Yes, as well as utilities, banks, insurers, hospitals, etc, etc. Treating the SSN as a password is idiotic, to the point where I almost wish Anonymous or someone would publish every American's number so that we'd be forced to stop doing it.
Yes, as well as utilities, banks, insurers, hospitals, etc, etc. Treating the SSN as a password is idiotic, to the point where I almost wish Anonymous or someone would publish every American's number so that we'd be forced to stop doing it.
http://www.sciencemag.org/news/2009/07/social-security-numbe...
The actual situation is quite a bit less dire than your quote.
What that linked article says is that for people born AFTER 1989, the first five digits could be guessed with 44% accuracy. (There's a very real sense that the "last 4 of your social" are less guessable than the first five, so it's no surprise that the last 4 is what is often used/misused.)
If you have those last 4 digits, and you can guess the first 5 digits with nearly 50% accuracy, then you have a very good chance on getting legitimate SSN's for mass numbers of people with a DB dump.
for($i = 0; $i < 1000000000; $i++) {
print str_pad($i, 9, '0', STR_PAD_LEFT) . "\n";
}
There you go! Guaranteed to contain every American's SSN.