8 ms·

The damage from incidents such as this would be at least somewhat limited if organizations did not collect SS numbers when they have no legal purpose for doing

The damage from incidents such as this would be at least somewhat limited if organizations did not collect SS numbers when they have no legal purpose for doing so, and if people did not automatically comply when asked to supply these numbers. Whenever I go to the doctor and am asked to fill out the usual form while waiting the usual 90 minutes past my scheduled appointment time, I leave the ubiquitous space for my SS number blank. They are not paying me a salary, so have no legitimate need for this number. I know why they want it, and that purpose does not benefit me. Not once has this led to a problem: they know that there is no legal basis for demanding the number, but ask for it anyway, as they have nothing to lose by doing so.

splithalf 6y ago
Give the wrong ssn on every form you possibly can. Many databases are filled with fake ssns, nobody cares or checks. A lot of Americans don’t even have one.
- dhosek 6y ago
  >A lot of Americans don’t even have one. Citation?
  - colejohnson66 6y ago
    Mostly immigrants who haven’t become citizens yet. But there are others.
  - istjohn 6y ago
    Consider that the IRS provides an ITIN number for tax filing purposes to anyone who doesn't have a SSN. Millions of undocumented immigrants pay their taxes and operate in society without a SSN.
    - bpodgursky 6y ago
      Undocumented immigrants definitionally are not Americans.
      - dhosek 6y ago
        And I'm not sure that ~3% counts as “lots” in any event. Also, that 3% includes people who may have overstayed a work authorization (although that's probably a small enough fraction of the total to ignore).
- vharuck 6y ago
  Some Americans, mostly older women, don't know their SSN because they never used it. Their husbands handled taxes, opened bank accounts, and collected Social Security. If you've ever dealt with medical data, SSN is not a reliably unique identifier. Couples will share a number because each gives the "relevant" number instead of their own.
tenacious_tuna 6y ago
Anecdote: I've been told previously that my state kept vaccine records in a shared database indexed by SSN--as a way of easing loss of medical records when patience switched providers. It's possible they were doing something similar. I've also had to give my SSN to verify my identity to my insurance carrier at my dentist.
- thephyber 6y ago
  SSN is the de facto userID for lots of government systems. It’s sad for lots of reasons, but understandable considering that it is useful. for whatever reason there isn’t much political will to make an honest effort at a federal government ID (even though we de facto have multiple)
grumple 6y ago
Universities do a lot of financial interactions with students, including credit checks, housing, financial aid, and very high levels of payments. They also often employ students. They also need to be able to track your records through name changes. They need your SSN.
- DamnYuppie 6y ago
  Not disagreeing with you points. My issue is, when I went to school, they wanted you to put your SS on your papers and tests as that is really what they used as your student id.
  - driverdan 6y ago
    A law was passed about 15 years ago that prohibited using SSNs as student IDs.
    - officeplant 6y ago
      Now I feel ancient. If you ran our highschool ID cards through a magstripe reader it would display your SSN. There was a huge problem a few friends and I caused our first year there when we got bored in the computer lab. Every student account on a school computer had a folder named PUBLIC. Out of curiosity we dug down a few folders and found the txt file that was referenced by the simple visual basic program the IT guy wrote for class scheduling. That program used your name and SSN as login credentials. So there was a txt file that was simply a list of everyone's name and SSN for it to reference. We being the idiots we are copied the file because it was a public folder anyone could access. The only reason we didn't get expelled was because one of the kids had a lawyer father who threatened to go public about them being that irresponsible with our data.
      - driverdan 6y ago
        When I was in college SSNs were still used as our ID numbers. Every dept had folders in the hall outside the office for each student. They'd put grades out in those folders. Guess what was printed on those grades. If you had a mag stripe writer you could grab a random person's grades, encode their SSN on a student ID, and then use the card to buy stuff on campus.
mindslight 6y ago
While I agree that the world would be a better place if people refused giving as much information as possible, the specific fix here is to not consider social security numbers private information in the first place - they're clearly identifiers, not shared secrets. There is nothing about them that verifies anything - it's basically the database-friendly version of your name. But yes, this could have all been headed off if the social security act had prohibited private organizations from requesting, using, or storing these identifiers in the first place, for anything but immediately passing them on to tax authorities. A Customer ID is good enough for all non-credit uses, and credit should require actual in-person verification to issue. But this is the general shape of totalitarianism in the US. The government mandates the barest minimum of systems, companies lobby against any restrictions that would prevent their abusing it, and we end up with a legally-mandated freedom-destroying system invading most aspects of our lives. PS I've got to wonder about a blockchain solution for keeping a public catalog of leaked PII that gets abused for verification. Make the "exploit" plain as day and companies will have to change. Right now the carding community keep this to themselves, and out of sight is out of mind for the companies that continue to abuse it.
neil_s 6y ago
As a recent expat to the US, I don't actually know, why DOES the medical office want my SSN?
- SubzeroCarnage 6y ago
  So they can take you to small claims/civil court if you or your insurance doesn't pay up.
  - leephillips 6y ago
    And it helps in collection efforts in general. There is no benefit to you in divulging it, only potential harm. So don’t do it.
- cozzyd 6y ago
  Often this is how they verify you are insured.
  - leephillips 6y ago
    They have no problem verifying my insurance without a SS #.
    - cozzyd 6y ago
      Depends on the insurer, probably. That's how my dental is verified since my dental insurance doesn't bother sending out a card...
  - stevula 6y ago
    For medical insurance it’s usually only needed if they you don’t have your member ID number or just recently enrolled. More common for vision or dental insurance to use SSN though.
- collinmanderson 6y ago
  I think some just want a stable unique identifier to prevent duplicate accounts. Many use Name + Date of Birth, but that's not always unique.
EvanAnderson 6y ago
I said this just a couple of days ago re: a data breach: The US needs to just scorch the earth re: social security numbers. Set a date when all liability for fraud enabled by improper use of SSN's for "authentication" is the responsibility of the party misusing SSNs and publish the entire list. The list has, arguably, already been published (thanks, Equifax!). We just need to close the loop.
- thephyber 6y ago
  Unlikely to unfold that way (we are 20 years into the RealID standard recommendation and it has been delayed again). As I’ve mentioned elsewhere, SSN is not the only fact used for authentication. We need to move away from all pure fact-knowledge proofs of ID and to MfA preferably with one factor based on a government issued ID and asymmetric encryption.
  - EvanAnderson 6y ago
    I agree that it's unlikely unless there's massive public outcry, and even then I don't see it happening. The status quo is too entrenched and until elected leaders feel the pain from their constituents nothing is going to change. I concentrated on SSN because it's the government-issued fact-based "authentication" factor. The other fact-based factors are just as bad. I wish we could have a government-sponsored PKI but between concerns from citizens about "freedom" (either freedom for business to "innovate" in the space, or freedom from individuals to be "tracked" by the government) and from surveillance advocates who will want to include key escrow/recovery provision I don't see it flying. In some other comments on this post I mentioned the USPS would be a great "trust" provider. They already serve in that capacity to some extent evidenced by the various government entities who accept an addressed piece of mail as proof of residency. I don't think there'd be enough bipartisan support to make it happen, but I think it'd work great.
Aloisius 6y ago
Schools are required by law to file 1098-T tuition statements with the IRS for almost all students. That requires collecting social security numbers.

splithalf 6y ago

Give the wrong ssn on every form you possibly can. Many databases are filled with fake ssns, nobody cares or checks. A lot of Americans don’t even have one.

dhosek 6y ago
>A lot of Americans don’t even have one. Citation?
- colejohnson66 6y ago
  Mostly immigrants who haven’t become citizens yet. But there are others.
- istjohn 6y ago
  Consider that the IRS provides an ITIN number for tax filing purposes to anyone who doesn't have a SSN. Millions of undocumented immigrants pay their taxes and operate in society without a SSN.
  - bpodgursky 6y ago
    Undocumented immigrants definitionally are not Americans.
    - dhosek 6y ago
      And I'm not sure that ~3% counts as “lots” in any event. Also, that 3% includes people who may have overstayed a work authorization (although that's probably a small enough fraction of the total to ignore).
vharuck 6y ago
Some Americans, mostly older women, don't know their SSN because they never used it. Their husbands handled taxes, opened bank accounts, and collected Social Security. If you've ever dealt with medical data, SSN is not a reliably unique identifier. Couples will share a number because each gives the "relevant" number instead of their own.

tenacious_tuna 6y ago

Anecdote: I've been told previously that my state kept vaccine records in a shared database indexed by SSN--as a way of easing loss of medical records when patience switched providers. It's possible they were doing something similar. I've also had to give my SSN to verify my identity to my insurance carrier at my dentist.

thephyber 6y ago
SSN is the de facto userID for lots of government systems. It’s sad for lots of reasons, but understandable considering that it is useful. for whatever reason there isn’t much political will to make an honest effort at a federal government ID (even though we de facto have multiple)

grumple 6y ago

Universities do a lot of financial interactions with students, including credit checks, housing, financial aid, and very high levels of payments. They also often employ students. They also need to be able to track your records through name changes. They need your SSN.

DamnYuppie 6y ago
Not disagreeing with you points. My issue is, when I went to school, they wanted you to put your SS on your papers and tests as that is really what they used as your student id.
- driverdan 6y ago
  A law was passed about 15 years ago that prohibited using SSNs as student IDs.
  - officeplant 6y ago
    Now I feel ancient. If you ran our highschool ID cards through a magstripe reader it would display your SSN. There was a huge problem a few friends and I caused our first year there when we got bored in the computer lab. Every student account on a school computer had a folder named PUBLIC. Out of curiosity we dug down a few folders and found the txt file that was referenced by the simple visual basic program the IT guy wrote for class scheduling. That program used your name and SSN as login credentials. So there was a txt file that was simply a list of everyone's name and SSN for it to reference. We being the idiots we are copied the file because it was a public folder anyone could access. The only reason we didn't get expelled was because one of the kids had a lawyer father who threatened to go public about them being that irresponsible with our data.
    - driverdan 6y ago
      When I was in college SSNs were still used as our ID numbers. Every dept had folders in the hall outside the office for each student. They'd put grades out in those folders. Guess what was printed on those grades. If you had a mag stripe writer you could grab a random person's grades, encode their SSN on a student ID, and then use the card to buy stuff on campus.

mindslight 6y ago

While I agree that the world would be a better place if people refused giving as much information as possible, the specific fix here is to not consider social security numbers private information in the first place - they're clearly identifiers, not shared secrets. There is nothing about them that verifies anything - it's basically the database-friendly version of your name. But yes, this could have all been headed off if the social security act had prohibited private organizations from requesting, using, or storing these identifiers in the first place, for anything but immediately passing them on to tax authorities. A Customer ID is good enough for all non-credit uses, and credit should require actual in-person verification to issue. But this is the general shape of totalitarianism in the US. The government mandates the barest minimum of systems, companies lobby against any restrictions that would prevent their abusing it, and we end up with a legally-mandated freedom-destroying system invading most aspects of our lives. PS I've got to wonder about a blockchain solution for keeping a public catalog of leaked PII that gets abused for verification. Make the "exploit" plain as day and companies will have to change. Right now the carding community keep this to themselves, and out of sight is out of mind for the companies that continue to abuse it.

neil_s 6y ago

As a recent expat to the US, I don't actually know, why DOES the medical office want my SSN?

SubzeroCarnage 6y ago
So they can take you to small claims/civil court if you or your insurance doesn't pay up.
- leephillips 6y ago
  And it helps in collection efforts in general. There is no benefit to you in divulging it, only potential harm. So don’t do it.
cozzyd 6y ago
Often this is how they verify you are insured.
- leephillips 6y ago
  They have no problem verifying my insurance without a SS #.
  - cozzyd 6y ago
    Depends on the insurer, probably. That's how my dental is verified since my dental insurance doesn't bother sending out a card...
- stevula 6y ago
  For medical insurance it’s usually only needed if they you don’t have your member ID number or just recently enrolled. More common for vision or dental insurance to use SSN though.
collinmanderson 6y ago
I think some just want a stable unique identifier to prevent duplicate accounts. Many use Name + Date of Birth, but that's not always unique.

EvanAnderson 6y ago

I said this just a couple of days ago re: a data breach: The US needs to just scorch the earth re: social security numbers. Set a date when all liability for fraud enabled by improper use of SSN's for "authentication" is the responsibility of the party misusing SSNs and publish the entire list. The list has, arguably, already been published (thanks, Equifax!). We just need to close the loop.

thephyber 6y ago
Unlikely to unfold that way (we are 20 years into the RealID standard recommendation and it has been delayed again). As I’ve mentioned elsewhere, SSN is not the only fact used for authentication. We need to move away from all pure fact-knowledge proofs of ID and to MfA preferably with one factor based on a government issued ID and asymmetric encryption.
- EvanAnderson 6y ago
  I agree that it's unlikely unless there's massive public outcry, and even then I don't see it happening. The status quo is too entrenched and until elected leaders feel the pain from their constituents nothing is going to change. I concentrated on SSN because it's the government-issued fact-based "authentication" factor. The other fact-based factors are just as bad. I wish we could have a government-sponsored PKI but between concerns from citizens about "freedom" (either freedom for business to "innovate" in the space, or freedom from individuals to be "tracked" by the government) and from surveillance advocates who will want to include key escrow/recovery provision I don't see it flying. In some other comments on this post I mentioned the USPS would be a great "trust" provider. They already serve in that capacity to some extent evidenced by the various government entities who accept an addressed piece of mail as proof of residency. I don't think there'd be enough bipartisan support to make it happen, but I think it'd work great.

Aloisius 6y ago

Schools are required by law to file 1098-T tuition statements with the IRS for almost all students. That requires collecting social security numbers.