7 ms·

I feel most for those who have young children. If you consider the long term viability of SSN over the life-span of a person who is under the age of 5 today th

I feel most for those who have young children. If you consider the long term viability of SSN over the life-span of a person who is under the age of 5 today they'll likely have been exposed to a breach that will contain their dox a few times over by the time they reach a legal age - that is likely a conservative estimate given the frequency of these events. SSN is broken and we're going to see a lot of push back going forward as these people come of age. TL;DR If you're a parent, monitor your child's SSN for activity. Especially considering this is a healthcare breach, nobody is immune.

babyjake 12y ago
Thanks for the advice. Can you give some specific steps on how to "monitor your child's SSN for activity"? How would I go about doing this?
- at-fates-hands 12y ago
  Start with Trans Union, they have a child specific application so you can find out if your child's SSN has been used by identity thieves: http://www.transunion.com/corporate/personal/fraudIdentityTheft/fraudPrevention/childIdTheft.page http://www.transunion.com/corporate/personal/fraudIdentityTh... If they don't have any reports, there's a good chance you're probably ok. You can also apply to put a security freeze on your child's SSN. State by state laws and application process here: http://consumersunion.org/research/security-freeze/ http://consumersunion.org/research/security-freeze/ And then there's the myriad of companies who can give you protection for a monthly fee: AllClearID: https://www.allclearid.com/ https://www.allclearid.com/ LifeLock Junior: http://www.safety4yourkids.com http://www.safety4yourkids.com Also, Experian has a monitoring service as well specifically for kids: http://www.familysecure.com/ http://www.familysecure.com/ Hope this helps.
  - BrokenEnso 12y ago
    Just filled out the Trans Union site with dummy data to check, and none of the transaction is over SSL. So, to kind out if my child's identity has been stolen I have to expose them to identity theft....
    - webXL 12y ago
      That shocked me as well. Doesn't exactly give you a warm fuzzy feeling about a major credit reporting agency's security measures. Do some of these companies just view these breaches/vulnerabilities as a joke?
    - nkozyra 12y ago
      Wow. That is incredibly hilarious and sad. I passed the note on to TU.
sprkyco 12y ago
Had never really thought of that angle. Being a father it does shake me up a bit more than usual as it seems my peers and I are quite used to these headlines being the norm. Imagining a future in which you have already been "doxed" prior to elementary school is a bit disturbing.
k2enemy 12y ago
We really do need to find a better way of authenticating and identifying people. SSNs were never meant for this and they clearly don't fill the role successfully. I've long been a proponent of the government announcing that they will publish everyone's SSN 2 years from now. Banks, insurance companies, the govt, etc have until then to figure better methods.
- john_b 12y ago
  There are plenty of better ways already. A simple public/private keypair would go a long way towards this goal. The problem is that everyone working on crypto products focuses on just developing technology, often attempting to make existing crypto systems easier to use for ordinary people. This is fine, but it's only a partial solution. We need to educate people who don't know and don't care about proper security. Nobody is going to use the most secure and easy to use crypto system if they don't see the benefit and think that a SSN or a driver's license is a good way to show their identity. There is a lot of hand wringing about how hard it is to get ordinary people to take security seriously, but honestly this is a problem that will solve itself given enough time and enough breaches such as this. Until people understand that only secret information--which they and only they know--can be used to authenticate them and protect their information, this will just keep happening.
- exelius 12y ago
  SSNs are already public information. There are numerous legal ways online to enter a person's name and 1 or 2 past addresses and get their SSN back. Their main purpose is to serve as a primary key - many people have the same name, but SSN is unique. It should never be used for establishing identity - it's about as effective as asking someone for their middle name.
- kanzure 12y ago
  > We really do need to find a better way of authenticating and identifying people What about not doing that at all? Hear me out. Not relying on "identity" would cost many orders of magnitude less. And besides, why should I care who you are-- what does your identity matter to me? And why should anyone else care?
jeletonskelly 12y ago
Maybe we should get a public/private key pair at birth instead.
nradov 12y ago
If you live in California, you have the right to put a security freeze on your child's credit file. This will prevent one of the most serious types of identity theft with a stolen SSN. Other states might have similar laws. http://oag.ca.gov/idtheft/facts/freeze-your-credit http://oag.ca.gov/idtheft/facts/freeze-your-credit
- zrail 12y ago
  I'd just like to point out that you can put a freeze on your and your children's credit files in any state. In most states it will cost in the neighborhood of $10 for each of the three bureaus, unless you're already the documented victim of identity theft (ask me how I know this).
- chandraonline 12y ago
  It is not possible to put a freeze on a child's SSN until they have a credit file. So unless they have been a victim of an identity theft or have a credit file (because they have a credit card from their parent for eg) this won't work. The only thing to do for parents with minor children is to monitor their SSN for activity.
exelius 12y ago
SSN is not some secret number - they're actually public information and can be obtained through legal channels with minimal effort. SSN is simply used as a "primary key" to differentiate one John Smith from another; it's not a private passcode or anything (even though many places treat it as one). The main benefit of an SSN is that it's a unique identifier of a person, but it's not sufficient for establishing identity and should not be used for that purpose.
- windexh8er 12y ago
  But it is private and it does unlock keys to lines of credit. It is not simply a "primary key" as stated, whether or not that was the original intent is not the argument here however. Recall the LifeLock CEO* plastered his SSN publicly and felt the repercussions. While I won't suggest you do that here - just knowing that if you did the assumption is bad things will happen in due time. Keeping SSNs private today is a risk organizations have to deal with and it does impact people, sometimes to an extensive length. Also, for clarification, the breach involved all of the information required to establish identity - which was my main point in the protection and monitoring of the SSN, with special regard to children/minors. * http://www.wired.com/2010/05/lifelock-identity-theft/ http://www.wired.com/2010/05/lifelock-identity-theft/
  - exelius 12y ago
    I heard about that, but when you publicly tell a bunch of hackers "come at me bro", you have to expect that kind of reaction. But realistically, the cat is out of the bag with regards to SSNs. Legally you can obtain someone's SSN for very little money. If you go the illegal route, I'd be willing to bet that there is black-market identity data on over half of Americans. We really need to treat SSNs as about as secret as your e-mail address, because for all intents and purposes they are already. I wouldn't be surprised if online ad networks were using your SSN as a primary key in the background - the information is so easy to get and it would solve a lot of problems. I guess I'm saying that sticking your head in the sand and pretending that SSNs are secure won't make them any more so. I'd doubt that a whole lot of SSNs were gathered in this hack that weren't already effectively disseminated widely in black market circles or marketing databases already.

babyjake 12y ago

Thanks for the advice. Can you give some specific steps on how to "monitor your child's SSN for activity"? How would I go about doing this?

at-fates-hands 12y ago
Start with Trans Union, they have a child specific application so you can find out if your child's SSN has been used by identity thieves: http://www.transunion.com/corporate/personal/fraudIdentityTheft/fraudPrevention/childIdTheft.page http://www.transunion.com/corporate/personal/fraudIdentityTh... If they don't have any reports, there's a good chance you're probably ok. You can also apply to put a security freeze on your child's SSN. State by state laws and application process here: http://consumersunion.org/research/security-freeze/ http://consumersunion.org/research/security-freeze/ And then there's the myriad of companies who can give you protection for a monthly fee: AllClearID: https://www.allclearid.com/ https://www.allclearid.com/ LifeLock Junior: http://www.safety4yourkids.com http://www.safety4yourkids.com Also, Experian has a monitoring service as well specifically for kids: http://www.familysecure.com/ http://www.familysecure.com/ Hope this helps.
- BrokenEnso 12y ago
  Just filled out the Trans Union site with dummy data to check, and none of the transaction is over SSL. So, to kind out if my child's identity has been stolen I have to expose them to identity theft....
  - webXL 12y ago
    That shocked me as well. Doesn't exactly give you a warm fuzzy feeling about a major credit reporting agency's security measures. Do some of these companies just view these breaches/vulnerabilities as a joke?
  - nkozyra 12y ago
    Wow. That is incredibly hilarious and sad. I passed the note on to TU.

sprkyco 12y ago

Had never really thought of that angle. Being a father it does shake me up a bit more than usual as it seems my peers and I are quite used to these headlines being the norm. Imagining a future in which you have already been "doxed" prior to elementary school is a bit disturbing.

k2enemy 12y ago

We really do need to find a better way of authenticating and identifying people. SSNs were never meant for this and they clearly don't fill the role successfully. I've long been a proponent of the government announcing that they will publish everyone's SSN 2 years from now. Banks, insurance companies, the govt, etc have until then to figure better methods.

john_b 12y ago
There are plenty of better ways already. A simple public/private keypair would go a long way towards this goal. The problem is that everyone working on crypto products focuses on just developing technology, often attempting to make existing crypto systems easier to use for ordinary people. This is fine, but it's only a partial solution. We need to educate people who don't know and don't care about proper security. Nobody is going to use the most secure and easy to use crypto system if they don't see the benefit and think that a SSN or a driver's license is a good way to show their identity. There is a lot of hand wringing about how hard it is to get ordinary people to take security seriously, but honestly this is a problem that will solve itself given enough time and enough breaches such as this. Until people understand that only secret information--which they and only they know--can be used to authenticate them and protect their information, this will just keep happening.
exelius 12y ago
SSNs are already public information. There are numerous legal ways online to enter a person's name and 1 or 2 past addresses and get their SSN back. Their main purpose is to serve as a primary key - many people have the same name, but SSN is unique. It should never be used for establishing identity - it's about as effective as asking someone for their middle name.
kanzure 12y ago
> We really do need to find a better way of authenticating and identifying people What about not doing that at all? Hear me out. Not relying on "identity" would cost many orders of magnitude less. And besides, why should I care who you are-- what does your identity matter to me? And why should anyone else care?

jeletonskelly 12y ago

Maybe we should get a public/private key pair at birth instead.

nradov 12y ago

If you live in California, you have the right to put a security freeze on your child's credit file. This will prevent one of the most serious types of identity theft with a stolen SSN. Other states might have similar laws. http://oag.ca.gov/idtheft/facts/freeze-your-credit http://oag.ca.gov/idtheft/facts/freeze-your-credit

zrail 12y ago
I'd just like to point out that you can put a freeze on your and your children's credit files in any state. In most states it will cost in the neighborhood of $10 for each of the three bureaus, unless you're already the documented victim of identity theft (ask me how I know this).
chandraonline 12y ago
It is not possible to put a freeze on a child's SSN until they have a credit file. So unless they have been a victim of an identity theft or have a credit file (because they have a credit card from their parent for eg) this won't work. The only thing to do for parents with minor children is to monitor their SSN for activity.

exelius 12y ago

SSN is not some secret number - they're actually public information and can be obtained through legal channels with minimal effort. SSN is simply used as a "primary key" to differentiate one John Smith from another; it's not a private passcode or anything (even though many places treat it as one). The main benefit of an SSN is that it's a unique identifier of a person, but it's not sufficient for establishing identity and should not be used for that purpose.

windexh8er 12y ago
But it is private and it does unlock keys to lines of credit. It is not simply a "primary key" as stated, whether or not that was the original intent is not the argument here however. Recall the LifeLock CEO* plastered his SSN publicly and felt the repercussions. While I won't suggest you do that here - just knowing that if you did the assumption is bad things will happen in due time. Keeping SSNs private today is a risk organizations have to deal with and it does impact people, sometimes to an extensive length. Also, for clarification, the breach involved all of the information required to establish identity - which was my main point in the protection and monitoring of the SSN, with special regard to children/minors. * http://www.wired.com/2010/05/lifelock-identity-theft/ http://www.wired.com/2010/05/lifelock-identity-theft/
- exelius 12y ago
  I heard about that, but when you publicly tell a bunch of hackers "come at me bro", you have to expect that kind of reaction. But realistically, the cat is out of the bag with regards to SSNs. Legally you can obtain someone's SSN for very little money. If you go the illegal route, I'd be willing to bet that there is black-market identity data on over half of Americans. We really need to treat SSNs as about as secret as your e-mail address, because for all intents and purposes they are already. I wouldn't be surprised if online ad networks were using your SSN as a primary key in the background - the information is so easy to get and it would solve a lot of problems. I guess I'm saying that sticking your head in the sand and pretending that SSNs are secure won't make them any more so. I'd doubt that a whole lot of SSNs were gathered in this hack that weren't already effectively disseminated widely in black market circles or marketing databases already.