3 ms·

SSNs should be made public. Then we could all stop pretending that knowing an SSN provides any sort of security. The pernicious idea that asking someone their

by irq-1 12y ago

SSNs should be made public. Then we could all stop pretending that knowing an SSN provides any sort of security. The pernicious idea that asking someone their SSN is like asking for a password needs to be killed, completely. To make organizations change their processes requires more than mere federal law forbidding the use of SSNs, and making SSNs public would make it obvious to _everyone_ that knowing an SSN doesn't mean anything. Make them public, and take away their power.

scintill76 12y ago
Interesting, but I think it has bad side-effects for privacy. I'm guessing this would mean a public mapping of at least full-name => SSN being published. AFAIK there's no such list of names currently -- is there a good reason for that? Would/should this list include more data like date of birth? My understanding is that SSN's from certain eras encode information on the place of birth. Might having a public, nearly unique number of any person allow buying/selling additional data from third parties more easily?
- irq-1 12y ago
  A Name<=>SSN mapping would be enough to force change. It wouldn't even have to be accurate or complete, just well known. If the government announced that it will release a list of SSNs and names, everyone would realize they can't ask for a SSN for "verification". > My understanding is that SSN's from certain eras encode information on the place of birth. It goes the other way too, from public info to SSN: http://arstechnica.com/science/2009/07/social-insecurity-numbers-open-to-hacking/ http://arstechnica.com/science/2009/07/social-insecurity-num... > Might having a public, nearly unique number of any person allow buying/selling additional data from third parties more easily? The government has been trying to restrict the use of SSNs since their beginning, including commercial restrictions. https://en.wikipedia.org/wiki/Social_Security_number#Identity_theft https://en.wikipedia.org/wiki/Social_Security_number#Identit...
  - scintill76 12y ago
    Good points, thanks. I think you missed my point about commercial use, though. Allowing a public, universal, nearly unique identifier (apparently SSN's aren't always unique) for every resident of the US might make it easier to compile, buy, and sell information about people. I guess these companies already use {name, date of birth} as an ID to attach addresses etc., but having a more robust UID would allow more accuracy when considering name changes or variants. Also, publicizing SSN's risks retroactively publicizing everything that was ever privately collected under them. I can't quite put my thumb on this, so maybe it's a bit irrational, but I would want somebody to thoroughly disprove things like this before I could support the idea. If, e.g., Facebook is completely allowed to know my SSN, they can more easily make deals with anyone else to share information about my finances, medicine, voting, etc., which are already tied to my SSN. Considering the "shadow profiles" some social companies reportedly compile, they might even be able to do this without my ever creating an account. The current situation in this area would still probably make me uncomfortable if I knew it all (as your links suggest, Facebook might already be able to guess a lot of SSN's), but I at least hope that having one "secret" and legally "regulated" element slows down some data mining and exchanging. If you have confidence that business interests or laws will prevent my worst fears from being realized, consider we're talking about this in a thread about supposedly private information being publicly released when a company got hacked. Then there's the trading and compiling these hackers could be doing outside of the public view.
    - irq-1 12y ago
      I agree that a government issued identifier is a bad idea, but that debate is long over and SSNs won. The government can still stop corporations from using it by passing a law and enforcing it (and they have for some things), but that doesn't seem likely given the history and evolution of SSNs. It seems more likely that the government continues to require SSNs on more and more reporting, and continues to not punish other uses by corporations.

by irq-1 12y ago

scintill76 12y ago

Interesting, but I think it has bad side-effects for privacy. I'm guessing this would mean a public mapping of at least full-name => SSN being published. AFAIK there's no such list of names currently -- is there a good reason for that? Would/should this list include more data like date of birth? My understanding is that SSN's from certain eras encode information on the place of birth. Might having a public, nearly unique number of any person allow buying/selling additional data from third parties more easily?

irq-1 12y ago
A Name<=>SSN mapping would be enough to force change. It wouldn't even have to be accurate or complete, just well known. If the government announced that it will release a list of SSNs and names, everyone would realize they can't ask for a SSN for "verification". > My understanding is that SSN's from certain eras encode information on the place of birth. It goes the other way too, from public info to SSN: http://arstechnica.com/science/2009/07/social-insecurity-numbers-open-to-hacking/ http://arstechnica.com/science/2009/07/social-insecurity-num... > Might having a public, nearly unique number of any person allow buying/selling additional data from third parties more easily? The government has been trying to restrict the use of SSNs since their beginning, including commercial restrictions. https://en.wikipedia.org/wiki/Social_Security_number#Identity_theft https://en.wikipedia.org/wiki/Social_Security_number#Identit...
- scintill76 12y ago
  Good points, thanks. I think you missed my point about commercial use, though. Allowing a public, universal, nearly unique identifier (apparently SSN's aren't always unique) for every resident of the US might make it easier to compile, buy, and sell information about people. I guess these companies already use {name, date of birth} as an ID to attach addresses etc., but having a more robust UID would allow more accuracy when considering name changes or variants. Also, publicizing SSN's risks retroactively publicizing everything that was ever privately collected under them. I can't quite put my thumb on this, so maybe it's a bit irrational, but I would want somebody to thoroughly disprove things like this before I could support the idea. If, e.g., Facebook is completely allowed to know my SSN, they can more easily make deals with anyone else to share information about my finances, medicine, voting, etc., which are already tied to my SSN. Considering the "shadow profiles" some social companies reportedly compile, they might even be able to do this without my ever creating an account. The current situation in this area would still probably make me uncomfortable if I knew it all (as your links suggest, Facebook might already be able to guess a lot of SSN's), but I at least hope that having one "secret" and legally "regulated" element slows down some data mining and exchanging. If you have confidence that business interests or laws will prevent my worst fears from being realized, consider we're talking about this in a thread about supposedly private information being publicly released when a company got hacked. Then there's the trading and compiling these hackers could be doing outside of the public view.
  - irq-1 12y ago
    I agree that a government issued identifier is a bad idea, but that debate is long over and SSNs won. The government can still stop corporations from using it by passing a law and enforcing it (and they have for some things), but that doesn't seem likely given the history and evolution of SSNs. It seems more likely that the government continues to require SSNs on more and more reporting, and continues to not punish other uses by corporations.