6 ms·

I normally don't have much sympathy for companies which get egg-on-face because of their own incompetence, but I am very sympathetic to the employees and past e

I normally don't have much sympathy for companies which get egg-on-face because of their own incompetence, but I am very sympathetic to the employees and past employees who just had their SSN and other vitals leaked onto the internet. As an aside SSNs really need a massive overhaul. In theory they're meant to only be used for government stuff, but their use is now so broad (finance, insurance, medical, et al) that their leakage is all too common and the potential cost of a leak too damaging. With a little bit of investment the SSA could continue to generate SSNs (for historical reasons and government department usage) and generate a new SSID which is just a longer unique number which companies are legally prohibited from storing, however when they receive it they forward it to the SSA via an API and it returns a static unique customer number (UCN) which they can then in fact store. This has the following advantages: - The SSA can update your SSID a lot. Every few years, every new card, or when requested. Unlike SSNs which cannot be changed. - Updating your SSID won't break existing accounts or similar, as companies won't store the old one anyway (only the resulting UCN). Unlike SSNs which break stuff if changed. - Leaked UCNs are not as useful because you cannot enter them into a web-site or put them on a financial form directly (it would be a different length/format to SSIDs or SSNs on purpose). Unlike SSNs which can be directly reused. - The system doesn't depend on complex cryptography. It is just a simple perhaps JSON request over HTTPS. You could deploy this system over ten years at minimal cost. The system is relatively simply, and behind the scenes it can tie UCNs to SSNs in the SSA's database system. A single customer would have three things (in this system): Current SSID, static SSN, static UCN.

VLM 12y ago
If SSN was no longer the primary key for financial and marketing data, and UCNs were only locally significant, this would make data sharing rather difficult between companies. Think of banks and service providers talking with credit bureaus. Or they'd just use an even more inferior technique for UUIDs like "name-address". Or even more invasive (biometrics, or something)
- Jedd 12y ago
  You mean a system similar to what almost every non-USA country currently uses? Here in sunny Australia we don't have anything like an SSN, at least not in terms of secrecy and potential personal disruption were it revealed. We have a TFN (Tax File Number) but lots of non-owners of that number need to, and do, have access to it. Our bank accounts contain two parts - the branch (BSB) and account numbers. Anyone can get access to those, and in fact we frequently share them in order to receive payments. The way the US, and I think the UK also, revere such evidently hard-to-protect information means the social designs around them are hugely fragile. Really, it's not a hypothetical 'there has to be a better way', but simply 'there is a better way'.
  - justincormack 12y ago
    Not aware of a UK equivalent of SSN.
    - Jedd 12y ago
      Justin - you're quite right. NI number isn't anywhere near so powerful. However I was thinking more of the assumption that your Sort code[1] + account number can be kept secret, and more importantly the profound risks to your finances if it is not. [1] http://en.wikipedia.org/wiki/Sort_code http://en.wikipedia.org/wiki/Sort_code
      - JonoBB 12y ago
        Sort code and account number is no risk at all. You can (and many do) quite happily give this information out.
        justincormack 12y ago
        Indeed, it allows you to pay me money, you can easily obtain them from invoices... they do not provide any authentication.
        geographomics 12y ago
        There is some risk in revealing these, for example: http://news.bbc.co.uk/1/hi/7174760.stm http://news.bbc.co.uk/1/hi/7174760.stm
- UnoriginalGuy 12y ago
  They could just share UCNs instead. SSIDs cannot be stored (or shared). But UCNs would function exactly like SSNs in the current system. SSIDs just exist to "wrap" UCNs, they prove that you have the current SSID for whatever person you're claiming to be (kind of like a poor man's password) and make it more difficult for thieves to re-use the UCN number trivially (you'd have to be an insider to enter a UCN, outsiders need the SSID). The reason to stop people storing or sharing the SSID is primarily so SSIDs themselves don't become the SSN replacement. Companies might get lazy and instead of converting the SSID at the SSA, they instead "cache" the SSID->UCN conversion in-house or worse just use the SSID directly. You have to make SSIDs ephemeral. UCNs and SSNs are static. UCNs can be stored/shared, SSNs get outmoded eventually, and SSIDs are short-lived no storage-sharing numbers that provide the UCN.
taf2 12y ago
great idea... which consultant gets to build it for 800 billion dollars?
downandout 12y ago
>I am very sympathetic to the employees and past employees who just had their SSN and other vitals leaked onto the internet. What makes it even worse is that the SSA makes it virtually impossible obtain a new SSN. Even showing them that you were a victim in a high profile leak like this, for example, isn't enough. You have to prove actual misuse, such as someone taking a credit card out or being arrested in your name, before they will issue a new one. In almost all cases, police reports are required. Given that a new SSN is essentially impossible, if I were a victim in this, I would immediately freeze my credit file at all 3 major credit bureaus. In most states this can be done for $0-$10 per bureau. This can cause hassles for instant credit approvals etc, but they provide mechanisms to unfreeze the file temporarily when necessary.
- MatthewMcDonald 12y ago
  Why wait until you're a victim? It's much easier to prevent significant damage to your credit history than it is to repair it. The hassle with credit approvals is pretty minimal; people generally know ahead of time when they'll need a credit check, and it only takes ~15 minutes to put a temporary lift in place. Identity theft is often an expensive, massive headache that can take years to fully recover from.
- steven2012 12y ago
  Actual misuse isn't enough. There was the case of a woman whose ssn was used by hundreds of people. I think she eventually was able to get a new number but it took years and it's impossible for anyone else.
skrish 12y ago
+1 I recently saw a demo of the "Aadhaar" project by Indian government in Nasscom Product Conclave event (in Bangalore). I was a skeptic & still am wary about security aspects of something at this scale by government. But I was quite impressed by the progress & the use cases [1] themselves. They showed in real time, how a bank account authentication can be completed without bringing any other document. Just IRIS scanner on a phone / tablet, that confirmed the identify of user by returning a photograph & other details. It was done in seconds with a 3G network. There were a few other use cases demonstrated and was pleasantly surprised to learn there are companies in valley that are building services on top of the API. [2] [1] Overview of Aadhaar service: https://resident.uidai.net.in/aadhaar-services;jsessionid=B1B0ABF71B01A60E809E838B27770736.RES32 https://resident.uidai.net.in/aadhaar-services;jsessionid=B1... [2] API: https://developer.uidai.gov.in/site/book/export/html/18 https://developer.uidai.gov.in/site/book/export/html/18
maxerickson 12y ago
Companies just shouldn't use a government id number for any sort of authentication. They might need such a number to carry out some level of authentication, but they shouldn't treat knowledge of the number as significant.
- UnoriginalGuy 12y ago
  Perhaps you're right. But then they still need a way of uniquely identifying a specific individual across many products and services. If for combating fraud if nothing else. There could always be an independant organisation who generates GUIDs for everyone, but you'd still want to improve on SSNs due to the limitations outlined above.
  - maxerickson 12y ago
    The unique id is fine. It's pretending that it can be a secret that causes all the problems. It should be treated as personally identifiable information and not distributed carelessly, but that shouldn't be mixed up with treating it as secret (which it needs to be to provide useful verification of identity).
irq-1 12y ago
SSNs should be made public. Then we could all stop pretending that knowing an SSN provides any sort of security. The pernicious idea that asking someone their SSN is like asking for a password needs to be killed, completely. To make organizations change their processes requires more than mere federal law forbidding the use of SSNs, and making SSNs public would make it obvious to _everyone_ that knowing an SSN doesn't mean anything. Make them public, and take away their power.
- scintill76 12y ago
  Interesting, but I think it has bad side-effects for privacy. I'm guessing this would mean a public mapping of at least full-name => SSN being published. AFAIK there's no such list of names currently -- is there a good reason for that? Would/should this list include more data like date of birth? My understanding is that SSN's from certain eras encode information on the place of birth. Might having a public, nearly unique number of any person allow buying/selling additional data from third parties more easily?
  - irq-1 12y ago
    A Name<=>SSN mapping would be enough to force change. It wouldn't even have to be accurate or complete, just well known. If the government announced that it will release a list of SSNs and names, everyone would realize they can't ask for a SSN for "verification". > My understanding is that SSN's from certain eras encode information on the place of birth. It goes the other way too, from public info to SSN: http://arstechnica.com/science/2009/07/social-insecurity-numbers-open-to-hacking/ http://arstechnica.com/science/2009/07/social-insecurity-num... > Might having a public, nearly unique number of any person allow buying/selling additional data from third parties more easily? The government has been trying to restrict the use of SSNs since their beginning, including commercial restrictions. https://en.wikipedia.org/wiki/Social_Security_number#Identity_theft https://en.wikipedia.org/wiki/Social_Security_number#Identit...
    - scintill76 12y ago
      Good points, thanks. I think you missed my point about commercial use, though. Allowing a public, universal, nearly unique identifier (apparently SSN's aren't always unique) for every resident of the US might make it easier to compile, buy, and sell information about people. I guess these companies already use {name, date of birth} as an ID to attach addresses etc., but having a more robust UID would allow more accuracy when considering name changes or variants. Also, publicizing SSN's risks retroactively publicizing everything that was ever privately collected under them. I can't quite put my thumb on this, so maybe it's a bit irrational, but I would want somebody to thoroughly disprove things like this before I could support the idea. If, e.g., Facebook is completely allowed to know my SSN, they can more easily make deals with anyone else to share information about my finances, medicine, voting, etc., which are already tied to my SSN. Considering the "shadow profiles" some social companies reportedly compile, they might even be able to do this without my ever creating an account. The current situation in this area would still probably make me uncomfortable if I knew it all (as your links suggest, Facebook might already be able to guess a lot of SSN's), but I at least hope that having one "secret" and legally "regulated" element slows down some data mining and exchanging. If you have confidence that business interests or laws will prevent my worst fears from being realized, consider we're talking about this in a thread about supposedly private information being publicly released when a company got hacked. Then there's the trading and compiling these hackers could be doing outside of the public view.
scintill76 12y ago
Somewhat related, I think the history of SSNs is a lesson in things like separation-of-concerns and scope creep. Social Security cards started in 1936 with the heading "Social Security Act." In 1946, "For Social Security Purposes Not For Identification." In 1961, "For Social Security and Tax Purposes -- Not For Identification." In 1972, they gave up on "not for identification." As of 2007, the card includes security features such as color-shifting ink and a latent image only viewable from certain angles. It seems the card progressed from simply a medium to convey an account number to the holder, to a high-security proof of eligibility and identity. A system designed in the 30's, explicitly not for identification, is still in use 80 years later for everything from its original design for a single government agency, to medical care, financial credit tracking, taxation, voting, employment, etc. Might we have benefited from re-designing it at some point in the past, instead of overloading purposes beyond what it was created for? http://www.ssa.gov/history/ssn/ssnversions.html http://www.ssa.gov/history/ssn/ssnversions.html

VLM 12y ago

If SSN was no longer the primary key for financial and marketing data, and UCNs were only locally significant, this would make data sharing rather difficult between companies. Think of banks and service providers talking with credit bureaus. Or they'd just use an even more inferior technique for UUIDs like "name-address". Or even more invasive (biometrics, or something)

Jedd 12y ago
You mean a system similar to what almost every non-USA country currently uses? Here in sunny Australia we don't have anything like an SSN, at least not in terms of secrecy and potential personal disruption were it revealed. We have a TFN (Tax File Number) but lots of non-owners of that number need to, and do, have access to it. Our bank accounts contain two parts - the branch (BSB) and account numbers. Anyone can get access to those, and in fact we frequently share them in order to receive payments. The way the US, and I think the UK also, revere such evidently hard-to-protect information means the social designs around them are hugely fragile. Really, it's not a hypothetical 'there has to be a better way', but simply 'there is a better way'.
- justincormack 12y ago
  Not aware of a UK equivalent of SSN.
  - Jedd 12y ago
    Justin - you're quite right. NI number isn't anywhere near so powerful. However I was thinking more of the assumption that your Sort code[1] + account number can be kept secret, and more importantly the profound risks to your finances if it is not. [1] http://en.wikipedia.org/wiki/Sort_code http://en.wikipedia.org/wiki/Sort_code
    - JonoBB 12y ago
      Sort code and account number is no risk at all. You can (and many do) quite happily give this information out.
      - justincormack 12y ago
        Indeed, it allows you to pay me money, you can easily obtain them from invoices... they do not provide any authentication.
      - geographomics 12y ago
        There is some risk in revealing these, for example: http://news.bbc.co.uk/1/hi/7174760.stm http://news.bbc.co.uk/1/hi/7174760.stm
UnoriginalGuy 12y ago
They could just share UCNs instead. SSIDs cannot be stored (or shared). But UCNs would function exactly like SSNs in the current system. SSIDs just exist to "wrap" UCNs, they prove that you have the current SSID for whatever person you're claiming to be (kind of like a poor man's password) and make it more difficult for thieves to re-use the UCN number trivially (you'd have to be an insider to enter a UCN, outsiders need the SSID). The reason to stop people storing or sharing the SSID is primarily so SSIDs themselves don't become the SSN replacement. Companies might get lazy and instead of converting the SSID at the SSA, they instead "cache" the SSID->UCN conversion in-house or worse just use the SSID directly. You have to make SSIDs ephemeral. UCNs and SSNs are static. UCNs can be stored/shared, SSNs get outmoded eventually, and SSIDs are short-lived no storage-sharing numbers that provide the UCN.

taf2 12y ago

great idea... which consultant gets to build it for 800 billion dollars?

downandout 12y ago

>I am very sympathetic to the employees and past employees who just had their SSN and other vitals leaked onto the internet. What makes it even worse is that the SSA makes it virtually impossible obtain a new SSN. Even showing them that you were a victim in a high profile leak like this, for example, isn't enough. You have to prove actual misuse, such as someone taking a credit card out or being arrested in your name, before they will issue a new one. In almost all cases, police reports are required. Given that a new SSN is essentially impossible, if I were a victim in this, I would immediately freeze my credit file at all 3 major credit bureaus. In most states this can be done for $0-$10 per bureau. This can cause hassles for instant credit approvals etc, but they provide mechanisms to unfreeze the file temporarily when necessary.

MatthewMcDonald 12y ago
Why wait until you're a victim? It's much easier to prevent significant damage to your credit history than it is to repair it. The hassle with credit approvals is pretty minimal; people generally know ahead of time when they'll need a credit check, and it only takes ~15 minutes to put a temporary lift in place. Identity theft is often an expensive, massive headache that can take years to fully recover from.
steven2012 12y ago
Actual misuse isn't enough. There was the case of a woman whose ssn was used by hundreds of people. I think she eventually was able to get a new number but it took years and it's impossible for anyone else.

skrish 12y ago

+1 I recently saw a demo of the "Aadhaar" project by Indian government in Nasscom Product Conclave event (in Bangalore). I was a skeptic & still am wary about security aspects of something at this scale by government. But I was quite impressed by the progress & the use cases [1] themselves. They showed in real time, how a bank account authentication can be completed without bringing any other document. Just IRIS scanner on a phone / tablet, that confirmed the identify of user by returning a photograph & other details. It was done in seconds with a 3G network. There were a few other use cases demonstrated and was pleasantly surprised to learn there are companies in valley that are building services on top of the API. [2] [1] Overview of Aadhaar service: https://resident.uidai.net.in/aadhaar-services;jsessionid=B1B0ABF71B01A60E809E838B27770736.RES32 https://resident.uidai.net.in/aadhaar-services;jsessionid=B1... [2] API: https://developer.uidai.gov.in/site/book/export/html/18 https://developer.uidai.gov.in/site/book/export/html/18

maxerickson 12y ago

Companies just shouldn't use a government id number for any sort of authentication. They might need such a number to carry out some level of authentication, but they shouldn't treat knowledge of the number as significant.

UnoriginalGuy 12y ago
Perhaps you're right. But then they still need a way of uniquely identifying a specific individual across many products and services. If for combating fraud if nothing else. There could always be an independant organisation who generates GUIDs for everyone, but you'd still want to improve on SSNs due to the limitations outlined above.
- maxerickson 12y ago
  The unique id is fine. It's pretending that it can be a secret that causes all the problems. It should be treated as personally identifiable information and not distributed carelessly, but that shouldn't be mixed up with treating it as secret (which it needs to be to provide useful verification of identity).

irq-1 12y ago

SSNs should be made public. Then we could all stop pretending that knowing an SSN provides any sort of security. The pernicious idea that asking someone their SSN is like asking for a password needs to be killed, completely. To make organizations change their processes requires more than mere federal law forbidding the use of SSNs, and making SSNs public would make it obvious to _everyone_ that knowing an SSN doesn't mean anything. Make them public, and take away their power.

scintill76 12y ago
Interesting, but I think it has bad side-effects for privacy. I'm guessing this would mean a public mapping of at least full-name => SSN being published. AFAIK there's no such list of names currently -- is there a good reason for that? Would/should this list include more data like date of birth? My understanding is that SSN's from certain eras encode information on the place of birth. Might having a public, nearly unique number of any person allow buying/selling additional data from third parties more easily?
- irq-1 12y ago
  A Name<=>SSN mapping would be enough to force change. It wouldn't even have to be accurate or complete, just well known. If the government announced that it will release a list of SSNs and names, everyone would realize they can't ask for a SSN for "verification". > My understanding is that SSN's from certain eras encode information on the place of birth. It goes the other way too, from public info to SSN: http://arstechnica.com/science/2009/07/social-insecurity-numbers-open-to-hacking/ http://arstechnica.com/science/2009/07/social-insecurity-num... > Might having a public, nearly unique number of any person allow buying/selling additional data from third parties more easily? The government has been trying to restrict the use of SSNs since their beginning, including commercial restrictions. https://en.wikipedia.org/wiki/Social_Security_number#Identity_theft https://en.wikipedia.org/wiki/Social_Security_number#Identit...
  - scintill76 12y ago
    Good points, thanks. I think you missed my point about commercial use, though. Allowing a public, universal, nearly unique identifier (apparently SSN's aren't always unique) for every resident of the US might make it easier to compile, buy, and sell information about people. I guess these companies already use {name, date of birth} as an ID to attach addresses etc., but having a more robust UID would allow more accuracy when considering name changes or variants. Also, publicizing SSN's risks retroactively publicizing everything that was ever privately collected under them. I can't quite put my thumb on this, so maybe it's a bit irrational, but I would want somebody to thoroughly disprove things like this before I could support the idea. If, e.g., Facebook is completely allowed to know my SSN, they can more easily make deals with anyone else to share information about my finances, medicine, voting, etc., which are already tied to my SSN. Considering the "shadow profiles" some social companies reportedly compile, they might even be able to do this without my ever creating an account. The current situation in this area would still probably make me uncomfortable if I knew it all (as your links suggest, Facebook might already be able to guess a lot of SSN's), but I at least hope that having one "secret" and legally "regulated" element slows down some data mining and exchanging. If you have confidence that business interests or laws will prevent my worst fears from being realized, consider we're talking about this in a thread about supposedly private information being publicly released when a company got hacked. Then there's the trading and compiling these hackers could be doing outside of the public view.

scintill76 12y ago

Somewhat related, I think the history of SSNs is a lesson in things like separation-of-concerns and scope creep. Social Security cards started in 1936 with the heading "Social Security Act." In 1946, "For Social Security Purposes Not For Identification." In 1961, "For Social Security and Tax Purposes -- Not For Identification." In 1972, they gave up on "not for identification." As of 2007, the card includes security features such as color-shifting ink and a latent image only viewable from certain angles. It seems the card progressed from simply a medium to convey an account number to the holder, to a high-security proof of eligibility and identity. A system designed in the 30's, explicitly not for identification, is still in use 80 years later for everything from its original design for a single government agency, to medical care, financial credit tracking, taxation, voting, employment, etc. Might we have benefited from re-designing it at some point in the past, instead of overloading purposes beyond what it was created for? http://www.ssa.gov/history/ssn/ssnversions.html http://www.ssa.gov/history/ssn/ssnversions.html