3 ms·

This comes up regularly, but... is it actually true that SSN still functions as a sole authentication mechanism? I don't recall a single instance in the past de

This comes up regularly, but... is it actually true that SSN still functions as a sole authentication mechanism? I don't recall a single instance in the past decade where I could open a bank account, apply for credit, or do anything else of consequence based on an SSN alone. Well, maybe open an utility account, but that's hardly consequential, they just use your SSN to decide if you're a deadbeat who needs to make a deposit before they hook you up. In other cases, there's always either some secondary document check, or you need to pass some online quiz about your credit history. These quizzes are not bulletproof, but require the attacker to have a more comprehensive dossier on you.

atrettel 2y ago
Perhaps the SSN is not the sole authentication mechanism, but it is often the most critical. For example, I have recently have had to call Equifax, and they authenticate you over the phone using your SSN, first number in your address, and your ZIP code. They also send you an SMS verification code. Any neighbor of mine knows two of those four things, and it is quite easy to find the SSNs for most people if you know what you are doing. That's Equifax, though. Other places do not verify you with all that much information. I opened a bank account at a local bank last year in person, and as far as I can tell, their verification consisted of photocopying my driver's license and pulling my Chex Systems report using my SSN. That really isn't much verification. Unfortunately, documents can be easily faked [1]. Document check services are mostly a form of security theater. The "knowledge-based authentication" (KBA) questions are quite easy to get around if you have at least some basic information on your target. For example, the answer is often "None of the above". The last time I had to do them, 3 out of the 5 questions were "none of the above". The attacker doesn't necessarily need a complete dossier on you since they only care about making it work once. If it doesn't work on you, they'll just move on to the next target, who might have 4 out of 5 questions being "none of the above" and the other one being easy to guess. My point about public-key cryptography is that we need a system that isn't easily spoofed and that provides much stronger guarantees. And the best part about public-key cryptography is that you can give out your public key widely without any issue. Giving out your SSN is inviting disaster. We can and should do better. [1] https://www.404media.co/inside-the-underground-site-where-ai-neural-networks-churns-out-fake-ids-onlyfake/ https://www.404media.co/inside-the-underground-site-where-ai...
- deleted 2y ago
  [deleted]

atrettel 2y ago

Perhaps the SSN is not the sole authentication mechanism, but it is often the most critical. For example, I have recently have had to call Equifax, and they authenticate you over the phone using your SSN, first number in your address, and your ZIP code. They also send you an SMS verification code. Any neighbor of mine knows two of those four things, and it is quite easy to find the SSNs for most people if you know what you are doing. That's Equifax, though. Other places do not verify you with all that much information. I opened a bank account at a local bank last year in person, and as far as I can tell, their verification consisted of photocopying my driver's license and pulling my Chex Systems report using my SSN. That really isn't much verification. Unfortunately, documents can be easily faked [1]. Document check services are mostly a form of security theater. The "knowledge-based authentication" (KBA) questions are quite easy to get around if you have at least some basic information on your target. For example, the answer is often "None of the above". The last time I had to do them, 3 out of the 5 questions were "none of the above". The attacker doesn't necessarily need a complete dossier on you since they only care about making it work once. If it doesn't work on you, they'll just move on to the next target, who might have 4 out of 5 questions being "none of the above" and the other one being easy to guess. My point about public-key cryptography is that we need a system that isn't easily spoofed and that provides much stronger guarantees. And the best part about public-key cryptography is that you can give out your public key widely without any issue. Giving out your SSN is inviting disaster. We can and should do better. [1] https://www.404media.co/inside-the-underground-site-where-ai-neural-networks-churns-out-fake-ids-onlyfake/ https://www.404media.co/inside-the-underground-site-where-ai...

deleted 2y ago
[deleted]