6 ms·

I'm sure the military still has a SSN field on EVERY. SINGLE. FORM. they have you fill out while you're in the service. There was talk of replacing that with a

by jcadam 3y ago

I'm sure the military still has a SSN field on EVERY. SINGLE. FORM. they have you fill out while you're in the service. There was talk of replacing that with a "service number" but somehow I doubt they've got around to it yet. Between VA employees leaving laptops full of PII laying around and that big OPM leak several years ago, I apparently have no private life.

LtWorf 3y ago
The problem is treating the SSN as a username and a password. It should not be the only information required to authenticate people.
- user3939382 3y ago
  It should be used for your social security account and nothing else.
  - tczMUFlmoNk 3y ago
    Huh. As a member of a generation that has grown up tacitly understanding that social security will very likely be insolvent/cancelled by the time that we're old enough to qualify for it, and thus we shouldn't rely on it whatsoever—it's surreal to consciously connect these two concepts. For me, "social security number" is just the name for the ID number that so many of us have and are used to writing everywhere. The name is just a string of symbols. It sounds silly, but I've never thought about it in relation to social security. Thanks for the mind-bender. :-)
    - SonicScrub 3y ago
      There's an interesting story about how the social security number evolved to being much more than just for social security. Quick 5 minute primer: https://m.youtube.com/watch?v=Erp8IAUouus&pp=ygUYY2dwIGdyZXkgc29jaWFsIHNlY3VyaXR5 https://m.youtube.com/watch?v=Erp8IAUouus&pp=ygUYY2dwIGdyZXk...
      - askiiart 3y ago
        Short link without tracking id (si=): https://youtu.be/Erp8IAUouus https://youtu.be/Erp8IAUouus
    - dragonwriter 3y ago
      > As a member of a generation that has grown up tacitly understanding that social security will very likely be insolvent/cancelled by the time that we're old enough to qualify for it Is it “tacitly understanding” when you've been bathed your whole life in active propaganda promoting an idea? Because, on this, if you are in any cohort from Gen X, or maybe the trailing edge of thr Boomers, on, you have been.
      - jcadam 3y ago
        Nah, we'll get our SS checks - the Fed will turn the money printer up to 11 if they have to cover the program. Inflation will make them worthless, but we'll get our checks :)
        dragonwriter 3y ago
        SS benefits are indexed to a wage index (which has been greater than inflation consistently since thr mid-1980s) over working life and to inflation from retirement on. Cranking the money printer just drives up nominal social security benefits to compensate (for current retires) or more (because easy money drives higher wages).
    - burkaman 3y ago
      > social security will very likely be insolvent/cancelled by the time that we're old enough to qualify for it This is not true, it's propaganda promoted by rich people who want to get rid of social security. It could be eliminated for political reasons, but spreading this idea that it's going to "run out of money" only makes that more likely. The government cannot run out of its own money. It can cause inflation, but continuing to pay social security benefits is not going to suddenly cause massive inflation. The only way social security could end is if politicians and voters decide they don't want it anymore.
      - cheeseomlit 3y ago
        >The government cannot run out of its own money. It can cause inflation, but continuing to pay social security benefits is not going to suddenly cause massive inflation. Social security is a massive portion of federal spending, indefinitely printing money to fund it is not sustainable and will cause significant inflation
        burkaman 3y ago
        Why hasn't that happened yet? Also, the government is going to continue indefinitely printing money whether or not we have social security.
        cheeseomlit 3y ago
        It has, inflation is rising rapidly in no small part due to the gov printing money to cover its obligations, of which social security is one of the largest and will only become larger as the cost of living increases due to said inflation- a vicious cycle. If contributions don't cover the payouts (which they don't, and never will unless you tax the younger generations to death) then the difference has to be made up with printing, which will of course cause inflation You are right that they will continue printing money regardless, and at this point it's too late for a 20% reduction to fix anything. Might as well just take the checks while you can and make the most of it, not much else you can do. But that doesn't mean its sustainable or will last forever.
  - vkou 3y ago
    What should we use for all the other government services that need to uniquely identify you? (This a trick question, not a rabbit hole you actually want to go down, because no matter what you suggest, I'll happily poke a thousand holes in it.)
    - BOOTRACER 3y ago
      DNA scan
  - kwhitefoot 3y ago
    It's used for everything here in Norway: banks, insurance companies, tax, social security, health, etc. It's just a Globally Unique Identifier not a password, it doesn't grant you access.
- stonogo 3y ago
  The US military does not use the SSN as a username or a password. They've had smartcards, even on Linux, as far back as 20 years ago or more. Users without smartcards have to go through 2FA with a username/password combination and codes over SMS or proper TOTP (depending on agency). The problem is that the entire Department of Defense is still very much a paper-oriented organization, and they got rid of service numbers in the 1970s, leaving the SSN as the only meaningful unique identifier. As a result it gets put on every piece of paperwork associated with a service member. Their own recordkeeping practices have the consequence that if you get almost any paperwork regarding a soldier, it has enough information to gain access to other personal information.
  - swells34 3y ago
    You've hit the nail mostly on the head. Paper is a problem, for obvious reasons, especially the amount of triplicate hand filled forms that require all of your PII every time. The second issue is access control vs. expediency. Millions of people, all over the world, can digitally access huge amounts of your personal information at a whim, by only having your name, or your military email address. This is an important requirement for quickly checking on a person or their orders or their training status, but at the sacrifice of personal information security for you. It gets even worse going to the VA, which I can say from personal experience, will happily allow just about anyone to have whatever information they want about you. I got a happy surprise letter from them stating that my DD-214, a super identity document, containing information found on a birth certificate, a social security card, a driver's license, plus so much more, had been put on a thumb drive by a third party contractor, along with thousands of other service members info, and sold to a dark web information broker. So, the problem is just that it's to the military's benefit to not protect you.
  - LtWorf 3y ago
    I wasn't talking about the military per se. I was talking about how you can open a bank account just by knowing someone else's ssn
  - hindsightbias 3y ago
    You should sit in on a call to dfas.mil sometime. Where they ask an 80 year old over a dozen obscure questions on their service record and hang up when you get one of them wrong, resetting the clock 24 hours.
- kube-system 3y ago
  The government doesn't do this though, it's mostly banks that are guilty.
  - LtWorf 3y ago
    The government should regulate the banks.
    - kube-system 3y ago
      I am sure the executive branch would require banks to use a better identifier, if the legislative branch allowed the executive branch to create one.
RobRivera 3y ago
Dipi keys are a thing and have been put to good use
- RecycledEle 3y ago
  I've never heard of "dipi keys." Can you tell me about them?
randombits0 3y ago
Chinese hackers stole over 70 million records of current/past military members from the Office of Management and Budget back in April of 2014.
- warner25 3y ago
  I think you're thinking of the Office of Personnel Management (OPM), not OMB (although I did just learn that the Trump administration proposed to merge parts of OPM into OMB). https://en.wikipedia.org/wiki/United_States_Office_of_Personnel_Management#2015_data_breach https://en.wikipedia.org/wiki/United_States_Office_of_Person... But yeah, compared to that, sadly, this acquisition of much less detailed information about 30,000 service members seems moot.
trvrsalom 3y ago
There are DOD ID numbers, but they've updated the forms to just ask for both.
- jcadam 3y ago
  ... sounds like DoD.
- warner25 3y ago
  In my experience, though, people now freak out if you fill in the SSN field on the form, because that makes it PII with a bunch of requirements for proper storage and transmission. This is despite the fact that most of the other information on the form already makes it PII, regardless of the presence of a SSN. It did take a few years in the mid-2010s for the forms to catch up and replace the SSN field with the DOD ID number. In 2021, I think I was supposed to get new ID tags (dog tags) that would have my DOD ID number instead of my SSN.
  - herewulf 3y ago
    I wish my experience was people freaking out but instead it's continued carelessness and near indifference. Oftentimes with HR NCOs even. I would like to see loss of PII given the same treatment as classified spillage.

by jcadam 3y ago

LtWorf 3y ago

The problem is treating the SSN as a username and a password. It should not be the only information required to authenticate people.

user3939382 3y ago
It should be used for your social security account and nothing else.
- tczMUFlmoNk 3y ago
  Huh. As a member of a generation that has grown up tacitly understanding that social security will very likely be insolvent/cancelled by the time that we're old enough to qualify for it, and thus we shouldn't rely on it whatsoever—it's surreal to consciously connect these two concepts. For me, "social security number" is just the name for the ID number that so many of us have and are used to writing everywhere. The name is just a string of symbols. It sounds silly, but I've never thought about it in relation to social security. Thanks for the mind-bender. :-)
  - SonicScrub 3y ago
    There's an interesting story about how the social security number evolved to being much more than just for social security. Quick 5 minute primer: https://m.youtube.com/watch?v=Erp8IAUouus&pp=ygUYY2dwIGdyZXkgc29jaWFsIHNlY3VyaXR5 https://m.youtube.com/watch?v=Erp8IAUouus&pp=ygUYY2dwIGdyZXk...
    - askiiart 3y ago
      Short link without tracking id (si=): https://youtu.be/Erp8IAUouus https://youtu.be/Erp8IAUouus
  - dragonwriter 3y ago
    > As a member of a generation that has grown up tacitly understanding that social security will very likely be insolvent/cancelled by the time that we're old enough to qualify for it Is it “tacitly understanding” when you've been bathed your whole life in active propaganda promoting an idea? Because, on this, if you are in any cohort from Gen X, or maybe the trailing edge of thr Boomers, on, you have been.
    - jcadam 3y ago
      Nah, we'll get our SS checks - the Fed will turn the money printer up to 11 if they have to cover the program. Inflation will make them worthless, but we'll get our checks :)
      - dragonwriter 3y ago
        SS benefits are indexed to a wage index (which has been greater than inflation consistently since thr mid-1980s) over working life and to inflation from retirement on. Cranking the money printer just drives up nominal social security benefits to compensate (for current retires) or more (because easy money drives higher wages).
  - burkaman 3y ago
    > social security will very likely be insolvent/cancelled by the time that we're old enough to qualify for it This is not true, it's propaganda promoted by rich people who want to get rid of social security. It could be eliminated for political reasons, but spreading this idea that it's going to "run out of money" only makes that more likely. The government cannot run out of its own money. It can cause inflation, but continuing to pay social security benefits is not going to suddenly cause massive inflation. The only way social security could end is if politicians and voters decide they don't want it anymore.
    - cheeseomlit 3y ago
      >The government cannot run out of its own money. It can cause inflation, but continuing to pay social security benefits is not going to suddenly cause massive inflation. Social security is a massive portion of federal spending, indefinitely printing money to fund it is not sustainable and will cause significant inflation
      - burkaman 3y ago
        Why hasn't that happened yet? Also, the government is going to continue indefinitely printing money whether or not we have social security.
        cheeseomlit 3y ago
        It has, inflation is rising rapidly in no small part due to the gov printing money to cover its obligations, of which social security is one of the largest and will only become larger as the cost of living increases due to said inflation- a vicious cycle. If contributions don't cover the payouts (which they don't, and never will unless you tax the younger generations to death) then the difference has to be made up with printing, which will of course cause inflation You are right that they will continue printing money regardless, and at this point it's too late for a 20% reduction to fix anything. Might as well just take the checks while you can and make the most of it, not much else you can do. But that doesn't mean its sustainable or will last forever.
- vkou 3y ago
  What should we use for all the other government services that need to uniquely identify you? (This a trick question, not a rabbit hole you actually want to go down, because no matter what you suggest, I'll happily poke a thousand holes in it.)
  - BOOTRACER 3y ago
    DNA scan
- kwhitefoot 3y ago
  It's used for everything here in Norway: banks, insurance companies, tax, social security, health, etc. It's just a Globally Unique Identifier not a password, it doesn't grant you access.
stonogo 3y ago
The US military does not use the SSN as a username or a password. They've had smartcards, even on Linux, as far back as 20 years ago or more. Users without smartcards have to go through 2FA with a username/password combination and codes over SMS or proper TOTP (depending on agency). The problem is that the entire Department of Defense is still very much a paper-oriented organization, and they got rid of service numbers in the 1970s, leaving the SSN as the only meaningful unique identifier. As a result it gets put on every piece of paperwork associated with a service member. Their own recordkeeping practices have the consequence that if you get almost any paperwork regarding a soldier, it has enough information to gain access to other personal information.
- swells34 3y ago
  You've hit the nail mostly on the head. Paper is a problem, for obvious reasons, especially the amount of triplicate hand filled forms that require all of your PII every time. The second issue is access control vs. expediency. Millions of people, all over the world, can digitally access huge amounts of your personal information at a whim, by only having your name, or your military email address. This is an important requirement for quickly checking on a person or their orders or their training status, but at the sacrifice of personal information security for you. It gets even worse going to the VA, which I can say from personal experience, will happily allow just about anyone to have whatever information they want about you. I got a happy surprise letter from them stating that my DD-214, a super identity document, containing information found on a birth certificate, a social security card, a driver's license, plus so much more, had been put on a thumb drive by a third party contractor, along with thousands of other service members info, and sold to a dark web information broker. So, the problem is just that it's to the military's benefit to not protect you.
- LtWorf 3y ago
  I wasn't talking about the military per se. I was talking about how you can open a bank account just by knowing someone else's ssn
- hindsightbias 3y ago
  You should sit in on a call to dfas.mil sometime. Where they ask an 80 year old over a dozen obscure questions on their service record and hang up when you get one of them wrong, resetting the clock 24 hours.
kube-system 3y ago
The government doesn't do this though, it's mostly banks that are guilty.
- LtWorf 3y ago
  The government should regulate the banks.
  - kube-system 3y ago
    I am sure the executive branch would require banks to use a better identifier, if the legislative branch allowed the executive branch to create one.

RobRivera 3y ago

Dipi keys are a thing and have been put to good use

RecycledEle 3y ago
I've never heard of "dipi keys." Can you tell me about them?

randombits0 3y ago

Chinese hackers stole over 70 million records of current/past military members from the Office of Management and Budget back in April of 2014.

warner25 3y ago
I think you're thinking of the Office of Personnel Management (OPM), not OMB (although I did just learn that the Trump administration proposed to merge parts of OPM into OMB). https://en.wikipedia.org/wiki/United_States_Office_of_Personnel_Management#2015_data_breach https://en.wikipedia.org/wiki/United_States_Office_of_Person... But yeah, compared to that, sadly, this acquisition of much less detailed information about 30,000 service members seems moot.

trvrsalom 3y ago

There are DOD ID numbers, but they've updated the forms to just ask for both.

jcadam 3y ago
... sounds like DoD.
warner25 3y ago
In my experience, though, people now freak out if you fill in the SSN field on the form, because that makes it PII with a bunch of requirements for proper storage and transmission. This is despite the fact that most of the other information on the form already makes it PII, regardless of the presence of a SSN. It did take a few years in the mid-2010s for the forms to catch up and replace the SSN field with the DOD ID number. In 2021, I think I was supposed to get new ID tags (dog tags) that would have my DOD ID number instead of my SSN.
- herewulf 3y ago
  I wish my experience was people freaking out but instead it's continued carelessness and near indifference. Oftentimes with HR NCOs even. I would like to see loss of PII given the same treatment as classified spillage.