7 ms·

At this rate is there any data on Americans that hasn't leaked? I don't feel like it's far fetched request to allow a one time change of SSNs given how poorly c

At this rate is there any data on Americans that hasn't leaked? I don't feel like it's far fetched request to allow a one time change of SSNs given how poorly companies and the government have handled our data.

sonicanatidae 3y ago
What would be the point of changing a social security number that will be breached again in a few years? Equifax provided 140 million people's information to the world. It was "shielded" behind a default password that was never changed. Their penalty? Profits, because they bought an identity protection firm, provided 2 years of free monitoring, for a lifetime problem, then gleefully charged fees for the protection, that their own malfeasance literally caused.
oxygen_crisis 3y ago
By now everyone needs to just abandon the fantasy that SSNs are private information. At this point it's obviously not much better protected than your street address. The fact that a criminal knows your SSN doesn't absolve companies of being defrauded by those criminals through their own lax verification. You should not be liable when entity-A leaks your data and entity-B suffers a loss to someone who has your data. There is no way you could have prevented that eventuality and none of the responsibility should fall on you. Data security and identity verification will not improve so long as we tolerate laws that pretend we are the victims of these attacks and should suffer the losses, instead of recognizing that the entity that failed to properly identify a criminal is the actual victim. The losses must be borne by the parties that are truly capable of preventing "identity theft," or nothing will change.
- alistairSH 3y ago
  This leak apparently also included medical records and insurance information.
- calamari4065 3y ago
  This nine digit number is unique to you and is the password to all of your financial, medical, and legal information. No, you can't change it and no, there's no security. Here it is on an un-laminated paper card. You only get one to keep for your whole life, so keep it safe. You're not allowed to laminate it either. Honestly sounds like a great system. Not a single flaw here.
  - fullspectrumdev 3y ago
    > you only get one I wish that was a joke. My wife (American) has found it utterly impossible to replace her social security card that went missing at least 7 years ago, despite several attempts. It would be nice to have so she can interact with the DMV when back in the US, and suchlike. At least where we live now, the equivalent card is infinitely replaceable within days with a simple online form, and the person number is of extremely limited value to fraudsters.
    - qup 3y ago
      That's weird. I have three copies of mine. Admittedly, I got the last one close to 20 years ago, but it was an easy process then (I walked into a building, requested it, they mailed it). My parents gave me the other two.
    - warner25 3y ago
      I've never needed mine to "interact with the DMV" or any other entity. Has she? It doesn't usually count as a primary form of identification like a passport, driver's license, or other government-issued ID card with a photo. I once looked into getting a replacement card because I'm not sure where mine is, and I didn't bother after reading this (https://www.ssa.gov/number-card/replace-card https://www.ssa.gov/number-card/replace-card): "You may not need to replace your card if you know your Social Security number. In most cases, a physical card isn't necessary." I thought, yeah, I guess I've never actually needed it, so if SSA isn't worried then I won't worry either.
      - macNchz 3y ago
LanternLight83 3y ago
I won't name names because it seems like an honest mistake, but i once recieved an apology letter (amoung other legal notifications) that a piece of mail had previously been sent to me with my full SSN on the outside of the envelope Not actually the wort breach of a reasonable threat model, i think it's a great whoops story
adolph 3y ago
> one-time change of SSNs Ok, chances are good you’d just get some other compromised ID, what’s the upside? Maybe there is something better than some numeric characters?
- 8n4vidtmkvmk 3y ago
  Can we not make SSNs just less sensitive? They're supposed to be for social security no? Why are they using them for so much other crap first of all. And then secondly.. just stop using it as a form of IDing me. Use my govt ID or something. Or that thing that openai or whoever did recently.
anonymouskimmer 3y ago
I believe my favorite drink is still secure. Possibly my favorite movie, but that's too easy to guess. My elementary school mascot has changed over the years, so that might be safe too.

sonicanatidae 3y ago

What would be the point of changing a social security number that will be breached again in a few years? Equifax provided 140 million people's information to the world. It was "shielded" behind a default password that was never changed. Their penalty? Profits, because they bought an identity protection firm, provided 2 years of free monitoring, for a lifetime problem, then gleefully charged fees for the protection, that their own malfeasance literally caused.

oxygen_crisis 3y ago

By now everyone needs to just abandon the fantasy that SSNs are private information. At this point it's obviously not much better protected than your street address. The fact that a criminal knows your SSN doesn't absolve companies of being defrauded by those criminals through their own lax verification. You should not be liable when entity-A leaks your data and entity-B suffers a loss to someone who has your data. There is no way you could have prevented that eventuality and none of the responsibility should fall on you. Data security and identity verification will not improve so long as we tolerate laws that pretend we are the victims of these attacks and should suffer the losses, instead of recognizing that the entity that failed to properly identify a criminal is the actual victim. The losses must be borne by the parties that are truly capable of preventing "identity theft," or nothing will change.

alistairSH 3y ago
This leak apparently also included medical records and insurance information.
calamari4065 3y ago
This nine digit number is unique to you and is the password to all of your financial, medical, and legal information. No, you can't change it and no, there's no security. Here it is on an un-laminated paper card. You only get one to keep for your whole life, so keep it safe. You're not allowed to laminate it either. Honestly sounds like a great system. Not a single flaw here.
- fullspectrumdev 3y ago
  > you only get one I wish that was a joke. My wife (American) has found it utterly impossible to replace her social security card that went missing at least 7 years ago, despite several attempts. It would be nice to have so she can interact with the DMV when back in the US, and suchlike. At least where we live now, the equivalent card is infinitely replaceable within days with a simple online form, and the person number is of extremely limited value to fraudsters.
  - qup 3y ago
    That's weird. I have three copies of mine. Admittedly, I got the last one close to 20 years ago, but it was an easy process then (I walked into a building, requested it, they mailed it). My parents gave me the other two.
  - warner25 3y ago
    I've never needed mine to "interact with the DMV" or any other entity. Has she? It doesn't usually count as a primary form of identification like a passport, driver's license, or other government-issued ID card with a photo. I once looked into getting a replacement card because I'm not sure where mine is, and I didn't bother after reading this (https://www.ssa.gov/number-card/replace-card https://www.ssa.gov/number-card/replace-card): "You may not need to replace your card if you know your Social Security number. In most cases, a physical card isn't necessary." I thought, yeah, I guess I've never actually needed it, so if SSA isn't worried then I won't worry either.
    - macNchz 3y ago

LanternLight83 3y ago

I won't name names because it seems like an honest mistake, but i once recieved an apology letter (amoung other legal notifications) that a piece of mail had previously been sent to me with my full SSN on the outside of the envelope Not actually the wort breach of a reasonable threat model, i think it's a great whoops story

adolph 3y ago

> one-time change of SSNs Ok, chances are good you’d just get some other compromised ID, what’s the upside? Maybe there is something better than some numeric characters?

8n4vidtmkvmk 3y ago
Can we not make SSNs just less sensitive? They're supposed to be for social security no? Why are they using them for so much other crap first of all. And then secondly.. just stop using it as a form of IDing me. Use my govt ID or something. Or that thing that openai or whoever did recently.

anonymouskimmer 3y ago

I believe my favorite drink is still secure. Possibly my favorite movie, but that's too easy to guess. My elementary school mascot has changed over the years, so that might be safe too.