4 ms·

By now everyone needs to just abandon the fantasy that SSNs are private information. At this point it's obviously not much better protected than your street add

By now everyone needs to just abandon the fantasy that SSNs are private information. At this point it's obviously not much better protected than your street address. The fact that a criminal knows your SSN doesn't absolve companies of being defrauded by those criminals through their own lax verification. You should not be liable when entity-A leaks your data and entity-B suffers a loss to someone who has your data. There is no way you could have prevented that eventuality and none of the responsibility should fall on you. Data security and identity verification will not improve so long as we tolerate laws that pretend we are the victims of these attacks and should suffer the losses, instead of recognizing that the entity that failed to properly identify a criminal is the actual victim. The losses must be borne by the parties that are truly capable of preventing "identity theft," or nothing will change.

alistairSH 3y ago
This leak apparently also included medical records and insurance information.
calamari4065 3y ago
This nine digit number is unique to you and is the password to all of your financial, medical, and legal information. No, you can't change it and no, there's no security. Here it is on an un-laminated paper card. You only get one to keep for your whole life, so keep it safe. You're not allowed to laminate it either. Honestly sounds like a great system. Not a single flaw here.
- fullspectrumdev 3y ago
  > you only get one I wish that was a joke. My wife (American) has found it utterly impossible to replace her social security card that went missing at least 7 years ago, despite several attempts. It would be nice to have so she can interact with the DMV when back in the US, and suchlike. At least where we live now, the equivalent card is infinitely replaceable within days with a simple online form, and the person number is of extremely limited value to fraudsters.
  - qup 3y ago
    That's weird. I have three copies of mine. Admittedly, I got the last one close to 20 years ago, but it was an easy process then (I walked into a building, requested it, they mailed it). My parents gave me the other two.
  - warner25 3y ago
    I've never needed mine to "interact with the DMV" or any other entity. Has she? It doesn't usually count as a primary form of identification like a passport, driver's license, or other government-issued ID card with a photo. I once looked into getting a replacement card because I'm not sure where mine is, and I didn't bother after reading this (https://www.ssa.gov/number-card/replace-card https://www.ssa.gov/number-card/replace-card): "You may not need to replace your card if you know your Social Security number. In most cases, a physical card isn't necessary." I thought, yeah, I guess I've never actually needed it, so if SSA isn't worried then I won't worry either.
    - macNchz 3y ago
      New York state requires you to present the physical card itself it to get a driver’s license. I had to have my parents get it out of their safe deposit box and mail it to me when I moved here. It’s also really dumb because there have been dozens of different card designs over the years, so the DMV clerk has no real way of authenticating it beyond putting the number into the computer.
- Terr_ 3y ago
  TBF, it's a bit more like... Government: Here's a number unique to you just for tax-related purposes. No, you can't change it and no, there's no security besides the anti-forgery measures on the card, which is why you can't laminate it. Here it is, you can't have spares, and getting a replacement is annoying, so keep it safe. Companies: Cool! You've got a tax-filing number? We're gonna use that as your personal secret password for all sorts of important shit because that's super-easy on our end. Remember, if anybody else abuses it then it's totally your fault and not ours. [0] [0] https://www.youtube.com/watch?v=CS9ptA3Ya9E https://www.youtube.com/watch?v=CS9ptA3Ya9E
  - sofixa 3y ago
    Well, it's not like companies have any alternatives. Most countries worldwide have some sort of ID system with official documents that everyone has, with a unique per document number and often personal number too. Those can be used for unique identification quite easily, even online (there are apps that can take a video selfie of you, and scan your card's NFC chip to confirm you are the owner of that card and therefore who you say you are). What alternative exists in countries without an ID system such as the US or UK? Rely on names, date of birth, place of birth? Conflicts are possible in big cities. Not everyone will have a driver's license. So yeah, it's quite easy to decide to use a unique number that everyone already has.
    - CuriousCosmic 3y ago
      > What alternative exists in countries without an ID system such as the US or UK? Rely on names, date of birth, place of birth? Conflicts are possible in big cities. Not everyone will have a driver's license. So yeah, it's quite easy to decide to use a unique number that everyone already has. The best alternative is the state ID. In every state you can get a state ID and/or a driver's license (which in almost all states is also a state ID). They contain a unique identifier and that identifier can be changed by the state if needed down the line. A federal ID standard would be nice of course but that's never going to happen due to some reasonable concerns (poor implementations resulting in loss of privacy) as well as some absolutely batshit insane ones (the ID system is the mark of the devil). I'd personally prefer that we establish a standard for a sane distributed trust federated ID system and then pressure the states into gradually adopting that rather than pushing it up to the federal level where it'll then get fucked up and everyone will be stuck with it forever.
- drdaeman 3y ago
  > No, you can't change it SSA says you can, but with a caveat that a victim should've "attempted to fix problems resulting from the misuse but continues to be disadvantaged by using the original number". I don't know how much of a barrier there is, but theoretically the number is changeable. https://faq.ssa.gov/en-us/Topic/article/KA-02220 https://faq.ssa.gov/en-us/Topic/article/KA-02220
  - Terr_ 3y ago
    Sounds like another way of saying: "We don't care if you think it looks ugly or unlucky, we won't change it without an actual practical reason."
- toast0 3y ago
  > You only get one to keep for your whole life, so keep it safe. You should be able to get replacements, but there is a lifetime limit of 10 replacements after 12/17/2005 [1]. I think that means the one from when I lost my wallet in my bedroom doesn't count! (lol, I know, but I had given up all hope, and then months later found the wallet just hanging out between the mattress and the bed frame) [1] https://secure.ssa.gov/poms.nsf/lnx/0110205400 https://secure.ssa.gov/poms.nsf/lnx/0110205400
- tick_tock_tick 3y ago
  It you know also has "not for identification" written right on it too.

alistairSH 3y ago

This leak apparently also included medical records and insurance information.

calamari4065 3y ago

This nine digit number is unique to you and is the password to all of your financial, medical, and legal information. No, you can't change it and no, there's no security. Here it is on an un-laminated paper card. You only get one to keep for your whole life, so keep it safe. You're not allowed to laminate it either. Honestly sounds like a great system. Not a single flaw here.

fullspectrumdev 3y ago
> you only get one I wish that was a joke. My wife (American) has found it utterly impossible to replace her social security card that went missing at least 7 years ago, despite several attempts. It would be nice to have so she can interact with the DMV when back in the US, and suchlike. At least where we live now, the equivalent card is infinitely replaceable within days with a simple online form, and the person number is of extremely limited value to fraudsters.
- qup 3y ago
  That's weird. I have three copies of mine. Admittedly, I got the last one close to 20 years ago, but it was an easy process then (I walked into a building, requested it, they mailed it). My parents gave me the other two.
- warner25 3y ago
  I've never needed mine to "interact with the DMV" or any other entity. Has she? It doesn't usually count as a primary form of identification like a passport, driver's license, or other government-issued ID card with a photo. I once looked into getting a replacement card because I'm not sure where mine is, and I didn't bother after reading this (https://www.ssa.gov/number-card/replace-card https://www.ssa.gov/number-card/replace-card): "You may not need to replace your card if you know your Social Security number. In most cases, a physical card isn't necessary." I thought, yeah, I guess I've never actually needed it, so if SSA isn't worried then I won't worry either.
  - macNchz 3y ago
    New York state requires you to present the physical card itself it to get a driver’s license. I had to have my parents get it out of their safe deposit box and mail it to me when I moved here. It’s also really dumb because there have been dozens of different card designs over the years, so the DMV clerk has no real way of authenticating it beyond putting the number into the computer.
Terr_ 3y ago
TBF, it's a bit more like... Government: Here's a number unique to you just for tax-related purposes. No, you can't change it and no, there's no security besides the anti-forgery measures on the card, which is why you can't laminate it. Here it is, you can't have spares, and getting a replacement is annoying, so keep it safe. Companies: Cool! You've got a tax-filing number? We're gonna use that as your personal secret password for all sorts of important shit because that's super-easy on our end. Remember, if anybody else abuses it then it's totally your fault and not ours. [0] [0] https://www.youtube.com/watch?v=CS9ptA3Ya9E https://www.youtube.com/watch?v=CS9ptA3Ya9E
- sofixa 3y ago
  Well, it's not like companies have any alternatives. Most countries worldwide have some sort of ID system with official documents that everyone has, with a unique per document number and often personal number too. Those can be used for unique identification quite easily, even online (there are apps that can take a video selfie of you, and scan your card's NFC chip to confirm you are the owner of that card and therefore who you say you are). What alternative exists in countries without an ID system such as the US or UK? Rely on names, date of birth, place of birth? Conflicts are possible in big cities. Not everyone will have a driver's license. So yeah, it's quite easy to decide to use a unique number that everyone already has.
  - CuriousCosmic 3y ago
    > What alternative exists in countries without an ID system such as the US or UK? Rely on names, date of birth, place of birth? Conflicts are possible in big cities. Not everyone will have a driver's license. So yeah, it's quite easy to decide to use a unique number that everyone already has. The best alternative is the state ID. In every state you can get a state ID and/or a driver's license (which in almost all states is also a state ID). They contain a unique identifier and that identifier can be changed by the state if needed down the line. A federal ID standard would be nice of course but that's never going to happen due to some reasonable concerns (poor implementations resulting in loss of privacy) as well as some absolutely batshit insane ones (the ID system is the mark of the devil). I'd personally prefer that we establish a standard for a sane distributed trust federated ID system and then pressure the states into gradually adopting that rather than pushing it up to the federal level where it'll then get fucked up and everyone will be stuck with it forever.
drdaeman 3y ago
> No, you can't change it SSA says you can, but with a caveat that a victim should've "attempted to fix problems resulting from the misuse but continues to be disadvantaged by using the original number". I don't know how much of a barrier there is, but theoretically the number is changeable. https://faq.ssa.gov/en-us/Topic/article/KA-02220 https://faq.ssa.gov/en-us/Topic/article/KA-02220
- Terr_ 3y ago
  Sounds like another way of saying: "We don't care if you think it looks ugly or unlucky, we won't change it without an actual practical reason."
toast0 3y ago
> You only get one to keep for your whole life, so keep it safe. You should be able to get replacements, but there is a lifetime limit of 10 replacements after 12/17/2005 [1]. I think that means the one from when I lost my wallet in my bedroom doesn't count! (lol, I know, but I had given up all hope, and then months later found the wallet just hanging out between the mattress and the bed frame) [1] https://secure.ssa.gov/poms.nsf/lnx/0110205400 https://secure.ssa.gov/poms.nsf/lnx/0110205400
tick_tock_tick 3y ago
It you know also has "not for identification" written right on it too.