They're not really private+, and nobody should design a system with the assumption that they are. afaik nobody does these days. There are extra authentication c

They're not really private+, and nobody should design a system with the assumption that they are. afaik nobody does these days. There are extra authentication checks done in addition to simply "I have the SSN". + e.g. until very recently there were US states that used your SSN as your driver license number.