7 ms·

Giving my SSN to my employer seems reasonable because that’s how I pay in to social security. SSNs are fine as IDs (with time bound assumptions), the problem i

by mulmen 6y ago

Giving my SSN to my employer seems reasonable because that’s how I pay in to social security. SSNs are fine as IDs (with time bound assumptions), the problem is using them for authentication.

d4mi3n 6y ago
They are in fact not great IDs and the Social Security Administration asked very nicely for the rest of the country to not use them as a form of identification: https://www.youtube.com/watch?v=Erp8IAUouus https://www.youtube.com/watch?v=Erp8IAUouus A few reasons why SSNs are bad as IDs: 1. There are a number of situations where people will not have a SSN. 2. SSNs are "secrets" that need to be broadly shared to participate in many parts of business and government in the US. 3. SSNs lack many security and authentication mechanisms most forms of ID have (e.g. photo ID) There are folks in the US who rally against the idea of a national ID, but I've always thought it was a silly argument considering how pervasive and problematic SSNs are as a form of identification.
- hedora 6y ago
  4. SSN’s are not unique, nor were they designed to be, but people think they are.
- mulmen 6y ago
  If a living person has a SSN they can be identified by it [1]. That does not imply any individual can be identified by a SSN or that any SSN identifies an individual. The suitability of an SSN is situational for ID purposes. The video conflates identification and authentication to its detriment. Social Security Numbers are very good identifiers, that’s literally their purpose. Social Security Cards are poor authentication tokens because they contain no validation to prove the card holder is the person associated with the number. Or said another way, you cannot prove your identity (authenticate) with a social security card. I don’t see what built in validation of the number has to do with the security of the identifier. So again, the problem is using a Social Security Number or card for authentication. It’s fine as an identifier. [1]: Social Security Numbers can be reissued but this should only happen when the number is no longer in use.
  - mulmen 6y ago
    Too late to edit but apparently SSNs are not reused: https://www.ssa.gov/history/hfaq.html https://www.ssa.gov/history/hfaq.html Q20: Are Social Security numbers reused after a person dies? A: No. We do not reassign a Social Security number (SSN) after the number holder's death. Even though we have issued over 453 million SSNs so far, and we assign about 5 and one-half million new numbers a year, the current numbering system will provide us with enough new numbers for several generations into the future with no changes in the numbering system.
    - nathanaldensr 6y ago
      I wonder how this is possible when there are only one billion combinations of digits.
      - rodonn 6y ago
        There are only around 330 million Americans and about 5 million born/immigrated each year. 1 billion possibilities will be enough for about 100 more years. Presumably sometime before then we can replace or update the system (or worst case add one more digit).
- ACS_Solver 6y ago
  Somewhat tangential, but I've always found it weird when I read about strong opposition of some in the US to government ID, framing it as something that jeopardizes the indivdiual's rights. My perspective from a European point of view is different, a government system that provides some ID (which is good both for identification and authentication) is a crucial protection of my rights. I don't want anybody to be able to impersonate me, which means I want a universally accepted system of strong authentication. That's what government ID is to me, it's like a PGP keyring where the government is the introducer in the web of trust. In the absence of such a system, various ad-hoc systems emerge, and that's IMO why identity theft is so staggeringly common in the US - it's easy, and it's easy because very poor systems are routinely used for authentication. If I understand correctly, you can do a lot in the US with one-factor knowledge authentication, where the "something you know" are things like your name, address, DOB or SSN, all of which are exceptionally poor as authentication.
  - jhanschoo 6y ago
    One dimension to this is that racism and xenophobia is so nakedly tolerated including in the political class in the US, that many are fear that any governmental ID would only be half-heartedly rolled out to inconvenient and undesirable people in an effort to suppress their voice.
    - deleted 6y ago
      [deleted]
  - mulmen 6y ago
    While there is no Federal ID every state in the Union (to my knowledge) provides ID cards to citizens. These vary slightly from place to place but all contain verifiable identity (authentication). This may seem strange to outsiders but makes more sense when you consider the United States is a federation of sovereign states. The system is built on the idea of limited federal power with states sharing but retaining much of their own sovereignty. This has many of the benefits of any federated system and makes for a robust democracy. There’s very little of consequence you can do in the United States with single factor knowledge. If identity theft is more common here than elsewhere (citation needed) I would guess it has more to do with a lack of consequences (consumer protection) than a Federal ID.
- swiley 6y ago
  I'm pretty sure I read somewhere SSNs aren't even guaranteed to be unique.
urda 6y ago
> SSNs are fine as IDs No, they actually are NOT fine for ID or authentication. They contain no security features and if an attacker knows their victim's birth location can often determine the first set of digits of an SSN. SSN are not fine as IDs.
- iso1631 6y ago
  My name + address is fine for ID, everyone knows it, but it's unique. There are no security features on my name. I could claim my name is Joe Biden and I live at 1600 Pennsylvania Avenue, just like I could go onto HN and claim my userid is urda, that isn't a problem. The next step would be to authenticate - and that's where the problem comes -- SSNs and names are no good for authentication. They're a userid.
  - Daho0n 6y ago
    "Please identify yourself" doesn't mean "give me a random name" but "prove who you are". It is a mess but To ID is to authenticate who you are.
    - rocqua 6y ago
      In colloquial use, you are right. In rigorous use in security, identification just means unambiguously referring to a specific identity. This is as simple as providing an identifier. Which the social security number roughly does (they can be re-used after death apparently). Actually proving the provided identity is your identity is authentication. SSNs come with no decent authentication method. Hence, the identifier of an SSN is not very good in situations where authentication is required. For an example where authentication of identifiers is not required. Consider the following: "Dear business please identify all your employees so we can correctly give them benefits". In this case, having identifiers for people is sufficient. Heck, any case where you are asked to identify a 3d party cannot require authentication. Strictly speaking "please identify yourself" means please give me your name. If this is spoken by someone with authority they may want prove of that claim. In that case, it is great if authentication of your given identifier is possible.

by mulmen 6y ago

Giving my SSN to my employer seems reasonable because that’s how I pay in to social security. SSNs are fine as IDs (with time bound assumptions), the problem is using them for authentication.

d4mi3n 6y ago

They are in fact not great IDs and the Social Security Administration asked very nicely for the rest of the country to not use them as a form of identification: https://www.youtube.com/watch?v=Erp8IAUouus https://www.youtube.com/watch?v=Erp8IAUouus A few reasons why SSNs are bad as IDs: 1. There are a number of situations where people will not have a SSN. 2. SSNs are "secrets" that need to be broadly shared to participate in many parts of business and government in the US. 3. SSNs lack many security and authentication mechanisms most forms of ID have (e.g. photo ID) There are folks in the US who rally against the idea of a national ID, but I've always thought it was a silly argument considering how pervasive and problematic SSNs are as a form of identification.

hedora 6y ago
4. SSN’s are not unique, nor were they designed to be, but people think they are.
mulmen 6y ago
If a living person has a SSN they can be identified by it [1]. That does not imply any individual can be identified by a SSN or that any SSN identifies an individual. The suitability of an SSN is situational for ID purposes. The video conflates identification and authentication to its detriment. Social Security Numbers are very good identifiers, that’s literally their purpose. Social Security Cards are poor authentication tokens because they contain no validation to prove the card holder is the person associated with the number. Or said another way, you cannot prove your identity (authenticate) with a social security card. I don’t see what built in validation of the number has to do with the security of the identifier. So again, the problem is using a Social Security Number or card for authentication. It’s fine as an identifier. [1]: Social Security Numbers can be reissued but this should only happen when the number is no longer in use.
- mulmen 6y ago
  Too late to edit but apparently SSNs are not reused: https://www.ssa.gov/history/hfaq.html https://www.ssa.gov/history/hfaq.html Q20: Are Social Security numbers reused after a person dies? A: No. We do not reassign a Social Security number (SSN) after the number holder's death. Even though we have issued over 453 million SSNs so far, and we assign about 5 and one-half million new numbers a year, the current numbering system will provide us with enough new numbers for several generations into the future with no changes in the numbering system.
  - nathanaldensr 6y ago
    I wonder how this is possible when there are only one billion combinations of digits.
    - rodonn 6y ago
      There are only around 330 million Americans and about 5 million born/immigrated each year. 1 billion possibilities will be enough for about 100 more years. Presumably sometime before then we can replace or update the system (or worst case add one more digit).
ACS_Solver 6y ago
Somewhat tangential, but I've always found it weird when I read about strong opposition of some in the US to government ID, framing it as something that jeopardizes the indivdiual's rights. My perspective from a European point of view is different, a government system that provides some ID (which is good both for identification and authentication) is a crucial protection of my rights. I don't want anybody to be able to impersonate me, which means I want a universally accepted system of strong authentication. That's what government ID is to me, it's like a PGP keyring where the government is the introducer in the web of trust. In the absence of such a system, various ad-hoc systems emerge, and that's IMO why identity theft is so staggeringly common in the US - it's easy, and it's easy because very poor systems are routinely used for authentication. If I understand correctly, you can do a lot in the US with one-factor knowledge authentication, where the "something you know" are things like your name, address, DOB or SSN, all of which are exceptionally poor as authentication.
- jhanschoo 6y ago
  One dimension to this is that racism and xenophobia is so nakedly tolerated including in the political class in the US, that many are fear that any governmental ID would only be half-heartedly rolled out to inconvenient and undesirable people in an effort to suppress their voice.
  - deleted 6y ago
    [deleted]
- mulmen 6y ago
  While there is no Federal ID every state in the Union (to my knowledge) provides ID cards to citizens. These vary slightly from place to place but all contain verifiable identity (authentication). This may seem strange to outsiders but makes more sense when you consider the United States is a federation of sovereign states. The system is built on the idea of limited federal power with states sharing but retaining much of their own sovereignty. This has many of the benefits of any federated system and makes for a robust democracy. There’s very little of consequence you can do in the United States with single factor knowledge. If identity theft is more common here than elsewhere (citation needed) I would guess it has more to do with a lack of consequences (consumer protection) than a Federal ID.
swiley 6y ago
I'm pretty sure I read somewhere SSNs aren't even guaranteed to be unique.

urda 6y ago

> SSNs are fine as IDs No, they actually are NOT fine for ID or authentication. They contain no security features and if an attacker knows their victim's birth location can often determine the first set of digits of an SSN. SSN are not fine as IDs.

iso1631 6y ago
My name + address is fine for ID, everyone knows it, but it's unique. There are no security features on my name. I could claim my name is Joe Biden and I live at 1600 Pennsylvania Avenue, just like I could go onto HN and claim my userid is urda, that isn't a problem. The next step would be to authenticate - and that's where the problem comes -- SSNs and names are no good for authentication. They're a userid.
- Daho0n 6y ago
  "Please identify yourself" doesn't mean "give me a random name" but "prove who you are". It is a mess but To ID is to authenticate who you are.
  - rocqua 6y ago
    In colloquial use, you are right. In rigorous use in security, identification just means unambiguously referring to a specific identity. This is as simple as providing an identifier. Which the social security number roughly does (they can be re-used after death apparently). Actually proving the provided identity is your identity is authentication. SSNs come with no decent authentication method. Hence, the identifier of an SSN is not very good in situations where authentication is required. For an example where authentication of identifiers is not required. Consider the following: "Dear business please identify all your employees so we can correctly give them benefits". In this case, having identifiers for people is sufficient. Heck, any case where you are asked to identify a 3d party cannot require authentication. Strictly speaking "please identify yourself" means please give me your name. If this is spoken by someone with authority they may want prove of that claim. In that case, it is great if authentication of your given identifier is possible.