5 ms·

> The breach at National Public Data may not be the worst data breach ever. But it does present yet another opportunity for this country’s leaders to acknowledg

> The breach at National Public Data may not be the worst data breach ever. But it does present yet another opportunity for this country’s leaders to acknowledge that the SSN has completely failed as a measure of authentication or authorization. It was never a good idea to use as an authenticator to begin with, and it is certainly no longer suitable for this purpose. I completely agree with Krebs's conclusion. We can replace the role that the SSN plays (authentication) with modern techniques like public-key cryptography. We have the technology. The hard part is in figuring out how to implement it and getting the will to implement it.

Mistletoe 2y ago
Hasn’t Europe already figured it out? Not that that would mean the USA would accept it. There will be an amazing amount of mark of the beast talk etc. from the people that thought Bill Gates was going to track them with nanobots in the Covid vaccine. https://commission.europa.eu/strategy-and-policy/priorities-2019-2024/europe-fit-digital-age/european-digital-identity_en https://commission.europa.eu/strategy-and-policy/priorities-...
- doe_eyes 2y ago
  Nothing is stopping wealthy and populous states, such as California, from rolling out their own smartcard IDs. This doesn't need to happen on the federal level. The problem is that harmonized, mandatory IDs are "problematic" to the left side of the political spectrum too. Undocumented immigration, voting-related wedge issues, etc.
  - atrettel 2y ago
    The US federal government already have smart cards for IDs for federal employees and contractors [1]. The technology exists. It is just a matter of implementation and political will. [1] https://en.wikipedia.org/wiki/FIPS_201 https://en.wikipedia.org/wiki/FIPS_201
  - kube-system 2y ago
    If California alone rolled out a smartcard ID, how many banks would implement support for it? And what would happen to customer when they move between states? California would probably be the greatest likelihood for success in this, but a big reason banks use other factors for identify verification is that those other identifiers work for all of their customers across state lines.
MarkMarine 2y ago
> We can replace the role that the SSN plays (authentication) with modern techniques like public-key cryptography. Would that we could (I mean political will, not technical capability) but let me tell you what is actually happening. We're replacing the identity provided by a secret number (SSN) with your phone number, and therefore your whole credit profile, your SSN, every address you've ever had, where you are standing right now, if you're in your home range (tower/wifi) and if you're actually clicking the approve this link from a device that they know. No one asked us, but we're ceding our privacy to push back against this threat.
- vasco 2y ago
  You can change phone numbers hundreds of times per hour but SSN is for life.
  - MarkMarine 2y ago
    Ah, someone who doesn’t understand modern identity. Read the docs about the breach above, everyone’s SSN is out there. It’s as secure as your birthday or your dad’s middle name.
    - deleted 2y ago
      [deleted]
    - vasco 2y ago
      Exactly why phone numbers are better than SSNs, did you just misread what I wrote?
      - MarkMarine 2y ago
        No, I didn’t misread it, you can’t use a phone number you can switch around every few minutes as identity for finance. It’s not trusted, it’s easy to see it’s VOIP. You’ll always get sent to IDV or other subsequent verification, but if you have a mobile phone with a reputable cell provider, the provider can verify who you are and if you’re holding the phone applying, if you're in your normal area, if your location history up to that point makes sense, if you just went through a SIM switch etc. this can be your trusted identity. Or, it is your trusted identity, as long as you clicked the yes button
doe_eyes 2y ago
This comes up regularly, but... is it actually true that SSN still functions as a sole authentication mechanism? I don't recall a single instance in the past decade where I could open a bank account, apply for credit, or do anything else of consequence based on an SSN alone. Well, maybe open an utility account, but that's hardly consequential, they just use your SSN to decide if you're a deadbeat who needs to make a deposit before they hook you up. In other cases, there's always either some secondary document check, or you need to pass some online quiz about your credit history. These quizzes are not bulletproof, but require the attacker to have a more comprehensive dossier on you.
- atrettel 2y ago
  Perhaps the SSN is not the sole authentication mechanism, but it is often the most critical. For example, I have recently have had to call Equifax, and they authenticate you over the phone using your SSN, first number in your address, and your ZIP code. They also send you an SMS verification code. Any neighbor of mine knows two of those four things, and it is quite easy to find the SSNs for most people if you know what you are doing. That's Equifax, though. Other places do not verify you with all that much information. I opened a bank account at a local bank last year in person, and as far as I can tell, their verification consisted of photocopying my driver's license and pulling my Chex Systems report using my SSN. That really isn't much verification. Unfortunately, documents can be easily faked [1]. Document check services are mostly a form of security theater. The "knowledge-based authentication" (KBA) questions are quite easy to get around if you have at least some basic information on your target. For example, the answer is often "None of the above". The last time I had to do them, 3 out of the 5 questions were "none of the above". The attacker doesn't necessarily need a complete dossier on you since they only care about making it work once. If it doesn't work on you, they'll just move on to the next target, who might have 4 out of 5 questions being "none of the above" and the other one being easy to guess. My point about public-key cryptography is that we need a system that isn't easily spoofed and that provides much stronger guarantees. And the best part about public-key cryptography is that you can give out your public key widely without any issue. Giving out your SSN is inviting disaster. We can and should do better. [1] https://www.404media.co/inside-the-underground-site-where-ai-neural-networks-churns-out-fake-ids-onlyfake/ https://www.404media.co/inside-the-underground-site-where-ai...
kube-system 2y ago
I think Krebs might be forgetting a bit about the history of the SSN in that statement. It was always intended to be an identification number, never an authentication code of any sort. The original Social Security cards even said "FOR SOCIAL SECURITY AND TAX PURPOSES - NOT FOR IDENTIFICATION" right on the front. If anything, this country's leaders were right all along, it's private industry who needs to admit that it makes for a poor shared-secret. It's the financial industry that created problems when they tried to use it out of expediency.
- twodave 2y ago
  Yes, indeed. The real issue isn’t that businesses use SSN to authenticate. It’s that they don’t authenticate at all.
  - kube-system 2y ago
    Meh, I don't agree. Authentication certainty is a spectrum. Bad authentication is still authentication, and good authentication is never perfect.
    - jameshart 2y ago
      But what kind of authentication signal can you possibly get from someone supplying a name, date of birth, SSN and address? Providing a tuple of those values that match a record in the social security database, or the Experian or Equifax databases, does absolutely nothing to tell you whether the person applying for a loan/job/credit card/twitter verification etc is the human being who that SSN record corresponds to.
      - kube-system 2y ago
        > But what kind of authentication signal can you possibly get from someone supplying a name, date of birth, SSN and address? Doctors at a hospital will administer potentially deadly drugs using half of that -- just last name and date of birth. They are shared secrets. They might be weak shared secrets. But alas, that's the issue with shared secrets. A lot of them suck. https://en.wikipedia.org/wiki/Knowledge-based_authentication https://en.wikipedia.org/wiki/Knowledge-based_authentication
simonw 2y ago
> We can replace the role that the SSN plays (authentication) with modern techniques like public-key cryptography. I think that would be a disaster. Have you met human beings? The idea that they could keep a private key safe and secure is not realistic at all. [EDIT: As people in replies have pointed out, this works great provided there's a central government process for issuing a new card should you lose access to your previous one - so yeah, public-key cryptography can absolutely help here provided there's a central authority to help people recover access] Same reason cryptocurrency could _NEVER_ become a mainstream way of handling finances - only the nerdiest of the super-nerds have the slightest chance of keeping a private key safe and consistently available. Even the super-nerds aren't safe. The number of technically proficient people who've lost all of their cryptocurrency/NFTs/etc has illustrated that many times over at this point.
- atrettel 2y ago
  I agree that implementing it like how cryptocurrency works would be bad. I'm not in favor of that. But as I had said, I'm not arguing for any specific implementation. However, smart cards for IDs is one implementation that already exists [1], and it would be more like using a security key instead of just typing in your SSN. I think that would be more appropriate for people with a broad range of technical experiences, but as I had said, I'm not advocating for any particular implementation, just pointing out that the technology exists to at least attempt to solve the problem. What solution do you think would work here? [1] https://en.wikipedia.org/wiki/FIPS_201 https://en.wikipedia.org/wiki/FIPS_201
- OptionOfT 2y ago
  In Belgium everybody has an ID card which has a chip which can be used to sign anything. It's a private key that is only on the card. So it's totally possible. But there needs to be a will from the government AND a will from the people to allow the government to store data on their citizens (address etc).
  - svieira 2y ago
    So what happens when you break or loose the card? How do you establish your identity at that point?

Mistletoe 2y ago

Hasn’t Europe already figured it out? Not that that would mean the USA would accept it. There will be an amazing amount of mark of the beast talk etc. from the people that thought Bill Gates was going to track them with nanobots in the Covid vaccine. https://commission.europa.eu/strategy-and-policy/priorities-2019-2024/europe-fit-digital-age/european-digital-identity_en https://commission.europa.eu/strategy-and-policy/priorities-...

doe_eyes 2y ago
Nothing is stopping wealthy and populous states, such as California, from rolling out their own smartcard IDs. This doesn't need to happen on the federal level. The problem is that harmonized, mandatory IDs are "problematic" to the left side of the political spectrum too. Undocumented immigration, voting-related wedge issues, etc.
- atrettel 2y ago
  The US federal government already have smart cards for IDs for federal employees and contractors [1]. The technology exists. It is just a matter of implementation and political will. [1] https://en.wikipedia.org/wiki/FIPS_201 https://en.wikipedia.org/wiki/FIPS_201
- kube-system 2y ago
  If California alone rolled out a smartcard ID, how many banks would implement support for it? And what would happen to customer when they move between states? California would probably be the greatest likelihood for success in this, but a big reason banks use other factors for identify verification is that those other identifiers work for all of their customers across state lines.

MarkMarine 2y ago

> We can replace the role that the SSN plays (authentication) with modern techniques like public-key cryptography. Would that we could (I mean political will, not technical capability) but let me tell you what is actually happening. We're replacing the identity provided by a secret number (SSN) with your phone number, and therefore your whole credit profile, your SSN, every address you've ever had, where you are standing right now, if you're in your home range (tower/wifi) and if you're actually clicking the approve this link from a device that they know. No one asked us, but we're ceding our privacy to push back against this threat.

vasco 2y ago
You can change phone numbers hundreds of times per hour but SSN is for life.
- MarkMarine 2y ago
  Ah, someone who doesn’t understand modern identity. Read the docs about the breach above, everyone’s SSN is out there. It’s as secure as your birthday or your dad’s middle name.
  - deleted 2y ago
    [deleted]
  - vasco 2y ago
    Exactly why phone numbers are better than SSNs, did you just misread what I wrote?
    - MarkMarine 2y ago
      No, I didn’t misread it, you can’t use a phone number you can switch around every few minutes as identity for finance. It’s not trusted, it’s easy to see it’s VOIP. You’ll always get sent to IDV or other subsequent verification, but if you have a mobile phone with a reputable cell provider, the provider can verify who you are and if you’re holding the phone applying, if you're in your normal area, if your location history up to that point makes sense, if you just went through a SIM switch etc. this can be your trusted identity. Or, it is your trusted identity, as long as you clicked the yes button

doe_eyes 2y ago

This comes up regularly, but... is it actually true that SSN still functions as a sole authentication mechanism? I don't recall a single instance in the past decade where I could open a bank account, apply for credit, or do anything else of consequence based on an SSN alone. Well, maybe open an utility account, but that's hardly consequential, they just use your SSN to decide if you're a deadbeat who needs to make a deposit before they hook you up. In other cases, there's always either some secondary document check, or you need to pass some online quiz about your credit history. These quizzes are not bulletproof, but require the attacker to have a more comprehensive dossier on you.

atrettel 2y ago
Perhaps the SSN is not the sole authentication mechanism, but it is often the most critical. For example, I have recently have had to call Equifax, and they authenticate you over the phone using your SSN, first number in your address, and your ZIP code. They also send you an SMS verification code. Any neighbor of mine knows two of those four things, and it is quite easy to find the SSNs for most people if you know what you are doing. That's Equifax, though. Other places do not verify you with all that much information. I opened a bank account at a local bank last year in person, and as far as I can tell, their verification consisted of photocopying my driver's license and pulling my Chex Systems report using my SSN. That really isn't much verification. Unfortunately, documents can be easily faked [1]. Document check services are mostly a form of security theater. The "knowledge-based authentication" (KBA) questions are quite easy to get around if you have at least some basic information on your target. For example, the answer is often "None of the above". The last time I had to do them, 3 out of the 5 questions were "none of the above". The attacker doesn't necessarily need a complete dossier on you since they only care about making it work once. If it doesn't work on you, they'll just move on to the next target, who might have 4 out of 5 questions being "none of the above" and the other one being easy to guess. My point about public-key cryptography is that we need a system that isn't easily spoofed and that provides much stronger guarantees. And the best part about public-key cryptography is that you can give out your public key widely without any issue. Giving out your SSN is inviting disaster. We can and should do better. [1] https://www.404media.co/inside-the-underground-site-where-ai-neural-networks-churns-out-fake-ids-onlyfake/ https://www.404media.co/inside-the-underground-site-where-ai...

kube-system 2y ago

I think Krebs might be forgetting a bit about the history of the SSN in that statement. It was always intended to be an identification number, never an authentication code of any sort. The original Social Security cards even said "FOR SOCIAL SECURITY AND TAX PURPOSES - NOT FOR IDENTIFICATION" right on the front. If anything, this country's leaders were right all along, it's private industry who needs to admit that it makes for a poor shared-secret. It's the financial industry that created problems when they tried to use it out of expediency.

twodave 2y ago
Yes, indeed. The real issue isn’t that businesses use SSN to authenticate. It’s that they don’t authenticate at all.
- kube-system 2y ago
  Meh, I don't agree. Authentication certainty is a spectrum. Bad authentication is still authentication, and good authentication is never perfect.
  - jameshart 2y ago
    But what kind of authentication signal can you possibly get from someone supplying a name, date of birth, SSN and address? Providing a tuple of those values that match a record in the social security database, or the Experian or Equifax databases, does absolutely nothing to tell you whether the person applying for a loan/job/credit card/twitter verification etc is the human being who that SSN record corresponds to.
    - kube-system 2y ago
      > But what kind of authentication signal can you possibly get from someone supplying a name, date of birth, SSN and address? Doctors at a hospital will administer potentially deadly drugs using half of that -- just last name and date of birth. They are shared secrets. They might be weak shared secrets. But alas, that's the issue with shared secrets. A lot of them suck. https://en.wikipedia.org/wiki/Knowledge-based_authentication https://en.wikipedia.org/wiki/Knowledge-based_authentication

simonw 2y ago

> We can replace the role that the SSN plays (authentication) with modern techniques like public-key cryptography. I think that would be a disaster. Have you met human beings? The idea that they could keep a private key safe and secure is not realistic at all. [EDIT: As people in replies have pointed out, this works great provided there's a central government process for issuing a new card should you lose access to your previous one - so yeah, public-key cryptography can absolutely help here provided there's a central authority to help people recover access] Same reason cryptocurrency could _NEVER_ become a mainstream way of handling finances - only the nerdiest of the super-nerds have the slightest chance of keeping a private key safe and consistently available. Even the super-nerds aren't safe. The number of technically proficient people who've lost all of their cryptocurrency/NFTs/etc has illustrated that many times over at this point.

atrettel 2y ago
I agree that implementing it like how cryptocurrency works would be bad. I'm not in favor of that. But as I had said, I'm not arguing for any specific implementation. However, smart cards for IDs is one implementation that already exists [1], and it would be more like using a security key instead of just typing in your SSN. I think that would be more appropriate for people with a broad range of technical experiences, but as I had said, I'm not advocating for any particular implementation, just pointing out that the technology exists to at least attempt to solve the problem. What solution do you think would work here? [1] https://en.wikipedia.org/wiki/FIPS_201 https://en.wikipedia.org/wiki/FIPS_201
OptionOfT 2y ago
In Belgium everybody has an ID card which has a chip which can be used to sign anything. It's a private key that is only on the card. So it's totally possible. But there needs to be a will from the government AND a will from the people to allow the government to store data on their citizens (address etc).
- svieira 2y ago
  So what happens when you break or loose the card? How do you establish your identity at that point?