Hacker News Reader

Comment by mikeash | Hacker News Reader

If we're lucky, this will be the best leak of personal info ever.

The primacy of the SSN in American society is idiotic. It's a "secret" that you have to hand out to dozens of different organizations. I've long thought that we should phase this out by committing to publish all SSNs (and the associated info, obviously, so it's not just a list of most 9-digit numbers...) which would force all these companies to stop treating it as confidential.

The system is dumb and works poorly, but worked will enough that there was no impetus to fix it. Some people got affected by breaches, and it sucked for them, but it was always a small enough group that most people didn't care.

Now that a majority of people's "secret" info is no longer confidential, maybe they'll realize they can't rely on it anymore.

OK, the odds of this actually coming to pass are not great. But I can hope.

View on HN

For anyone who wants an explanation at just how bad the social security number really is, this is the most enjoyable explanation for it I've seen, by CGP Grey

https://www.youtube.com/watch?v=Erp8IAUouus

Wow. Having an ID card seems so normal to me that I would never have thought that the US didn't have any. I've been to the US before and never even noticed. Thanks for the link.

There's a substantial faction of the American right wing which is vehemently opposed to any sort of national ID scheme. They don't want the government having a big database of all citizens. Strangely, these tend to be the same people who want to require photo ID to vote.

I hate to play the recently poisoned "both sides" argument, but it really is weirdly widely unpopular. The ACLU in particular is strongly opposed to a national ID system.

I say this as someone who would strongly support a federal mandatory national ID system (and the ACLU, generally)

In this particular case, I think the "both sides" argument may well have merit. Thanks for pointing that out. I really should just say a big chunk of Americans.

There's a substantial faction of the American right wing which is vehemently opposed to any sort of national ID scheme.

Oh, I doubt it's a left-right thing. I'm pretty lefty these days, and I oppose a national ID. Some minority groups, like say Jewish folks, might carry bad connotations about putting everybody in a big database so we can keep track of (and categorize) them.

I believe the majority of these people would be against the Federal government requiring such an ID. They are likely fine with their local government, that they have more control over, handling such IDs which would be required for voting.

But, of course, there's not much preventing the local government from sharing the info with the Feds.

No, some of us would love for the government to have one in an ideal world, we just recognize that the US government that exists today is not competent enough to be trusted to run such a database. Just think about the topic we're discussing - do you really trust the US Department of Identity to not have breaches like this every year? The only difference is that we'd never hear about them.

Is there any reason the data in a national database would have to be confidential in the first place?

One can dream that the state governments would be competent enough though. I feel like it wouldn't be that hard to make driver's licenses / state identification cards mandatory at the state level (fewer people to piss off).

This is not a right wing issue, it's an authoritarian vs libertarian issue. Plenty of people on every side don't trust the government and don't want to give it more power.

To be fair, I've traveled many places that require national ID cards, and yet never carried my passport on my person, in violation of local laws. And I've never had an issue.

It's something so unlikely to come up in day-to-day interactions that it's not really that important. I'm sure if I got stopped in, say, France, and had no passport to show, they wouldn't exactly lock me up on the spot, they'd find a way to accommodate me.

I still only have a really vague understanding of what happens if a cop in the US wants me to identify myself and I refuse. If I'm not suspected of a crime, obviously, I can just walk away. I'm not really sure what I'd do if I was arrested for cause and refused to identify myself.

This is an excellent video. Thanks for sharing it. Are there any other videos by this guy that you recommend? I like his style quite a bit.

Others have already chimed in here, but I honestly can't remember a CGP Grey video that I wasn't thoroughly entertained by, even when I already knew all of the facts presented.

For amusement's sake, I really enjoy his videos on geography, such as (his first video ever) this one on the UK (which I guess might need updating soon?):

https://youtu.be/rNu8XDBSn10

or this one on Scotland:

https://youtu.be/p3HnMLq8m9U

or my favorite geographical video, on the Vatican:

https://youtu.be/OPHRIjI3hXs

That said, they're all pretty great, so I'd just start with this list of all his videos in ascending order:

https://www.youtube.com/watch?v=rNu8XDBSn10&index=1&list=PLq...

There are a lot. I thought this one was really funny [0]. This one I found very interesting [1].

Somewhat different, is the Hello Internet [2] podcast, which is by Grey and Brady Haran who you might know from the Numberphile youtube channel [3]. It's basically the 2 of them chatting about random stuff, but I find it very entertaining.

[0] https://www.youtube.com/watch?v=LO1mTELoj6o

[1] https://www.youtube.com/watch?v=LrObZ_HZZUc

[2] http://www.hellointernet.fm/

[3] https://www.youtube.com/watch?v=w-I6XTVZXww

Humans Need not Apply. https://www.youtube.com/watch?v=7Pq-S557XQU

All of them.

Back when I started college, my SSN was my student ID number. It felt weird, of course. I think there was a change in the law soon after I started college, because it did soon get changed into a different number of the same length.

Later on, I did a brief stint working for the federal gov't. In that setting, they used the SSN as our employee IDs. It was on all the personnel forms, and often seen on "list of people in the department" spreadsheets. Of course in order to comply with some law, these forms would also have a footnote explaining why they needed the SSN.

From these experiences, I have a very hard time actually thinking of the SSN as the sort of "secure password" everyone else wants to insist that it is. Unfortunately, I'm not aware of an alternative.

An alternative? You mean user-created passwords?

Pretty much why I'm not freaking out, yet.

If my SSN & other personal details get out, it's my problem. If the SSN & personal details of half the country leak out, it's somebody else's problem.

Whose I'm not sure, but it would seem like banks. At this point, virtually all potential credit applicant's details have been leaked, and I believe it's the banks that ultimately lose when they issue credit to a fraud. So if you're the bank, hopefully right about now you're starting to think you need a much better method to authenticate credit applicants.

Banks never lose. They just create a fee to pass it on, throw a party and hand out bonuses.

But... in this case, the overall cost may be high enough that there's a competitive advantage in not needing to charge this particular fee, and that will force the industry to do something about it. Maybe.

Banks are already charging all the fees they think they can while still remaining competitive. If they could have already charged another fee they would have.

> The primacy of the SSN in American society is idiotic. It's a "secret" that you have to hand out to dozens of different organizations

I'm not from the US. The first time i had an american friend explain me the SSN thing, I thought they were crazy, for the exact same reasons.

It is idiotic, as you say.

Here in my third-world country there isn't any number or code that I need to keep secret and I need to hand over to other companies at the same time.

If you don't mind me asking, because I'm genuinely curious how it works in other countries. Does your country have an equivalent of a 'credit score' like in the US, which would be used by financial institutions when they judge whether or not they can loan you money? If so, how is this score calculated, how does it aggregate all your financial information without a specific identifier, and how do you secure yourself from identity fraud/theft without having a 'secret' number to id yourself?

>If you don't mind me asking(...)how is this score calculated, how does it aggregate all your financial information without a specific identifier

We do have an specific identifier. Each person has an ID card, with an ID number. The ID number is not secret at all and used for many things everywhere. By the way, we don't have anything like a "social security card". Even kids have this ID card, their parents can (and ought to) request one for each kid.

This ID number has nothing in common with your birthday or anything. It is mostly a sequential number.

All aggregations are done using this (unique) ID number. So financial companies submit payment data associated to your ID number. So later credit scores can be computed as well.

The difference with this ID number versus the SSN is that our ID number is not used as a password of any sort.

How do companies or government institutions check out if you are who you say you are? They can take a look at your ID card. And usually they do have fingerprint scanners and signature scanners to check against the government's central ID registry.

By the way, last year we issued the Electronic Id Card, this one has a security certificate (public-private key cryptography) associated with it, and each person chooses (and keeps secret) a password. This password never needs to be revealed to anyone. With this password one can do digital signatures of any document, etc.

> By the way, we don't have anything like a "social security card". Even kids have this ID card, their parents can (and ought to) request one for each kid.

Nowadays SSNs are generally issued at birth, particularly since the IRS wants one for each dependent listed on the tax return. I believe this has been the case for at least twenty or thirty years; certainly my card dates from when I was born.

> This ID number has nothing in common with your birthday or anything. It is mostly a sequential number.

If it's a sequential number requested near birth that would mean that most people with the same birthday have similar numbers, doesn't it?

> If it's a sequential number requested near birth that would mean that most people with the same birthday have similar numbers, doesn't it?

In practice it is not requested near birth. It is sequential to the time you asked for an ID card, so people who asked for one in the same timeframe get a close number

It probably varies by country, but here you have a unique personal ID-number. First number denotes your sex, next six numbers contain your birtday, and the next four numbers are assigned (probably? not certain) in order of births during that day. Last number acts as checksum, allowing immediate check for typos.

That ID number is public and allows government & any companies/organisations you show it to immediately verify that they are dealing with a specific person, instead of having to spend time figuring out which specific person named "John Smith" they are dealing with. Having this number simply makes life more quicker and convinient. It also allows to remove any pointless duplications for cards.

For some examples: separate medical insurance card was discontinued, you can verify medical coverage by a simple number query. Same with drivers licences, they still exist in a separate physical forms for foreign trips, but but not inside the country. There is no separate libary cards, I don´t have to carry a separate card for my gym or various retailers.

I can verify myself online quickly and securely. I can digitally sign documents and contracts and email them. Honestly, I´m having hard time imagining my life without it. I´m aware that all proposals for national identification methods in the US have failed thanks to fears of "mark of the beast" and big brother, but it seems pretty silly to me. All that data already exists and can be cross referenced. Making average person waste more time and money by having such massive inefficiencies in the system seems rather silly in these times.

This ID seems just as insecure as a SSN.

"This ID seems just as insecure as a SSN"

There is a big difference: that ID is being used as a username whereas our SSNs are (usually) used as passwords.

Oh, that makes sense. What do you guys use for passwords?

SHA and PIN.

For online verification(banking, contracts, taxes, voting etc) you need both physical card and PIN at the same time.

Otherwise it works just as any other normal ID.

A personal primary key that's semipublic, and when you do a financial transaction the institution performs know-your-customer identification checks - checking photo ID (with key printed), that sort of thing.

Some even have federated systems where you can later ask the financial institution to hand out a 2FA crypto token that you can use to identify yourself to other institutions over the Internet without ever showing up in person.

Moreover, there is no actual need for credit reporting agencies to have SSNs. They don't need to report payments to the government for tax collection. SSNs didn't prevent credit reporting agencies from commingling my father's credit data with mine.

if they switch to an Equifax ID, then you'll have to submit an Equifax ID when applying for a loan and a fraudster could do the same they do today.

If you switch to dozens up separate IDs, the entire system will get bogged down as everyone forgets all their ID #s

I think the bigger point is that companies like Equifax shouldn't be using ID numbers at all in the way that they rely on them. They use SSNs as a database ID crutch to keep from having to do the actual leg work of talking to people, verifying/reverifying the accuracy their data, and basically doing the job people pay them to do.

Others on this thread have suggested that storing information that can cause me to incur a liability should require insurance against such a damage. I'm confident that with the right incentives in place, commerce will proceed without getting bogged down.

Agree. The best thing that can happen here is the entire 149 million gets published online somewhere - that will force change. Overnight, companies will have to stop assuming SSN is secret.

At this point I think it's rather safe to assume no SSN is secret.

I agree - but this is going to get forgotten about in a month, Equifax's stock price will be back where it was in 6 months (or less) and everything will continue as before

Yeah, I won't be holding my breath.

He's right though, even if not feasible to implement. A SSN is an ID number that needs to be kept secret. How dumb is that?

How about using something like an ID card with attached chip that can be used to digitally sign things? Works great in Belgium.

There are millions of Americans who genuinely believe a national ID program is "the mark of the beast" and will hasten the arrival of the Biblical End Times: https://encrypted.google.com/search?hl=en&q=real%20id%20mark...

Americans have an distinctive hate for ID cards.

Actually, we have lots of ID cards. There's just a distrust of one card for everything controlled by the Federal government. Which is inevitable.

But they sure love their identity theft! ;)

I get it, most people aren't always rational about these things.

There is no political will to do such a thing. Even the REAL ID stuff with licenses is pretty weak and taking an eternity to implement.

He's right though, with any luck, the SSNs of a slew of politicians will be included in the data leak and then we may just get the ball rolling on change. Hopefully, this is the one that gets us moving.

I mean, the OPM breach didn't.

If they do something like that in between elections, conservatives will flip.

The sentiment goes something like this:

- Conservatives gave up on minorities, historically stated that the less they vote, the better - Conservatives push the narrative that voting fraud is a big problem, and that the liberals are doing it (many high profile member's of Trump's family/cabinet are registered to vote in many states simultaneously)

- They push for Voter ID laws and push back against weekend voting days, as it makes it harder for hourly/poor/minority voters to show up and vote.

So it would probably be a great idea, but since conservatives consider non-white franchising is an existential threat to their cause, they'll probably scream "state's rights" and block it from happening.

I advocate something similar regarding all secrets (passwords, private keys, credit card numbers, etc).

Secrecy (and privacy) aren't sustainable, and relying on them will just end up hurting people.

Identity must be solved, not through secrecy, but through transparency.

If AI overcomes us, it will be (in part) because we failed to adapt to this reality.

I'm sorry that you are getting downvoted for simply expressing an unpopular opinion, but you may be interested in this: https://www.theatlantic.com/politics/archive/2014/08/this-ma...

How could we go about not having private passwords or credit card numbers?

You authenticate with physical states with enough entropy generation rate, e.g. physical tokens. All security is physical security.

You first.

Are you being sarcastic?

No. I'm completely serious.

Reply on news.ycombinator.com