5 ms·

The problem is that it's a username that is used as a password. In Europe you'd use some kind of tax identification number plus a physical copy of an ID card or

The problem is that it's a username that is used as a password. In Europe you'd use some kind of tax identification number plus a physical copy of an ID card or driving license. My identification number is algorithmically derived from place and date of birth, first and last name and gender. Anybody who knows my address and has heard someone greeting me happy birthday can guess mine with two-three trials corresponding to the closest hospitals. But that doesn't worry me, because I don't fear identity theft, it just doesn't exist in Italy. Instead, as a result of America's allergy to ID, they are essentially the only country where identity theft is a thing.

path411 6y ago
5 out of the 9 numbers for an American social security number is also derived from location and date of birth.
- mdturnerphys 6y ago
  This was finally done away with in 2011. I only found out because I was surprised that our second child's SSN (issued in 2012) had a different prefix than that of our first child (2009).
liversage 6y ago
I live in Denmark so also Europe. Our social security number (which can be guessed with enough information and a few tries) has been incorrectly used as a password instead of a key just like you describe. You make a call, provide this number and the clerk on the phone believes that you are who you claim to be. Nowadays things are better because computers are used everywhere We have a national ID system using 2FA which is pretty safe. Unfortunately, identify theft is still a thing. Recently someone installed keyloggers on public computers. The second factor in the 2FA is a cardboard card with a list of one time password codes. You use a code on each sign in. The criminals were able to determine when there were only a few codes left on the card. You then get a new cardboard card sent to your home address. They would stalk their victim's mail box and steal the new card as soon as it arrived. With user name (your social security number) and password from the key logger together with the 2FA codes they were able to perform identity theft. It's not easy to guard against attacks like this.
- bonzini 6y ago
  Absolutely, but it's more effort than knowing an SSN and being immediately able to get a loan in the name of that person. That would be ridiculous in Europe.
  - kortilla 6y ago
    That’s pretty ridiculous in the US as well. An SSN is never enough. Usually they will need some copy of a state ID and proof of access to a mailing address on your credit history.
    - bonzini 6y ago
      I didn't say that, the US government does: > Identity thieves can use your number and your good credit to apply for more credit in your name. Then, they use the credit cards and don’t pay the bills, it damages your credit. You may not find out that someone is using your number until you’re turned down for credit, or you begin to get calls from unknown creditors demanding payment for items you never bought. https://www.ssa.gov/pubs/EN-05-10064.pdf https://www.ssa.gov/pubs/EN-05-10064.pdf
      - kortilla 6y ago
        That’s not how it works though in the vast majority of US financial institutions though. They won’t just send a credit card to a random address. That document is written to scare people into protecting their SSN. It’s discussing what is now an edge case that may have been easier 20 years ago.
- Svip 6y ago
  While all that is accurate, it should be noted that they have already mitigated some of the problems mentioned above (no more displaying number of keys left), but also that the entire system is being replaced this year with one that does not rely on a physical cardboard key card, but can use something like a Yubikey instead. You can also change your username to something other than your CPR-number. Indeed, the problem lies more with other services that has used it as a password rather than 'username'. But those are rarer to come by these days.
toyg 6y ago
> identity theft [...] just doesn’t exist in Italy Big lol. The country used to be famous for frauds and scams! Of course identity fraud exists, but precisely because everyone expects it, the majority of systems errs on the side of caution and requires validation from multiple sources. The result is that fraud processes become so much harder to pull off that fewer and fewer bad guys attempt it, but on the other hand every validation step becomes a bureaucratic nightmare (“did you include certificate X from office A, Y from office B, and Z from office C, as well as your ID card, health card, tax card, and recent pictures? No? Sorry, no cookie for you.”) This is also why the country has a pretty secure and advanced way to carry out official acts electronically (PEC) - because otherwise fraud would be even more rampant. I do agree that the “anglo” hate for ID documents (“such Napoleonic constructs, so barbaric!”) leaves the door open to scammers, but it’s not like they don’t exist in Italy too.
- bonzini 6y ago
  I see, the good old racist card. But no, you're wrong. I have opened bank accounts in three EU countries and the procedure was the same everywhere. No ID, no bank account. I still have to see a headline like "identity theft ruined my life" in any other language than English. Every single time "furto di identità" makes the news in Italy, it's just about someone impersonating a famous person on social media to scam the followers, which is a completely different thing than in the US. So yeah of course scams and credit card skimmers exist in Italy (though the US's disdain for chip and PIN would be another interesting topic). Dishonest telemarketers convince gullible people to switch into more expensive utilities contracts. But identity theft in the US is not in any way comparable to "scamming". And yeah, PEC ("registered email") is pretty cool. :)
  - dogma1138 6y ago
    Identity theft if very common in Italy for pension fraud, people don’t report deaths of their elderly parents and assume their identities to cash in pensions.
    - bonzini 6y ago
dmurray 6y ago
'No Way To Prevent This,' Says Only Nation Where This Regularly Happens.
icedchai 6y ago
When your identity gets stolen enough times, the IRS assigns you an identity protection PIN and mails you a new one every year. Too bad it's only useful for your taxes.
- bonzini 6y ago
  Just the fact that there is a process for that, and you have people whose "identity gets stolen enough times", is worth an Onion headline...
  - icedchai 6y ago
    The thieves filed a fake tax return in my name so they could steal the refund. The IRS takes that stuff pretty seriously, fortunately.

path411 6y ago

5 out of the 9 numbers for an American social security number is also derived from location and date of birth.

mdturnerphys 6y ago
This was finally done away with in 2011. I only found out because I was surprised that our second child's SSN (issued in 2012) had a different prefix than that of our first child (2009).

liversage 6y ago

I live in Denmark so also Europe. Our social security number (which can be guessed with enough information and a few tries) has been incorrectly used as a password instead of a key just like you describe. You make a call, provide this number and the clerk on the phone believes that you are who you claim to be. Nowadays things are better because computers are used everywhere We have a national ID system using 2FA which is pretty safe. Unfortunately, identify theft is still a thing. Recently someone installed keyloggers on public computers. The second factor in the 2FA is a cardboard card with a list of one time password codes. You use a code on each sign in. The criminals were able to determine when there were only a few codes left on the card. You then get a new cardboard card sent to your home address. They would stalk their victim's mail box and steal the new card as soon as it arrived. With user name (your social security number) and password from the key logger together with the 2FA codes they were able to perform identity theft. It's not easy to guard against attacks like this.

bonzini 6y ago
Absolutely, but it's more effort than knowing an SSN and being immediately able to get a loan in the name of that person. That would be ridiculous in Europe.
- kortilla 6y ago
  That’s pretty ridiculous in the US as well. An SSN is never enough. Usually they will need some copy of a state ID and proof of access to a mailing address on your credit history.
  - bonzini 6y ago
    I didn't say that, the US government does: > Identity thieves can use your number and your good credit to apply for more credit in your name. Then, they use the credit cards and don’t pay the bills, it damages your credit. You may not find out that someone is using your number until you’re turned down for credit, or you begin to get calls from unknown creditors demanding payment for items you never bought. https://www.ssa.gov/pubs/EN-05-10064.pdf https://www.ssa.gov/pubs/EN-05-10064.pdf
    - kortilla 6y ago
      That’s not how it works though in the vast majority of US financial institutions though. They won’t just send a credit card to a random address. That document is written to scare people into protecting their SSN. It’s discussing what is now an edge case that may have been easier 20 years ago.
Svip 6y ago
While all that is accurate, it should be noted that they have already mitigated some of the problems mentioned above (no more displaying number of keys left), but also that the entire system is being replaced this year with one that does not rely on a physical cardboard key card, but can use something like a Yubikey instead. You can also change your username to something other than your CPR-number. Indeed, the problem lies more with other services that has used it as a password rather than 'username'. But those are rarer to come by these days.

toyg 6y ago

> identity theft [...] just doesn’t exist in Italy Big lol. The country used to be famous for frauds and scams! Of course identity fraud exists, but precisely because everyone expects it, the majority of systems errs on the side of caution and requires validation from multiple sources. The result is that fraud processes become so much harder to pull off that fewer and fewer bad guys attempt it, but on the other hand every validation step becomes a bureaucratic nightmare (“did you include certificate X from office A, Y from office B, and Z from office C, as well as your ID card, health card, tax card, and recent pictures? No? Sorry, no cookie for you.”) This is also why the country has a pretty secure and advanced way to carry out official acts electronically (PEC) - because otherwise fraud would be even more rampant. I do agree that the “anglo” hate for ID documents (“such Napoleonic constructs, so barbaric!”) leaves the door open to scammers, but it’s not like they don’t exist in Italy too.

bonzini 6y ago
I see, the good old racist card. But no, you're wrong. I have opened bank accounts in three EU countries and the procedure was the same everywhere. No ID, no bank account. I still have to see a headline like "identity theft ruined my life" in any other language than English. Every single time "furto di identità" makes the news in Italy, it's just about someone impersonating a famous person on social media to scam the followers, which is a completely different thing than in the US. So yeah of course scams and credit card skimmers exist in Italy (though the US's disdain for chip and PIN would be another interesting topic). Dishonest telemarketers convince gullible people to switch into more expensive utilities contracts. But identity theft in the US is not in any way comparable to "scamming". And yeah, PEC ("registered email") is pretty cool. :)
- dogma1138 6y ago
  Identity theft if very common in Italy for pension fraud, people don’t report deaths of their elderly parents and assume their identities to cash in pensions.
  - bonzini 6y ago

dmurray 6y ago

'No Way To Prevent This,' Says Only Nation Where This Regularly Happens.

icedchai 6y ago

When your identity gets stolen enough times, the IRS assigns you an identity protection PIN and mails you a new one every year. Too bad it's only useful for your taxes.

bonzini 6y ago
Just the fact that there is a process for that, and you have people whose "identity gets stolen enough times", is worth an Onion headline...
- icedchai 6y ago
  The thieves filed a fake tax return in my name so they could steal the refund. The IRS takes that stuff pretty seriously, fortunately.