get around that I just put down a $500 "bond" and got a Credit Card with a $500 limit (so the bank was guaranteed not to lose it's money). Can you not just refuse to give out your SSN and still get on with life in America? (I get on OK without one)
  • aianus 7y ago
    > Can you not just refuse to give out your SSN and still get on with life in America? (I get on OK without one) That's really strange, is it because you're not employed in the US? I am not a US citizen but I have a US SSN because I lived there on a work visa (multiple times). Employers have always asked for my SSN to check my work authorization through e-Verify. Every time.
    • grecy 7y ago
      Right, I'm just a tourist (6 months at a time though, which gets me a drivers license, etc)