6 ms·

> American SSN usage Nothing like a secret token that can be reliably guessed using only your birth month+year and place of birth!

deleted 5y ago
[deleted]
booi 5y ago
wait it's based on birth month/year/place? is there an algorithm to generate it or something?
- lelandbatey 5y ago
  There's not quite an "algorithm"; SSN's are so short (it's just a 9-digit number, so max 1 billion unique SSNs) that they have a very simple procedure for assigning them. The Social Security Administration explains it here: https://www.ssa.gov/history/ssn/geocard.html https://www.ssa.gov/history/ssn/geocard.html - The first set of three digits is called the Area Number - The second set of two digits is called the Group Number - The final set of four digits is the Serial Number Certain geographic areas get certain "Areas Numbers", then Group Numbers are assigned consecutively, then Serial Numbers are assigned consecutively. This entire system of consecutive assignment makes it trivial to guess pretty well, or even exactly, what someone's SSN is.
  - tmm 5y ago
    Not since June 25, 2011 when they started randomizing assignment[1]. They still don't use 666 as an area number, though. [1] https://www.ssa.gov/employer/randomization.html https://www.ssa.gov/employer/randomization.html
    - abustamam 5y ago
      This is a good change, but since it's not retroactive anyone born before that date (which is 100% of adults and probably roughly 50% of minors, who are likely not good targets for identity theft) are still at risk.
      - Moru 5y ago
        And it's still a problem since everyone uses it as a secret, not a username. So if leaked, you are still at risk. This is why the number realy should have been public from start so companies would not get the idea to use it as password.
    - registeredcorn 5y ago
      I have mixed emotions about this. From a security professional perspective, this is at least somewhat of an improvement, even if the entire thing feels like it's held together with a wish and a prayer. I would really like if there were a means to just institute an entirely new system. Essentially having one's entire life ruined, on the chance a bad actor can guess a four digit number is...not great. From a genealogist perspective though, this is horrible news. Being able to trackdown people based off of rough geographic assumptions can help narrow down if someone is "lucky" enough to have a common name in a specific region. Of course, this change to SSN isn't nearly as disastrous as the death of paper - especially newspapers - but I really do not envy anyone who is going to try and do historical family research in two to three hundred years. It makes me cringe just to think about how much valuable information, how many life changing moments, are going to be lost to encryption, bit rot, and the constantly changing standards of software and hardware.
  - newscracker 5y ago
    Doesn’t guessing someone’s SSN require that you need to know the numbers and assignments of some more people (who obtained it) in the same location and around the same time period? If someone tells you their name and that they got the SSN in a particular place and doesn’t reveal any other information, you wouldn’t be able to guess that, would you?
  - Fatnino 5y ago
    My dad and myself have SSN numbers that are 5 apart because we immigrated at the same time.
  - runamok 5y ago
    Not even worth the effort considering how many companies have been hacked. https://www.popsci.com/social-security-number-equifax-leak/ https://www.popsci.com/social-security-number-equifax-leak/ https://www.forbes.com/sites/suzannerowankelleher/2019/08/01/everyones-social-security-number-has-been-compromised-heres-how-to-protect-yourself/?sh=3def6b2429ac https://www.forbes.com/sites/suzannerowankelleher/2019/08/01...

deleted 5y ago

[deleted]

booi 5y ago

wait it's based on birth month/year/place? is there an algorithm to generate it or something?

lelandbatey 5y ago
There's not quite an "algorithm"; SSN's are so short (it's just a 9-digit number, so max 1 billion unique SSNs) that they have a very simple procedure for assigning them. The Social Security Administration explains it here: https://www.ssa.gov/history/ssn/geocard.html https://www.ssa.gov/history/ssn/geocard.html - The first set of three digits is called the Area Number - The second set of two digits is called the Group Number - The final set of four digits is the Serial Number Certain geographic areas get certain "Areas Numbers", then Group Numbers are assigned consecutively, then Serial Numbers are assigned consecutively. This entire system of consecutive assignment makes it trivial to guess pretty well, or even exactly, what someone's SSN is.
- tmm 5y ago
  Not since June 25, 2011 when they started randomizing assignment[1]. They still don't use 666 as an area number, though. [1] https://www.ssa.gov/employer/randomization.html https://www.ssa.gov/employer/randomization.html
  - abustamam 5y ago
    This is a good change, but since it's not retroactive anyone born before that date (which is 100% of adults and probably roughly 50% of minors, who are likely not good targets for identity theft) are still at risk.
    - Moru 5y ago
      And it's still a problem since everyone uses it as a secret, not a username. So if leaked, you are still at risk. This is why the number realy should have been public from start so companies would not get the idea to use it as password.
  - registeredcorn 5y ago
    I have mixed emotions about this. From a security professional perspective, this is at least somewhat of an improvement, even if the entire thing feels like it's held together with a wish and a prayer. I would really like if there were a means to just institute an entirely new system. Essentially having one's entire life ruined, on the chance a bad actor can guess a four digit number is...not great. From a genealogist perspective though, this is horrible news. Being able to trackdown people based off of rough geographic assumptions can help narrow down if someone is "lucky" enough to have a common name in a specific region. Of course, this change to SSN isn't nearly as disastrous as the death of paper - especially newspapers - but I really do not envy anyone who is going to try and do historical family research in two to three hundred years. It makes me cringe just to think about how much valuable information, how many life changing moments, are going to be lost to encryption, bit rot, and the constantly changing standards of software and hardware.
- newscracker 5y ago
  Doesn’t guessing someone’s SSN require that you need to know the numbers and assignments of some more people (who obtained it) in the same location and around the same time period? If someone tells you their name and that they got the SSN in a particular place and doesn’t reveal any other information, you wouldn’t be able to guess that, would you?
- Fatnino 5y ago
  My dad and myself have SSN numbers that are 5 apart because we immigrated at the same time.
- runamok 5y ago
  Not even worth the effort considering how many companies have been hacked. https://www.popsci.com/social-security-number-equifax-leak/ https://www.popsci.com/social-security-number-equifax-leak/ https://www.forbes.com/sites/suzannerowankelleher/2019/08/01/everyones-social-security-number-has-been-compromised-heres-how-to-protect-yourself/?sh=3def6b2429ac https://www.forbes.com/sites/suzannerowankelleher/2019/08/01...