5 ms·

SSN, DOB and other personal data of my child is part of this leak. But it was already leaked through a different hack at a health insurance provider in any cas

SSN, DOB and other personal data of my child is part of this leak. But it was already leaked through a different hack at a health insurance provider in any case. It should be clear by now that as long as the data is stored somewhere it is at risk of being leaked. It doesn't matter how secure you think your tech stack is. Improving tech is not the solution. Here's the solution: 1. Don't collect information in the first place, unless absolutely needed. Some schools collect DOB, address and so on just to register for a webinar. 2. Don't permanently store information. If you collect SSN for employability verification then do the verification, store a flag, then delete the SSN. Similarly, after verifying DOB, store a flag then delete DOB. 3. Assume information is already public. This is the most important part. Despite all of the leaks happening, many financial and other sites will let you use your DOB, SSN etc. to prove that you are who you say you are. This is absurd. It appears American businesses prioritize convenience over security. Americans need to demand better.

fluidcruft 6y ago
I think the solution is to make SSN useless for anything. It's ridiculous what can be done with nothing more than what amounts to glorified directory information. Why are SSN targets? Because of what can be done with them. The world should expect SSN to be in the same class as a phone number. Private, but mostly useless. "Oh no... they hacked a database and got a list of phone numbers." Not something you hear very often nor does it really make people squirm. I think we need something like drivers licenses with public-key crypto. Lost your ID? Go to the police, prove your identity to them and get a new driver's license. If people are worried the masses are too dumb for PKI, then make it opt-in and leave it to advocacy groups to expand utilization.
- thephyber 6y ago
  Your first paragraph misses the diagnosis a little bit your prescription is correct. The problem isn’t specific to SSNs. Most authentication of users in the public sector in the USA is done by knowledge of facts, whereas it should require proof of government ID card (preferably with digital certificate, not just knowledge of the ID number)
  - stjohnswarts 6y ago
    Yep this is really the only way to fix it.
- zamalek 6y ago
  > I think the solution is to make SSN useless for anything. It is rapidly approaching that point by virtue of all these breaches. SSNs are like gold or fiat currency: they only hold value because they are relatively scarce. If too many are in circulation, then no institution will trust them, which makes them useless. > If people are worried the masses are too dumb for PKI Use OAuth to communicate with a central service that uses FIDO2 for authentication. Easy to use, easy to revoke, almost impossible to pwn.
  - rectang 6y ago
    Is an SSN really "useless", though? The problem is that the heaviest costs of stolen identity are borne primarily by the individual victim, not by the company which got hoodwinked.
    - xbar 6y ago
      Useless is not the term of art. It is brittle. So, very, very brittle. Costs born by the victim are not the only problem. It is that the brittleness of SSN makes it impossible to lay the costs at the feet of the proper "company which got hoodwinked". You must share your SSN 100 times for: work, home, credit, school, health. All of them have been popped 5 times each. 20 years later, you are victimized. Who pays? SSN should be deprecated. You can pretty quickly reason to public/private-key SSN alternatives. The US government would actually do it for the consumer (this term) but the US probably doesn't want to pay it's share of the replacement cost to do so. Still, we should demand it.
      - rectang 6y ago
        > Who pays? Since all those companies can plausibly point to someone else, the victim pays! Which is just how they like it — privatize the profits and socialize the losses. What would actually get creditors to stop using social security numbers is if the SSN's utility as a proxy for creditworthiness drops. But that won't happen, even with many more breaches, because individual consumers need to do everything they can to keep their credit scores up. > Still, we should demand it. Yep. The market will not drive this. It will have to be consumers, speaking collectively through the government, imposing regulations.
EvanAnderson 6y ago
Given the the "market" has chosen to use public "secret" information like SSN's, birthdates, "mother's maiden name", etc, I'm fearful of what kind of hare brained solutions industry would come up with on their own if left to design an authentication system. That having been said, something needs to change. Culturally, I think we need to move away from the idea of "identity theft", which places most of the burden of "restoring their good name" on the individual whose "identity" was "stolen". We need to treat it like what it is-- fraud. We should hold the parties who are negligent in their duty to authenticate liable for the fraud committed. Insurance companies and banks would act quickly if the liability were theirs. We'd have "chip and PIN" in the United States if fraud liability rested with banks, instead of mainly with merchants, for example. I'd like to see the US Postal Service get into the identity/authentication "game", personally, but efforts at a state level would be better than nothing.
- mitchdoogle 6y ago
  Yes! So often I see conversations surrounding data theft, and the talk is about how people can protect themselves. People seem to rarely consider that if the burdens of fraud were put onto financial institutions, identity theft would stop overnight.
hctaw 6y ago
1) and 2) are definitely concrete things we can act on but 3) is a battle you will lose. The only reason that SSNs remain convenient is because there is no viable alternative when your authorization hits government or financial institutions. Maybe financial institutions will get wise (I doubt it, unless they have to pay $1,000,000 to every user whose SSN gets leaked from their systems) but the government will probably never change in our lifetimes. It's not like universal government issued IDs haven't been suggested, but the SSN is used because it's the thing resembling one that hasn't died in committee or debate. There's no political will to create a single identification system for US Citizens and it will be fought tooth and nail by liberals and conservatives.
- zamalek 6y ago
  > it will be fought tooth and nail by liberals and conservatives. Then don't replace SSN, augment it. Once you opt-in, your government-issued FIDO2 will be required alongside your SSN.
  - hctaw 6y ago
    There is fundamental opposition to the very notion of a national ID system in the United States, it's not as simple as "opt-in" or "SSN would be backwards compatible." Here's the ACLU's stance: https://www.aclu.org/other/5-problems-national-id-cards https://www.aclu.org/other/5-problems-national-id-cards
    - zamalek 6y ago
      I didn't suggest a national ID, I suggested optional 2-factor SSN. I'm well aware of the spectrum of concerns of a national ID system.
      - xbar 6y ago
        This, but include an actual SSN sunset date with a PKI-style replacement in 10 years.
godshatter 6y ago
I agree completely with items 1 and 3, but 2 isn't really practical. A person's employer doesn't just need the SSN for verification, they need it to send tax-related data to the IRS, and if your student has loans the SSN is needed for sending data about loans to the Department of Education. It would be impractical for them to ask the employee or student for this information every time it was needed, so they store it. It would be better to purge this data when it is no longer needed, though.
- dragonwriter 6y ago
  The solution is single-user tax/benefit-account identifiers: someone gives you their authorized-user identifier, you go to the issuer of your private id (SSA, IRS, whoever) with it and get a single-use identifier for you to use for that user, and you give them that, not your main identifier. Ideally, the identifier they give you would be not be the one that they use to government either, but one tired to it
- stjohnswarts 6y ago
  They could do all the same with chip-and-pin. SSN should not be used as they currently are, it's as simple as that.
stjohnswarts 6y ago
I really wish we had a real national ID card and SSN usage because a thing of the past. Maybe a chip in the card like the ones credit cards that provide one time use numbers for verification. It seems like every couple of months I get a hit on someone trying to take out a loan or similar but they are blocked because I have my accounts frozen with the big 3 credit agencies.

fluidcruft 6y ago

I think the solution is to make SSN useless for anything. It's ridiculous what can be done with nothing more than what amounts to glorified directory information. Why are SSN targets? Because of what can be done with them. The world should expect SSN to be in the same class as a phone number. Private, but mostly useless. "Oh no... they hacked a database and got a list of phone numbers." Not something you hear very often nor does it really make people squirm. I think we need something like drivers licenses with public-key crypto. Lost your ID? Go to the police, prove your identity to them and get a new driver's license. If people are worried the masses are too dumb for PKI, then make it opt-in and leave it to advocacy groups to expand utilization.

thephyber 6y ago
Your first paragraph misses the diagnosis a little bit your prescription is correct. The problem isn’t specific to SSNs. Most authentication of users in the public sector in the USA is done by knowledge of facts, whereas it should require proof of government ID card (preferably with digital certificate, not just knowledge of the ID number)
- stjohnswarts 6y ago
  Yep this is really the only way to fix it.
zamalek 6y ago
> I think the solution is to make SSN useless for anything. It is rapidly approaching that point by virtue of all these breaches. SSNs are like gold or fiat currency: they only hold value because they are relatively scarce. If too many are in circulation, then no institution will trust them, which makes them useless. > If people are worried the masses are too dumb for PKI Use OAuth to communicate with a central service that uses FIDO2 for authentication. Easy to use, easy to revoke, almost impossible to pwn.
- rectang 6y ago
  Is an SSN really "useless", though? The problem is that the heaviest costs of stolen identity are borne primarily by the individual victim, not by the company which got hoodwinked.
  - xbar 6y ago
    Useless is not the term of art. It is brittle. So, very, very brittle. Costs born by the victim are not the only problem. It is that the brittleness of SSN makes it impossible to lay the costs at the feet of the proper "company which got hoodwinked". You must share your SSN 100 times for: work, home, credit, school, health. All of them have been popped 5 times each. 20 years later, you are victimized. Who pays? SSN should be deprecated. You can pretty quickly reason to public/private-key SSN alternatives. The US government would actually do it for the consumer (this term) but the US probably doesn't want to pay it's share of the replacement cost to do so. Still, we should demand it.
    - rectang 6y ago
      > Who pays? Since all those companies can plausibly point to someone else, the victim pays! Which is just how they like it — privatize the profits and socialize the losses. What would actually get creditors to stop using social security numbers is if the SSN's utility as a proxy for creditworthiness drops. But that won't happen, even with many more breaches, because individual consumers need to do everything they can to keep their credit scores up. > Still, we should demand it. Yep. The market will not drive this. It will have to be consumers, speaking collectively through the government, imposing regulations.

EvanAnderson 6y ago

Given the the "market" has chosen to use public "secret" information like SSN's, birthdates, "mother's maiden name", etc, I'm fearful of what kind of hare brained solutions industry would come up with on their own if left to design an authentication system. That having been said, something needs to change. Culturally, I think we need to move away from the idea of "identity theft", which places most of the burden of "restoring their good name" on the individual whose "identity" was "stolen". We need to treat it like what it is-- fraud. We should hold the parties who are negligent in their duty to authenticate liable for the fraud committed. Insurance companies and banks would act quickly if the liability were theirs. We'd have "chip and PIN" in the United States if fraud liability rested with banks, instead of mainly with merchants, for example. I'd like to see the US Postal Service get into the identity/authentication "game", personally, but efforts at a state level would be better than nothing.

mitchdoogle 6y ago
Yes! So often I see conversations surrounding data theft, and the talk is about how people can protect themselves. People seem to rarely consider that if the burdens of fraud were put onto financial institutions, identity theft would stop overnight.

hctaw 6y ago

1) and 2) are definitely concrete things we can act on but 3) is a battle you will lose. The only reason that SSNs remain convenient is because there is no viable alternative when your authorization hits government or financial institutions. Maybe financial institutions will get wise (I doubt it, unless they have to pay $1,000,000 to every user whose SSN gets leaked from their systems) but the government will probably never change in our lifetimes. It's not like universal government issued IDs haven't been suggested, but the SSN is used because it's the thing resembling one that hasn't died in committee or debate. There's no political will to create a single identification system for US Citizens and it will be fought tooth and nail by liberals and conservatives.

zamalek 6y ago
> it will be fought tooth and nail by liberals and conservatives. Then don't replace SSN, augment it. Once you opt-in, your government-issued FIDO2 will be required alongside your SSN.
- hctaw 6y ago
  There is fundamental opposition to the very notion of a national ID system in the United States, it's not as simple as "opt-in" or "SSN would be backwards compatible." Here's the ACLU's stance: https://www.aclu.org/other/5-problems-national-id-cards https://www.aclu.org/other/5-problems-national-id-cards
  - zamalek 6y ago
    I didn't suggest a national ID, I suggested optional 2-factor SSN. I'm well aware of the spectrum of concerns of a national ID system.
    - xbar 6y ago
      This, but include an actual SSN sunset date with a PKI-style replacement in 10 years.

godshatter 6y ago

I agree completely with items 1 and 3, but 2 isn't really practical. A person's employer doesn't just need the SSN for verification, they need it to send tax-related data to the IRS, and if your student has loans the SSN is needed for sending data about loans to the Department of Education. It would be impractical for them to ask the employee or student for this information every time it was needed, so they store it. It would be better to purge this data when it is no longer needed, though.

dragonwriter 6y ago
The solution is single-user tax/benefit-account identifiers: someone gives you their authorized-user identifier, you go to the issuer of your private id (SSA, IRS, whoever) with it and get a single-use identifier for you to use for that user, and you give them that, not your main identifier. Ideally, the identifier they give you would be not be the one that they use to government either, but one tired to it
stjohnswarts 6y ago
They could do all the same with chip-and-pin. SSN should not be used as they currently are, it's as simple as that.

stjohnswarts 6y ago

I really wish we had a real national ID card and SSN usage because a thing of the past. Maybe a chip in the card like the ones credit cards that provide one time use numbers for verification. It seems like every couple of months I get a hit on someone trying to take out a loan or similar but they are blocked because I have my accounts frozen with the big 3 credit agencies.