Replacing Social Security Numbers Is Harder Than You Think | Hacker News Reader

Replacing Social Security Numbers Is Harder Than You Think

motherboard.vice.com

42 pointssohkamyung50 comments

> The problem underlying identity theft is not the existence of social security numbers, but rather, how little authentication is done for a person requesting credit.

> Why don't they do [stronger authentication] for credit card requests? At a guess, it's because these stronger schemes are too inconvenient, and will drive away consumers who are trying to apply for credit.

> If that guess is correct, it suggests that the real solution is regulatory: make credit providers liable for the full damages, including ongoing inconvenience, suffered by victims of identity theft. SSNs are not the problem; authentication commensurate with the risk to all parties, including especially individuals, is.

Doesn't sound that hard to me...

This is Vice, everything is hard for them. Hey cover interesting stories with glorious incompetence, the Dunning-Kruger daily...

Curious, but did you see who was the author of the piece?

One could argue that neither the reputation of Vice nor the reputation of the author has anything to do with the quality of the article. You're both appealing to authority (or non-authority for the GP).

True. But the author's reputation in the security area makes me more inclined to listen to what he has to say.

An article with the same title, but written by, say, a marketing specialist would probably get a more sceptical reading.

It's worth nothing that Appeal to Authority is a logical fallacy only when the authority is not an authority on the facts relevant to the argument.

Deferring to a subject matter expert is logical.

There’s something to be said, especially when this site is so full of subject matter experts (although I am not one), for the notion that a discussion of somebody’s authority without including a discussion of the subject at hand is by definition, an appeal.

I did, but I also saw this:

They could also do things like send paper mail to the last long-term address, to confirm it. Why don't they do that for credit card requests? At a guess, it's because these stronger schemes are too inconvenient, and will drive away consumers who are trying to apply for credit. If that guess is correct, it suggests that the real solution is regulatory: make credit providers liable for the full damages, including ongoing inconvenience, suffered by victims of identity theft. SSNs are not the problem; authentication commensurate with the risk to all parties, including especially individuals, is.

That’s a loooooot of guesses for my taste.

I want to clarify that it doesn’t sound like a hard technical problem. Bending the will of our politicians is much harder than it should be, unless you have a lot of money.

What kind of money are we talking?

According to OpenSecrets[0] (MPAA PAC), it’s $100k - $200k, or about $1k - $5k per politician. That’s actually a lot less than I expected

[0]: https://www.opensecrets.org/pacs/lookup2.php?strID=C00139519

This latest article about Detroit developers seems to support that [0]. A meager $300K dished out to politicians opened up the possibility of $700M-$1B plus the developers of these buildings can collect income tax from businesses and folks who occupy them for the next 20 years.

What's the now?!

[0] https://www.metrotimes.com/detroit/how-dan-gilbert-just-scor...

It's a bit more subtle than that, in the same way that the cost of an ad is larger than the cost to place that ad somewhere. But on steroids.

If you just show up and dump $300k on some politicians laps, the effect isn't likely to be particularly overwhelming. You need to cultivate relationships, wait for a good moment (when the money is disproportionately valuable to said politician), at least sell the perception that you're able and willing to dish up more in the future, etc.

So the actual cost is a lot higher than the amount the politician actually receives.

I feel we need to stop complaining and begin playing this game as the others do. A community such as HN alone could raise this much in a matter of minutes.

My take on it that I've expressed for years: "I'm not surprised that politicians are whores. I'm horrified that they're CHEAP whores."

Keep in mind the credit reporting agencies are well known to give white glove treatment to senior politicians, their families, and even their friends. Thus no one who matters has to deal with the shit you or I have to deal with if our credit is stolen.

The equivalent of a social security number is used here in Norway (fødselsnummer) as my ID for all sorts of things. I use it when I log in to my bank, when I apply for a loan or credit card, when log in to the state run tax web site, when I apply for my pension, if I am admitted to hospital I will have a bracelet with my full name,and this number both as plain text and as a bar code.

It's hardly a secret yet identity theft is not a major problem here.

Exactly same situation in Finland. Yet in Finland there has been discussion about replacing it. But the current system isn't perfect. Address space is limited, as well as the current system indicates your gender, which gender neutral people don't like too much.

In Finland we do have check code. Valid check byte is '0123456789ABCDEFHJKLMNPRSTUVWXY'. Format is DDMMYY then separator (if CC==19 then - elif + CC==20 then +)NNNC where NNN is sequence number and C is check byte. NNN contains also sex in format of parity, and even sequence numbers are used for females. -> Creates a limit of 500 identities / day / sex. Full example: 0123456-7890

As stated, this can be a problem at times: "The couple said that the Finnish health care professionals have had no problem with them except that the administrative systems do not recognise a situation where a pregnant person has the male social security number."

It is used as the "username" for all those things, not as the "password". That's the major difference.

To login to secure services like all government services, our banks, our digital post box etc we mostly use BankID.

With BankID you enter your SSN, your personal password and a code from your 2FA key fob/phone app. https://www.bankid.no/en/

So what's stopping anyone from downloading the phone app and getting your BankID and 2FA code? Is there a verification process to be able to use the app?

Ah sorry, "phone app" was slightly misleading. It's a special kind of phone app that's saved on the SIM card.

https://en.wikipedia.org/wiki/SIM_Application_Toolkit

There is a verification process: Only institutions capable of doing proper KYC can hand out BankIDs.

For those, like me, who don't know what KYC is: https://en.wikipedia.org/wiki/Know_your_customer.

I wonder if I or, more likely, someone else could write a GreaseMonkey script that would turn all these obscure abbreviations into explanatory tooltips.

They would also need your personal password. And the first time you use it you will need the one time pad your bank has provided you with.

More examples of other countries (and their solutions, not particulrly hard) in this thread:

https://news.ycombinator.com/item?id=15210634

The "secrecy" of the SSN is seemingly an US only problem, that all the rest of the word has already solved, one way or the other, so, no it it is not "harder than you think", it is "not hard at all" ...

Banks and other issuers of credit just need to have high penalties for libeling people when then give false information to credit bureaus. $5,000 for a wrongly reported debt might make the banks more cautious about libeling people when fraudsters steal money from them by impersonating someone else.

If I was a bank opposed to this plan here is how I would kill it. I'd say (well, I'd pay people with bullhorns and signs to say) the new requirements for 'wrongly reported debt' require banks to have greater ID requirements, greater ID requirements have been linked to less minority representation thus that plan is a racist plot.

It would be dead in the water before you could draft the bill.

Seems to me like SSN is missing an open free (as in paid for by taxes) 2FA service.

When I obtain a drivers license or passport (or some other process to confirm my identity at a government facility) that I should be able specify my 2FA medium (email address or phone number [text or call]).

Any organization that wants to prevent identity theft should be able to do a 2FA challenge. As an individual I would receive a phone call or text or email "Acme Co. is processing a request to open up a new line of credit under your SSN. Did you initiate this action?"

There should then be regulatory requirements on banks, insurance, etc that require 2FA confirmations before associating an SSN to your account.

Somebody should warn all the countries that don't have them or an equivalent

Ten years ago, maybe. Today though, most people have devices that are both portable and computationally powerful. This has the potential to finally make secure keys that are actually convenient to use.

How do you authenticate yourself when you need to rekey the app?

I wonder if public-key crypto enabled ID-cards for example would be a good idea to solve this problem.

So... national ids? Not a politically popular option.

Aren’t we treating SSN cards like national IDs already? What make national ids not popular politically?

It'd be really hard to change SSNs as database keys. But we could stop using knowledge of SSNs as authorization. Make a public database, put all the SSNs on it, and associate each with a public key.

It's only hard because PHBs (and Vice reporters, apparently) are willfully ignorant of public key cryptography.

If you are referring to this article, do note that it wasn't written by a Vice reporter.

Heh, good point. That makes it even more baffling. A CS professor should know better.

The author acknowledged the existence of cryptographic solutions, but points out that what they lack is the ability to be memorized.

Anything that can be memorized can be trivially compromised. There's nothing special about an SSN in this regard. It's the protocol that's broken. To prove you know the secret you have to reveal the secret. PKE is the only solution to this problem that works remotely.

I have two 2 questions when it comes to the usage of public key cryptography:

1. Who will be the CA and RA?

2. How do you prove your identity to RA?

The institutions that want to verify your identity should be their own CAs.

If I were implementing a replacement for SSNs, I'd send out certs rendered as QR codes by physical mail. That's not perfect, but it's at least as secure as the current practice of sending out UIDs by physical mail. At least the is the possibility of getting the key safely inside a secure device and destroying the original. With the current protocol, in which the only way to prove you know a secret is to reveal the secret, it's completely hopeless.

I am not a PKI expert, so I may be missing something, but isn’t this chicken and egg problem?

For someone to issue you a certificate, you have to prove your identity to them. How would you do that?

There are two inherent problems with SSNs:

1) No check digits--every number is valid. Adding a couple of extra digits would help tremendously

2) No ability to retire/change the number--this is the big one. Once the criminals get your SSN--game over. You can't change it and shut the old one down. If you simply changed this, a lot of the issues with SSNs would go away.

Then there are the usage issues:

SSNs have two tasks which need to be separated:

1) Identification for "blocking" or "association" tasks. SSNs are fine for identity on a blocking task--ie. trying to shut something down, taxation identification, etc.

2) Identification for "allowing" tasks. SSNs are BAD for allowing tasks--new credit card, new bank account, etc. These kinds of tasks should always require SSN plus something else. This is where the primary failure modes are.

> No ability to retire/change the number

You can change your SSN in certain situations [1].

[1] https://faq.ssa.gov/link/portal/34011/34019/article/3789/can...

In reality, it rarely happens. The government makes the process so onerous that you have to be suffering horribly before they will even deign to think about it.

Well, even that has its problems. Consider the case of Rachel Yould [1], who obtained a second SSN with her married name claiming abuse and stalking from her father. She was convicted of falsely using the second SSN and name as an originator and cosigner for hundreds of thousands of dollars in student loans in both her married and maiden names under false pretenses.

[1] https://www.newyorker.com/magazine/2010/10/04/the-scholar-je...

That's a rather special case; the nature of the HALE program means that you can't allow someone to ask "do SSNs X and Y belong to the same natural person?". Whereas such a question would be entirely reasonable for the SS issuing authority to answer under more normal circumstances.

(as for whether this case was actually a case of fraud, well, "the heart of Yould’s defense was that she thought she was allowed, under the hale program, to use the new Social Security number to apply for the loans above the lifetime cap and to use one name as a co-signer for loans to the other" pretty much sums it up for me... who would think that?!)

Check digits are not an isssue because it’s too easy to gain access to real numbers in the first place.

We don’t have a problem with people providing technically invalid (I.e. never issued) social security numbers, only reusing ones that aren’t theirs.

Reply on news.ycombinator.com