7 ms·

>The target was a Vietnamese man named Hieu Minh Ngo. Investigators believed he was a big-time identity thief who sold packages of data known as “fullz,” each o

>The target was a Vietnamese man named Hieu Minh Ngo. Investigators believed he was a big-time identity thief who sold packages of data known as “fullz,” each of which typically included a person’s name, date of birth, mother’s maiden name, Social Security number, and e-mail address and password. Criminals could buy fullz from Ngo for as little as eight cents and then use them to open credit cards, take out loans, or file for bogus tax refunds. [...] He had allowed nearly 1,400 criminals to access a database containing the personal information of 200 million U.S. citizens—almost two-thirds of the population. If two thirds of Americans have had all of that information compromised from this one incident alone, why do we use it as authentication for anything? Shouldn't the SSN be replaced/assisted by a key pair?

simplicio 7y ago
I always thought the Gov't should just publish everyones SSN. That would prevent institutions from trying to use them as psuedo-passwords, while making them more useful for their actual purpose of providing a unique identifier for individuals.
- Qwertystop 7y ago
  Problem: Too many places already use them as pseudo-passwords, and no amount of forewarning would stop at least some of them from not moving away from that in time.
pjc50 7y ago
Americans are dead-set against having a working national ID system. There are even people who are upset about the mere existence of the SSN for weird religious reasons. The British situation is even worse - proof of right of residence is required for opening a bank account, working, or renting a home, but only immigrants are made to have ID cards. Also utility bills are a valid proof of address for some reason. No, the real problem is a liability one; loan companies should be held liable for each instance of fraud where they pursue the wrong person.
- ed312 7y ago
  Only if loan companies can freely deny loans to folks who cannot prove their credit worthiness (spoiler alert: that's a lot of lower class/immigrants/disadvantage populations). Credit is a complex problem that simple "common sense" solutions will never adequately address.
  - jermaustin1 7y ago
    Actually I think @simplicio might have hit the nail on the head. If you want to take out a line of credit from a bank, you have to be physically present at the bank to do so. It would inconvenience SOME who don't live near a bank and shopping loan offers around will be harder than going on Quicken Loans, but it would also make it nearly impossible for the giant crime-rings that outside of the US to steal identities and open up credit cards.
    - ed312 7y ago
      Every purchase you make with a credit card is a loan. Rapidly available, distributed credit is an amazing thing for society. I think both the genie is out of the bottle on the current credit paradigm. Forcing people to go to a physical location to conduct routine business should not be the primary solution to a problem in the 21st century.
      - Qwertystop 7y ago
        Yes, but the line of credit is the credit card, not the purchase. You wouldn't have to go to a bank every time you wanted to buy something on a credit card, but you would have to go there to get a card.
- simplicio 7y ago
  I wonder if just requiring someone to personally appear at a bank with an ID to get a line of credit would get rid of 90% of identity theft issues. While its hardly impossible to pretend to be someone else in person, it would increase both the risk and time-commitment necessary to commit the fraud enough that I doubt it would be worth the criminals time. On the other hand, opening a line of credit is something people do rarely enough that the extra time required for legitimate borrowers would be marginal.
Iv 7y ago
Governments are long overdue a good authentication system. Note that passports provide passable ones but not everyone has a passport. If you desire an optional government-enforced ID scheme, Estonia provides some even to non-resident. You need to go to an Estonian embassy with a valid passport and for a sum ($200 IIRC) they'll give you a card and a USB card reader that allows to sign certificates in a way that is authenticated by the Estonian government.
manigandham 7y ago
CGP Grey recently made a great video about this exact problem with social security numbers: https://www.youtube.com/watch?v=Erp8IAUouus https://www.youtube.com/watch?v=Erp8IAUouus They were started to keep of taxes and never meant to be used as IDs.

simplicio 7y ago

I always thought the Gov't should just publish everyones SSN. That would prevent institutions from trying to use them as psuedo-passwords, while making them more useful for their actual purpose of providing a unique identifier for individuals.

Qwertystop 7y ago
Problem: Too many places already use them as pseudo-passwords, and no amount of forewarning would stop at least some of them from not moving away from that in time.

pjc50 7y ago

Americans are dead-set against having a working national ID system. There are even people who are upset about the mere existence of the SSN for weird religious reasons. The British situation is even worse - proof of right of residence is required for opening a bank account, working, or renting a home, but only immigrants are made to have ID cards. Also utility bills are a valid proof of address for some reason. No, the real problem is a liability one; loan companies should be held liable for each instance of fraud where they pursue the wrong person.

ed312 7y ago
Only if loan companies can freely deny loans to folks who cannot prove their credit worthiness (spoiler alert: that's a lot of lower class/immigrants/disadvantage populations). Credit is a complex problem that simple "common sense" solutions will never adequately address.
- jermaustin1 7y ago
  Actually I think @simplicio might have hit the nail on the head. If you want to take out a line of credit from a bank, you have to be physically present at the bank to do so. It would inconvenience SOME who don't live near a bank and shopping loan offers around will be harder than going on Quicken Loans, but it would also make it nearly impossible for the giant crime-rings that outside of the US to steal identities and open up credit cards.
  - ed312 7y ago
    Every purchase you make with a credit card is a loan. Rapidly available, distributed credit is an amazing thing for society. I think both the genie is out of the bottle on the current credit paradigm. Forcing people to go to a physical location to conduct routine business should not be the primary solution to a problem in the 21st century.
    - Qwertystop 7y ago
      Yes, but the line of credit is the credit card, not the purchase. You wouldn't have to go to a bank every time you wanted to buy something on a credit card, but you would have to go there to get a card.
simplicio 7y ago
I wonder if just requiring someone to personally appear at a bank with an ID to get a line of credit would get rid of 90% of identity theft issues. While its hardly impossible to pretend to be someone else in person, it would increase both the risk and time-commitment necessary to commit the fraud enough that I doubt it would be worth the criminals time. On the other hand, opening a line of credit is something people do rarely enough that the extra time required for legitimate borrowers would be marginal.

Iv 7y ago

Governments are long overdue a good authentication system. Note that passports provide passable ones but not everyone has a passport. If you desire an optional government-enforced ID scheme, Estonia provides some even to non-resident. You need to go to an Estonian embassy with a valid passport and for a sum ($200 IIRC) they'll give you a card and a USB card reader that allows to sign certificates in a way that is authenticated by the Estonian government.

manigandham 7y ago

CGP Grey recently made a great video about this exact problem with social security numbers: https://www.youtube.com/watch?v=Erp8IAUouus https://www.youtube.com/watch?v=Erp8IAUouus They were started to keep of taxes and never meant to be used as IDs.