Hacker News Reader

Comment by WorldMaker | Hacker News Reader

I've gotten into so many arguments about how the first five digits of an SSN for nearly everyone born before 2011 (!), when they switched to a more pseudo-random algorithm, is reverse engineer-able and thus you should never, ever show the last four digits as that really is the only "secret" part of an SSN. This argument is a "fun" circular argument that typically goes "Well, but if we only show the first five, many families can't tell which social is whose because they all look so similar..." "Yes, because it was an algorithm! We should use something other than SSN to identify different people." "But how will people know which SSN their account is connected to?" "Why is their SSN connected to the account at all?" "So they can identify their account!" /facepalm

View on HN

I find it amusing that many places that will require "Strong" passwords with numbers, letters, and symbols, will use 9 digits as if it is secure, many even using just the last four!

This. There's nothing like setting up a rigid password policy to give the appearance of security, then providing a secondary super weak password like ssn or easy to figure out security questions. For many sites its purely about appearance with little real thought given to protecting users.

Personally I take the opposite approach, why not connect SSN numbers to everything?

As you mention, it's easily determinable, and it has the fortune of being an existing ID number system already connected to everyone.

Allowing everyone the ability to tell people apart based on a number is infinitely better than matching names.

In my country we use our ID numbers for everything, dentist appointments, vehicle inspections.. if you call any business at all it will likely be one of the first things you're asked for.

The number should be an identifier for a person, not a security measure. If you just accepted the fact that SSNs are insecure and that by knowing someone's SSN does not necessarily mean you are that person, then the US could use them more effectively, cut down on a significant number of errors in every industry, and actually reduce identity theft.

SSNs were never really intended for that purpose and there are a number of problems with using SSNs for that (SSNs have been and will be reused, for instance).

I can see a point in having an identification system that spans the country and is easy to use, but SSNs are not (and should not be) it. It's also something unlikely to properly happen in the US due to the state/federal powers separation. (Which is why we have the kludge of so many businesses using SSN for the purpose in the first place...)

But if you were born before 1998 (1999?), it's not necessarily easily reverse engineer-able. You need to know where someone lived when they first got a job. I've gotten into many arguments that given the first five digits of my SSN, someone can tell me where I was born.

Prior to the IRS requiring a SSN for claiming dependents, many people did not get a SSN until they started working; parents did not apply for them at birth. Most of the people I went to high school with, got them in high school.

Reply on news.ycombinator.com