4 ms·

How can you steal a number? Here's a number: 147334572. Have I stolen it? This is yet another alarming signal that the whole idea that your SSN/SIN or credit

by jwr 13y ago

How can you steal a number? Here's a number: 147334572. Have I stolen it? This is yet another alarming signal that the whole idea that your SSN/SIN or credit card number is somehow secret and can be used for authentication is flawed. We need to work on fixing this. At the very least, we should stop talking about "stolen numbers". And even if the breach in question resulted in attackers gaining access to names + numbers (unclear from the article), it should not cause any serious consequences.

rlpb 13y ago
> How can you steal a number? The same way someone might "steal" your password. All data can be encoded as a number. > the whole idea that your SSN/SIN or credit card number is somehow secret and can be used for authentication is flawed. I don't disagree, but "how can you steal a number?" isn't a valid argument for your assertion.
yukichan 13y ago
> This is yet another alarming signal that the whole idea that your SSN/SIN or credit card number is somehow secret and can be used for authentication is flawed. Secret information is required for practical authentication. Some examples: Private keys (ssh, gpg, SSL/TLS certs, bitcoin wallets) passwords session ids api secrets auth tokens
- jwr 13y ago
  I believe you don't often write down your private keys, passwords, api secrets or auth tokens on paper forms that you then submit to various institutions you have no control over, right? As a comparison, your SSN is used all over the place, you will need to disclose it regularly (rent an apartment and your landlord is likely to request a credit check, you'll give him your SSN). A number of people and institutions will have access to it. It is not a secret. It should not be used for authentication and no one should assume it somehow secret, because it is not.
leoedin 13y ago
I agree that the short and commonly used numbers that are often considered to be proof of ID are no longer suitable. When a computer can easily guess every possible combination of numbers in a set in seconds, it's not really sensible to use it for validation. However, even if we all had a unique 4096 bit private key with which we identified ourselves, it would still essentially be a number and it would certainly be able to be stolen. Stealing a number is more or less the same as stealing a private key or stealing a classified electronic document - it's the unauthorised access and copying of information. Society has broadly come to accept that this is considered stealing.
- Nikker 13y ago
  "Stealing" a number does not exist. Learning what the number relates to by way of breaking the law should be.
  - leoedin 13y ago
    You're arguing about the definition of the word steal, and your definition is not the widely accepted one. You're facing a long and uphill struggle.
upofadown 13y ago
In Canada you can refuse to give someone your SIN for non-government purposes ... in theory. I was once refused an apartment sublet once when I did this. I had to come back with evidence that the landlord had no legal right to collect the SIN. That and the strong implication I was capable and willing to file a complaint. People use all sorts of zany things to try to prove identity. I think public education is the first line of defence against the misuse of things like SSN/SIN.
- kitcar 13y ago
  More specifically - you can't refuse to give your SIN to a financial institution or to your employer (as for 99% of Canadians those are their main sources of income, and because those entities need to submit information to the government regarding your income for tax purposes). For most other things though you can refuse to disclose it (i.e. telecom providers, debt-only financial institutions like credit card providers)
- err4nt 13y ago
  I didn't think it was so much a 'you have the right to refuse' as much as it was 'it's illegal to ask' for situations not related to taxes and payroll and stuff like that.
ctdonath 13y ago
How can you steal a name? Here's a name: jwr. Have I stolen it? This is yet another alarming signal that the whole idea that your colloquial identifying information (name, phone, SSN/SIN, credit card number) is somehow a natural resource that anyone can use as they like. We need to work on fixing this. At the very least, we should stop pretending that identifiers are just tags that anyone can use without consequence. And even if the breach in question resulted in no harm done (those associated with the identifiers suffer no direct liabilities), it should not be treated lightly. Possession of particular identifiers cannot be brushed off as "it's just a number" et al. You picked 14334572 precisely because it is not meaningful to anyone; short of such particular & peculiar use, we don't pick and retain numbers (or other identifiers) for no good reason. Out of a given range, the odds of picking 14334572 is very very small...if it happens to have a particular social meaning, and you possess it along with other information which likewise has an odd lack of meaninglessness, then you have malicious intent constituting "stolen numbers". Don't pretend information is meaningless. We're not dealing with the Library Of Babel here.
- jwr 13y ago
  I think you (and some others who are downvoting my comment) are missing the point. You having a 'jwr' string does not enable you to do much — you can't use it to gain access to anything, no one will ask you for this string to authenticate you, you can't use it to pay for services. So if you "stole" it (or produced it out of thin air), it would not be a problem. Now, I picked 14334572 specifically because it looks like a social security number (and might, for all I know, actually correspond to one). The point here was that you can't 'possess' a number, and you can't 'steal' one. You can steal complete personal information (that includes the number), but that is not what the original article was about. My main point was that the real problem is with the whole idea of social security numbers (and credit card numbers) being both public identifiers (which is fine) and authentication tokens (which is not). If they were just public identifiers, then "stealing" a list of such numbers would not be a problem for anyone. It is the embedded trust we place in those numbers that causes us problems. SSNs are not secret key material, and treating them as such causes all kinds of issues. As a side note: looking at the downvotes, I am increasingly worried about knee-jerk reactions here. I am finding that unless I craft my comment carefully and surround it with disclaimers, it will get misread. This is worrying, because it leads to watered-down and needlessly verbose discourse, words playing the role of guards against all the detail-pickers out there.
TomGullen 13y ago
Relevant: - http://en.wikipedia.org/wiki/Illegal_number http://en.wikipedia.org/wiki/Illegal_number - http://en.wikipedia.org/wiki/Illegal_prime http://en.wikipedia.org/wiki/Illegal_prime
SpikedCola 13y ago
In terms of being used for authentication, CRA and other online services usually require SIN + DOB + Postal Code, and then they mail you a 4-digit PIN to the address they have on file. Hilariously enough, if you call them, you can change the address on file if you have SIN + DOB, making the "PIN" pointless (and irritating, since you have to wait several weeks)
- serge2k 13y ago
  They have updated now to work with some of the banks. Still a pain to get it setup, but once you are setup it is much better now.
rwallace 13y ago
As a matter of principle, it's true that a number cannot be stolen. On the other hand, in some contexts obtaining a copy of a secret number can allow a thief to steal a resource such as money, which definitely can be stolen. I'm not quite sure what to use instead of the shorthand 'stole Social Security numbers'; while strictly inaccurate, better alternative phrasings don't immediately jump to mind.
danudey 13y ago
Semantics doesn't really help when everyone understands the meaning anyway. No one is going to read this and think 'Oh no, those poor people don't have their SINs anymore!' That said, the SIN in Canada is actually meant to be kept secret between you, your employer(s), the CRA, and a few other situations[1]. You should never give it to anyone else, write it down anywhere, etc. I memorized mine long ago and keep the actual card locked in a box somewhere, and I never give it out except to the government or new employers. [1] http://www.servicecanada.gc.ca/eng/sin/protect/provide.shtml http://www.servicecanada.gc.ca/eng/sin/protect/provide.shtml

by jwr 13y ago

rlpb 13y ago

> How can you steal a number? The same way someone might "steal" your password. All data can be encoded as a number. > the whole idea that your SSN/SIN or credit card number is somehow secret and can be used for authentication is flawed. I don't disagree, but "how can you steal a number?" isn't a valid argument for your assertion.

yukichan 13y ago

> This is yet another alarming signal that the whole idea that your SSN/SIN or credit card number is somehow secret and can be used for authentication is flawed. Secret information is required for practical authentication. Some examples: Private keys (ssh, gpg, SSL/TLS certs, bitcoin wallets) passwords session ids api secrets auth tokens

jwr 13y ago
I believe you don't often write down your private keys, passwords, api secrets or auth tokens on paper forms that you then submit to various institutions you have no control over, right? As a comparison, your SSN is used all over the place, you will need to disclose it regularly (rent an apartment and your landlord is likely to request a credit check, you'll give him your SSN). A number of people and institutions will have access to it. It is not a secret. It should not be used for authentication and no one should assume it somehow secret, because it is not.

leoedin 13y ago

I agree that the short and commonly used numbers that are often considered to be proof of ID are no longer suitable. When a computer can easily guess every possible combination of numbers in a set in seconds, it's not really sensible to use it for validation. However, even if we all had a unique 4096 bit private key with which we identified ourselves, it would still essentially be a number and it would certainly be able to be stolen. Stealing a number is more or less the same as stealing a private key or stealing a classified electronic document - it's the unauthorised access and copying of information. Society has broadly come to accept that this is considered stealing.

Nikker 13y ago
"Stealing" a number does not exist. Learning what the number relates to by way of breaking the law should be.
- leoedin 13y ago
  You're arguing about the definition of the word steal, and your definition is not the widely accepted one. You're facing a long and uphill struggle.

upofadown 13y ago

In Canada you can refuse to give someone your SIN for non-government purposes ... in theory. I was once refused an apartment sublet once when I did this. I had to come back with evidence that the landlord had no legal right to collect the SIN. That and the strong implication I was capable and willing to file a complaint. People use all sorts of zany things to try to prove identity. I think public education is the first line of defence against the misuse of things like SSN/SIN.

kitcar 13y ago
More specifically - you can't refuse to give your SIN to a financial institution or to your employer (as for 99% of Canadians those are their main sources of income, and because those entities need to submit information to the government regarding your income for tax purposes). For most other things though you can refuse to disclose it (i.e. telecom providers, debt-only financial institutions like credit card providers)
err4nt 13y ago
I didn't think it was so much a 'you have the right to refuse' as much as it was 'it's illegal to ask' for situations not related to taxes and payroll and stuff like that.

ctdonath 13y ago

How can you steal a name? Here's a name: jwr. Have I stolen it? This is yet another alarming signal that the whole idea that your colloquial identifying information (name, phone, SSN/SIN, credit card number) is somehow a natural resource that anyone can use as they like. We need to work on fixing this. At the very least, we should stop pretending that identifiers are just tags that anyone can use without consequence. And even if the breach in question resulted in no harm done (those associated with the identifiers suffer no direct liabilities), it should not be treated lightly. Possession of particular identifiers cannot be brushed off as "it's just a number" et al. You picked 14334572 precisely because it is not meaningful to anyone; short of such particular & peculiar use, we don't pick and retain numbers (or other identifiers) for no good reason. Out of a given range, the odds of picking 14334572 is very very small...if it happens to have a particular social meaning, and you possess it along with other information which likewise has an odd lack of meaninglessness, then you have malicious intent constituting "stolen numbers". Don't pretend information is meaningless. We're not dealing with the Library Of Babel here.

jwr 13y ago
I think you (and some others who are downvoting my comment) are missing the point. You having a 'jwr' string does not enable you to do much — you can't use it to gain access to anything, no one will ask you for this string to authenticate you, you can't use it to pay for services. So if you "stole" it (or produced it out of thin air), it would not be a problem. Now, I picked 14334572 specifically because it looks like a social security number (and might, for all I know, actually correspond to one). The point here was that you can't 'possess' a number, and you can't 'steal' one. You can steal complete personal information (that includes the number), but that is not what the original article was about. My main point was that the real problem is with the whole idea of social security numbers (and credit card numbers) being both public identifiers (which is fine) and authentication tokens (which is not). If they were just public identifiers, then "stealing" a list of such numbers would not be a problem for anyone. It is the embedded trust we place in those numbers that causes us problems. SSNs are not secret key material, and treating them as such causes all kinds of issues. As a side note: looking at the downvotes, I am increasingly worried about knee-jerk reactions here. I am finding that unless I craft my comment carefully and surround it with disclaimers, it will get misread. This is worrying, because it leads to watered-down and needlessly verbose discourse, words playing the role of guards against all the detail-pickers out there.

TomGullen 13y ago

Relevant: - http://en.wikipedia.org/wiki/Illegal_number http://en.wikipedia.org/wiki/Illegal_number - http://en.wikipedia.org/wiki/Illegal_prime http://en.wikipedia.org/wiki/Illegal_prime

SpikedCola 13y ago

In terms of being used for authentication, CRA and other online services usually require SIN + DOB + Postal Code, and then they mail you a 4-digit PIN to the address they have on file. Hilariously enough, if you call them, you can change the address on file if you have SIN + DOB, making the "PIN" pointless (and irritating, since you have to wait several weeks)

serge2k 13y ago
They have updated now to work with some of the banks. Still a pain to get it setup, but once you are setup it is much better now.

rwallace 13y ago

As a matter of principle, it's true that a number cannot be stolen. On the other hand, in some contexts obtaining a copy of a secret number can allow a thief to steal a resource such as money, which definitely can be stolen. I'm not quite sure what to use instead of the shorthand 'stole Social Security numbers'; while strictly inaccurate, better alternative phrasings don't immediately jump to mind.

danudey 13y ago

Semantics doesn't really help when everyone understands the meaning anyway. No one is going to read this and think 'Oh no, those poor people don't have their SINs anymore!' That said, the SIN in Canada is actually meant to be kept secret between you, your employer(s), the CRA, and a few other situations[1]. You should never give it to anyone else, write it down anywhere, etc. I memorized mine long ago and keep the actual card locked in a box somewhere, and I never give it out except to the government or new employers. [1] http://www.servicecanada.gc.ca/eng/sin/protect/provide.shtml http://www.servicecanada.gc.ca/eng/sin/protect/provide.shtml