5 ms·

> cybercriminals have stolen information, including social security numbers Very few companies have any way to differentiate between "person who has a SSN" vs

by nix0n 3y ago

> cybercriminals have stolen information, including social security numbers Very few companies have any way to differentiate between "person who has a SSN" vs "someone else who knows that SSN". > some kind of social engineering attack It's not really even social engineering at that point. It would take a lot of work to convince a company that person was not who they claimed to be.

Swizec 3y ago
> Very few companies have any way to differentiate between "person who has a SSN" vs "someone else who knows that SSN" Why is USA like this? The SSN thing has felt ridiculous ever since I moved here. “This is your SSN! It is super top secret important information, do not share with anyone ever” … “Oh also please give this number in plaintext to every company under the sun”
- ensignavenger 3y ago
  What do other countries generally do? I know many have national IDs, but if the USA had a national ID #, wouldn't that just put us in the same bucket as SSN? X.509 certs with public private keys may offer a solution, but I don't think there are many large countries that have adopted anything like that on a nationwide scale? X.509 certs still have an authority issue with managing their life cycle, something I personally beleive a competent goverment could figure out, though, but I know there are security experts who are skeptical. Biometrics offer another possible solution, but privacy advocates have been pretty, leery, perhaps for good reason, of mass biometric collection. What countries have successfully adopted a nationwide biometric identification system? Other soltions? I certainly agree SSNs as identification is a.complete.joke, but I am not sure the identification problem is completely a solved solution, either.
  - Swizec 3y ago
    Oh SSN as identification makes complete sense. But it can’t also be a password, that’s where these things go wrong. Growing up in Europe you never hear about identity theft as a thing that exists. I think it’s because you have to present official photo ID when signing any serious contracts. And the liability for checking your identity falls on companies instead of individuals. This makes them care enough that the problem simply goes away. PS: SSNs get recycled so they’re not only bad as passwords, they also aren’t very good at identification
    - giobox 3y ago
      > Growing up in Europe you never hear about identity theft as a thing that exists. > And the liability for checking your identity falls on companies instead of individuals. This makes them care enough that the problem simply goes away. What nonsense, to claim identity theft is a thing that doesn't happen in Europe! People pretend to be other people to access things they shouldn't almost everywhere. It's not a problem that gets solved at a continent level either - the EU alone has 27 separate States with their own legal systems and rules.
      - Swizec 3y ago
        I'm not saying it doesn't happen. I'm saying it's not a big part of public consciousness. You don't have movies that use identity theft as a plot point similar to how "teacher becomes meth dealer to pay for health care" wouldn't make sense as a TV show set in Europe. Forging a government issued identity card or passport to fit your description and biometrics is a very different beast than skimming someone's SSN. You'd only go to that much trouble for some very serious payout potential.
    - ensignavenger 3y ago
      I have never heard of SSNs being recycled? https://www.aarp.org/retirement/social-security/questions-answers/do-identification-numbers-get-reused.html https://www.aarp.org/retirement/social-security/questions-an... says otherwise. According to this official EU website, identity theft is certainly a thing in Europe. https://www.enisa.europa.eu/publications/enisa-threat-landscape-2020-identity-theft https://www.enisa.europa.eu/publications/enisa-threat-landsc...
      - ensignavenger 3y ago
        Since the above linked article had a worldwide focus, I found this one that talks more in depth about identity theft in the EU in particuliar. https://op.europa.eu/en/publication-detail/-/publication/f85399b3-abed-11ec-83e1-01aa75ed71a1/language-en https://op.europa.eu/en/publication-detail/-/publication/f85...
phpisthebest 3y ago
It is almost like SSN should not be used for Identification, it was never designed for that, and officially The SSN card is not an identification document (ID) ... [1] >>>Very few companies have any way to differentiate between "person who has a SSN" vs "someone else who knows that SSN". that seems like a them problem, not a me problem. If they accept that as an ID, and then are defrauded for money why can than them make that my problem? [1]https://secure.ssa.gov/poms.nsf/lnx/0110201065 https://secure.ssa.gov/poms.nsf/lnx/0110201065
- nix0n 3y ago
  > If they accept that as an ID, and then are defrauded for money why can than them make that my problem? They will have lots of help making it your problem, from collections agents and courts and eventually the police. > SSN should not be used for Identification I agree that it shouldn't, but it is.
- dylan604 3y ago
  On the back of older social security cards, it had text specifying "not an identification card". Modern cards no longer have that text.
Workaccount2 3y ago
When I worked at a restruant years ago, the owner got in trouble with wages so he started having to pay everyone with a check. This included the mostly illegal immigrant staffed kitchen. This presented a problem as you need their SSN's to have them legally work there to legally report their income. But the guys in the kitchen didn't flinch. They just went over to the run down part of town, and the next day all came back with fresh new SSNs. These guys had no idea what an SSN was, just that they needed one and that you can pay a guy to give you one. The owner doesn't care because it's not on him to police the legitimacy of the provided ssns. So you end up with a bunch of people whose IDs were stolen having to wrangle with the IRS to not get taxed on the pay for a line cook or dishwasher. Totally idiotic and outdated system.
- sokoloff 3y ago
  > The owner doesn't care because it's not on him to police the legitimacy of the provided ssns. I think there is an employer obligation: https://www.uscis.gov/i-9-central/form-i-9-resources/handbook-for-employers-m-274/10-why-employers-must-verify-employment-authorization-and-identity-of-new-employees https://www.uscis.gov/i-9-central/form-i-9-resources/handboo...

by nix0n 3y ago

Swizec 3y ago

> Very few companies have any way to differentiate between "person who has a SSN" vs "someone else who knows that SSN" Why is USA like this? The SSN thing has felt ridiculous ever since I moved here. “This is your SSN! It is super top secret important information, do not share with anyone ever” … “Oh also please give this number in plaintext to every company under the sun”

ensignavenger 3y ago
What do other countries generally do? I know many have national IDs, but if the USA had a national ID #, wouldn't that just put us in the same bucket as SSN? X.509 certs with public private keys may offer a solution, but I don't think there are many large countries that have adopted anything like that on a nationwide scale? X.509 certs still have an authority issue with managing their life cycle, something I personally beleive a competent goverment could figure out, though, but I know there are security experts who are skeptical. Biometrics offer another possible solution, but privacy advocates have been pretty, leery, perhaps for good reason, of mass biometric collection. What countries have successfully adopted a nationwide biometric identification system? Other soltions? I certainly agree SSNs as identification is a.complete.joke, but I am not sure the identification problem is completely a solved solution, either.
- Swizec 3y ago
  Oh SSN as identification makes complete sense. But it can’t also be a password, that’s where these things go wrong. Growing up in Europe you never hear about identity theft as a thing that exists. I think it’s because you have to present official photo ID when signing any serious contracts. And the liability for checking your identity falls on companies instead of individuals. This makes them care enough that the problem simply goes away. PS: SSNs get recycled so they’re not only bad as passwords, they also aren’t very good at identification
  - giobox 3y ago
    > Growing up in Europe you never hear about identity theft as a thing that exists. > And the liability for checking your identity falls on companies instead of individuals. This makes them care enough that the problem simply goes away. What nonsense, to claim identity theft is a thing that doesn't happen in Europe! People pretend to be other people to access things they shouldn't almost everywhere. It's not a problem that gets solved at a continent level either - the EU alone has 27 separate States with their own legal systems and rules.
    - Swizec 3y ago
      I'm not saying it doesn't happen. I'm saying it's not a big part of public consciousness. You don't have movies that use identity theft as a plot point similar to how "teacher becomes meth dealer to pay for health care" wouldn't make sense as a TV show set in Europe. Forging a government issued identity card or passport to fit your description and biometrics is a very different beast than skimming someone's SSN. You'd only go to that much trouble for some very serious payout potential.
  - ensignavenger 3y ago
    I have never heard of SSNs being recycled? https://www.aarp.org/retirement/social-security/questions-answers/do-identification-numbers-get-reused.html https://www.aarp.org/retirement/social-security/questions-an... says otherwise. According to this official EU website, identity theft is certainly a thing in Europe. https://www.enisa.europa.eu/publications/enisa-threat-landscape-2020-identity-theft https://www.enisa.europa.eu/publications/enisa-threat-landsc...
    - ensignavenger 3y ago
      Since the above linked article had a worldwide focus, I found this one that talks more in depth about identity theft in the EU in particuliar. https://op.europa.eu/en/publication-detail/-/publication/f85399b3-abed-11ec-83e1-01aa75ed71a1/language-en https://op.europa.eu/en/publication-detail/-/publication/f85...

phpisthebest 3y ago

It is almost like SSN should not be used for Identification, it was never designed for that, and officially The SSN card is not an identification document (ID) ... [1] >>>Very few companies have any way to differentiate between "person who has a SSN" vs "someone else who knows that SSN". that seems like a them problem, not a me problem. If they accept that as an ID, and then are defrauded for money why can than them make that my problem? [1]https://secure.ssa.gov/poms.nsf/lnx/0110201065 https://secure.ssa.gov/poms.nsf/lnx/0110201065

nix0n 3y ago
> If they accept that as an ID, and then are defrauded for money why can than them make that my problem? They will have lots of help making it your problem, from collections agents and courts and eventually the police. > SSN should not be used for Identification I agree that it shouldn't, but it is.
dylan604 3y ago
On the back of older social security cards, it had text specifying "not an identification card". Modern cards no longer have that text.

Workaccount2 3y ago

When I worked at a restruant years ago, the owner got in trouble with wages so he started having to pay everyone with a check. This included the mostly illegal immigrant staffed kitchen. This presented a problem as you need their SSN's to have them legally work there to legally report their income. But the guys in the kitchen didn't flinch. They just went over to the run down part of town, and the next day all came back with fresh new SSNs. These guys had no idea what an SSN was, just that they needed one and that you can pay a guy to give you one. The owner doesn't care because it's not on him to police the legitimacy of the provided ssns. So you end up with a bunch of people whose IDs were stolen having to wrangle with the IRS to not get taxed on the pay for a line cook or dishwasher. Totally idiotic and outdated system.

sokoloff 3y ago
> The owner doesn't care because it's not on him to police the legitimacy of the provided ssns. I think there is an employer obligation: https://www.uscis.gov/i-9-central/form-i-9-resources/handbook-for-employers-m-274/10-why-employers-must-verify-employment-authorization-and-identity-of-new-employees https://www.uscis.gov/i-9-central/form-i-9-resources/handboo...