Hacker News Reader

Comment by wtvanhest | Hacker News Reader

IMO, everyone's SSN should be public. Mine has already be compromised by both my undergrad and grad school. At this point, I operate under the assumption that it is public knowledge for bad actors.

Hiding SSNs is false security at best. If they were public, banks would stop hiding behind "identity theft" and would start having to acknowledge that its their responsibility to confirm who they are lending money to.

View on HN

The problem with identity in the USA has always been a religious problem more than anything else.

All legislation aimed around allowing people to be identified by numbers has been killed due to the whole "mark of the beast" .. "can't buy sell or trade without your number" revelations rhetoric.

As religion has less of an impact on people's daily lives, I expect this to change, but in the past it's been the one thing that's always prevented proper identity management in the USA.

I am curious to know though, if there are other countries that don't identify their citizens with a public id number?

If its primarily a religious problem why do countries less religious than the US have similar concepts? SINs in Canada, NINs in the UK, etc. etc

NIN is rarely used in the UK. You need one for student financing... and later for your employer to correctly relay your taxes to HMRC. Certainly it's not needed for banks/credit cards/phones/brokerages/etc.

The last time I opened a bank account in the UK involved me sitting in a bank employee's office with two forms of proof of identity and proof of income. I could have used my birth certificate for one but AFAIK the second would cost money.

ID number in South Africa. Assigned at birth, used for opening of any account. Not considered private at all, can be requested by any company who might want to check that you are you. Also: ID card with number, photo and details on it, separate from drivers license.

More or less the same in Sweden.

The parent means implementing national IDs provokes religious opposition in the US.

Religious concerns were only a minor factor. Other objections to having a national identifier include: wasteful "big government" spending, encroachment on states' rights, potential for civil liberties abuses, and lack of consensus over whether it's a real problem that needs to be solved.

I don't necessarily agree with those objections but there have been multiple reasons.

>"All legislation aimed around allowing people to be identified by numbers has been killed due to the whole "mark of the beast" .. "can't buy sell or trade without your number" revelations rhetoric."

This is easy to solve; simply make it illegal to use the identification number so capriciously. Define a narrow use-case for it, narrow enough to allay religious fears, and forbid anything other use if the ID number. Make it illegal to require customers to provide their ID number while making purchases, etc.

But once you do that, most of the desire to implement the system starts to disappear...

> This is easy to solve; simply make it illegal to use the identification number so capriciously.

Hmmmmm, that sounds familiar... https://en.wikipedia.org/wiki/Social_Security_number#/media/...

While it wasn't law, I don't see why legislature wouldn't renege on their promise to not use a unique identifier, already conveniently assigned to all people, for identification purposes.

Yes that's what I had in mind. It worked that time too, the general public accepted SSNs.

Maybe it's cynical, but I don't believe there is any limit on how many times you can lie to the public. There's only a limit to the frequency.

> a unique identifier, already conveniently assigned to all people, for identification purposes

One problem is that it's not unique. :)

Australia doesn't have a national ID number, and neither does New Zealand.

You have a TFN [1] (tax file number) in Australia, which are similar to an SSN, except somewhat more limited. My TFN is only used for income tax, not for identification, and I'm not actually legally required to supply it to anybody, even my employer (although it does make paying taxes a real pain as they withhold the maximum amount). You aren't even legally required to have a TFN, although once you get one you have it for life, and without one you pay the maximum income tax.

TFNs are specifically forbidden to be used for anything other than income or benefit purposes too. Businesses aren't allowed to ask for it as a form of ID.

[1] https://en.wikipedia.org/wiki/Tax_file_number

I'm not a Christian, but those concerns are not without merit. It's a slippery slope to "the only way we can eliminate identity theft is to use biometric authentication via implanted chips to validate financial transactions"

And yet many services rely on SSN for identity verification in the US (e.g. banks, telecoms, etc.)

You mean they rely solely on someone dictating a SSN number? That's insane. They should ask for a official ID with photo, as the very minimum.

Is that something that goes against the American culture? The other day I had to give all 10 fingerprints to renew my driver's license (location: South America) and nobody seemed to care.

That'll be leaked eventually, too.

That's a fact of life. I'm talking about how they are determining identity. Just asking for a SSN number is mostly like dealing with anonymous people (thus my question about culture).

America historically was not very federalized, and being able to just abandon your life and move out west is a key part of the country's mythology, if not the DNA of the country. So there have always been attempts to resist a national ID system, and the SSN was originally not supposed to be used for this purpose.

Of course in 2019 this is basically a moot point if you want to be integrated into society, but even then there are people who are legitimately not integrated into the modern US economy by choice.

I have thought about this a little bit. If this is something Americans believe in, its time to make it official. Make a legal proceeding where you can "start again", so that nobody from your old life can trace you.

Formalizing the process kind of misses the point.

From what I can tell you can go to California and say you are an immigrant and get an ID under any arbitrary name. It seems you can do anything with this so it's essentially a new identity.

https://www.nerdwallet.com/blog/banking/undocumented-immigra...

SSN is often used as an account verification, which is a problem because social engineers can get your SSN pretty easily.

It's hard for a phone bank operator to ask for a photo ID.

I used to give out fake SSNs to everyone that insisted on one (normally I just leave that part of a form blank). The first time someone asked for the last four digits of one of my fakes I had to scramble to remember what random number I had given out. I never considered that might actually be better security.

Downside of this solution is that many companies ask for it so they can do a credit check. Giving them a fake number could technically be fraud.

We don't require a full set of fingerprints to renew your driver's license, but we do require proof of citizenship and residence. As a practical matter, for most people that means birth certificate and a utility bill with their address on it.

I assume the fingerprints thing is for future crime solving?

A giant database of fingerprints is more likely to "solve" crimes than solve them. This statistical mistake even has a name: "the prosecutor's fallacy". (It could be that police detectives deserve to name this trope more than prosecutors do, but it's probably too late now.)

there are places here that will let you vote for the president of the united states without requiring proof that you are a US citizen. what do you expect.

That really isn't a big deal since you need to prove residence to register. There are a limited number of votes that can be made. If two people show up saying they are the same person, that will create a red flag.

> Is that something that goes against the American culture?

Conservative Christian fundamentalist groups have, ever since Reagan, likened a national ID card to "the mark of the beast", citing Revelation 13's prophecy that no one could buy or sell goods without the number of the beast, and the reference to God's chosen people that refuse the mark of the Beast.

When a small but meaningful fraction of your constituents fervently believe that giving them a national ID literally damns them to Hell, it's a hard sell.

Much easier if you attach it to a tool (Social Security) with which they can get money.

There's also the angle of State's Rights and whether the federal government can require people to have national ID over just amalgamating the various state IDs.

Finally, Americans generally distrust their government. Not without reason, they believe a national ID would reduce their privacy and allow the government to more easily spy on and track them.

Then again, you could be like my uncle. His SSN is 666-66-6666. He's not particularly religious...

There’s a chance your uncle made that one up himself: “No SSNs with an area number of 666 have been or will be assigned.”[0]

[0] https://www.ssa.gov/policy/docs/ssb/v69n2/v69n2p55.html

There's a chance I made up that uncle myself... it's easier than using Google to find this information.

And some places "rely" on knowing a full name or just a phone number.

We would call that an error on their part, and I don't see why the same logic doesn't apply here.

It’s risk management. Some products just have greater risk associated with them.

that is what wtvanhest is talking about. If everyone has your social, its no longer considered a secret (like a password) its more like a unique identifier (an email address) just like it was intended to be.

When you think about it that way & then combine it with some type of 2FA, it starts to make a lot of sense.

That's how it works in Sweden.

> its more like a unique identifier

AFAIK they are not ever unique

Article written in 2014:

> To date, 450+ million SSNs have been issued, but with just under 1 billion possible number combinations, there has never been a need to recycle numbers, and the SSA notes that it does "not reassign a Social Security number (SSN) after the number holder's death."

https://gizmodo.com/what-happens-to-your-social-security-num...

They're not reliably unique: a nontrivial percentage of the population has multiple numbers associated with them, and a nontrivial percentage of the numbers are associated with multiple people.

If you have two systems and you want to correlate data between them, you can use something like the SSN to assist in that process, but usually it will need additional information.

Generally you can't use something someone supplies as a shared identifier. You can't start the process of verifying it, after all, without an identifier. You might think of all sorts of ways around this, but they all boil down to either tolerating errors or making the SSN a secondary attribute rather than a bona fide identifier.

> In the peak year of 1943, 5,755 people were using Hilda's number.

https://www.ssa.gov/history/ssn/misused.html

There are actually lots of dummy SSNs that are used by a lot of people (including illegal workers).

Best Buy credit. I never have my card on me, but I can use my credit account with my Soc.

But they are not really secret just like your email isnt. Its using it as if it is thats the problem imo

Not saving my SSN along with my transaction is different than my SSN being "public".

Why don't they just assign a new one from time to time? It's just a number after all, much easier to change than fingerprints.

The whole point is that it's not supposed to change, unlike your name, address, gender, occupation, and everything else.

Which makes it all the more ridiculous that as an immutable identifier, it's also supposed to be a secret.

It is supposed to change. The Social Security Administration explicitly allows people to obtain new SSNs in limited circumstances.

supposed !== possible

This is actually a great idea, as long as the government makes clear the plan to do this, and gives banks et al time to adjust.

Reply on news.ycombinator.com