Hacker News Reader

Comment by arbuge | Hacker News Reader

> Social Security numbers are the keys to the kingdom. In this country, people get a unique number when they’re born, and the Social Security Administration tells them it’s secret and valuable. Then we use that number to pay taxes, to get government benefits, to apply to college, to get a mortgage, to apply for a car loan, to open a bank account, to track our credit. We’re asked to hand over this number again and again to institutions that have failed to guard it.

This is the problem right here.

To that sorry list, I would add medical providers' offices (doctors and dentists), all of which seem to request social security numbers for some reason on their patient intake forms, when all they should need is the patients' insurance information as printed on their insurance card.

View on HN

Regarding all the Social Security number issues, it somehow reminds me the Onion title "‘No Way To Prevent This,’ Says Only Nation Where This Regularly Happens" (I know USA is not literally the only one, but almost) - plenty of places have something similar to that number, but USA is pretty much unique is treating simply knowing it as some kind of identity proof. "Something you (and a bunch of others) know" doesn't cut it.

Indeed, here in the UK we have the very similar "National Insurance Number" for tax reasons but it's never used for identification as it's assumed to be public knowledge.

There are multiple meanings of the word identification.

SSN and NIN could reasonably be used for identification of the form of "this person's data is different from that person's data". (identification as in primary/unique key)

They can't/shouldn't be used for authentication that this person is who they claim to be. (identification as in password)

You're absolutely right.

SSN's were only ever meant to be used for identification (as in a username). In the beginning the worst that could happen is that someone else would file their payroll taxes with your SSN, and make you eligible for more Social Security benefits when you retired. It was never meant to be a password.

How would you receive benefits if not by using SSN as a password? Or to get a job when you may not have authorization to do so (noncitizen not on a worker visa)

You use the SSN (acting as the username [which links to authority to work or claim benefits]) combined with another piece of information that establishes your identity (acting as the password to establish that it's really you and not me who is applying).

For employment, the I-9 form is what we fill out as authorized US workers and to document same.

https://www.uscis.gov/i-9 (the "paper version" link works best)

You'll note that Social Security card is in List C "documents that establish employment authorization" and not in List B "documents that establish identity" nor in List A "documents that establish both identity and employment authorization"

I guess you can look at it as a form of off-line multi-factor authentication. You are using the Social Security card as proof of eligibility for the person whose identity you have already established using another factor. In that case, it's the card that acts as the factor, not the number (which if you've ever seen a social security card, it's ridiculous to think that it's in any way secure or even durable).

> They can't/shouldn't be used for authentication that this person is who they claim to be.

100% agreed, perhaps I should have worded my comment better. My point was that this seems to be common practice in the US but not over here.

In Germany we too have a SSN. Only my employers know it, it can be changed. I've never ever had anyone but the tax office or my employer ask for it.

Just being able to change it would be a huge improvement.

> In Germany we too have a SSN.

Well, TIL. I guess no one ever asked me for it.

It's rare, your employer can just ask your pension insurance to get it, some do this automatically, others ask specifically.

It's pretty much the same in Canada. I never seen it used for anything outside of the tax context.

This is because it's illegal to require a Canadian to provide their SIN, unless the use is on the list of exceptions [1].

One can still ask a Canadian for their SIN for reasons not on that list, but it is illegal to refuse service for not providing a SIN [2].

[1] https://www.canada.ca/en/employment-social-development/servi...

[2] https://www.canada.ca/en/employment-social-development/progr...

The German SSN is also trivial to query (if you don't have it at hand your employer can just phone the pension insurance) and is somewhat predictable. It's also only used for tax/pension purposes; if you steal mine you can basically only gift me money.

The closer equivalent in Germany is probably the Personalausweisnummer (ID card number). Basically everyone has an ID card, and sometimes the number of the ID card is used as age verification or is written down as part of identity verification at a bank or similar. Assuming you verified that the ID card is genuine it's a good unique identifier that survives name changes; however its usefulness doesn't come from secrecy but the forgery-proof piece of plastic it's printed on. Also you can change it at any time within a few weeks by just getting a new ID card, and it naturally expires every ten years or so.

I think a fundamental problem in the US is the requirement to verify identity via phone. In Germany that's just assumed to be impossible without a prearranged passphrase; when opening a bank account you verify identity by showing ID at the bank or a postal station or by waving your ID in front of a webcam during a live call.

How do securely obtain access to a remote system that wants you legal identity? Or do German companies allow access to any bot willing to pay?

Modern passports have an online functionality, you can unlock that plus hardware for fairly cheap (<50€ IIRC), which lets you use your passport to authenticate and you can, similar to credit cards, have the passport reported as stolen so it no longer works.

I can't think of a use case where this happens here?

- If you want to pay bills you just do a bank transfer (they are free and fast within the EU), transferring the money to a published bank account with my invoice id or similar in the subject. If somebody else wants to pay my invoice neither I nor the company will have any objections, so no need for authentication.

- If I want to check a bank account or a credit account or something similar I have a password that was set up when the account was created

- If I want to set up an account I can authenticate either via webcam (showing off the security features of my ID card) or via PostIdent (where I have to go to a post office)

- When talking on the phone you have an authentication problem (unless a "phone passphrase" is prearranged, but for anything with lasting consequences you usually have to send them a written version per email or snail mail for papertrail reasons anyways, or alternatively they send you a confirmation per snail mail that you can object to in a reasonable time frame.

The new ID card has online features that in theory solve the problem completely for online systems, but few places implement that so far.

I expect that in Germany it would also be harder to convince a bank to lend you money based on nothing but the tax number and a forged drivers license.

On a fundamental level, it's absurd to use the same datum as a unique identifier and an identity proof. The best analogy I can think of is signing up for websites with only a password, and then having to provide that password as an identifier any time you need support.

Oh, and the password is almost impossible to change, and you're required to use it to sign in on a host of other sites.

I recently redeemed my Amtrak points for a free ticket and then needed to change the ticket which required a phone call. The gentleman on the phone asked me for my “points PIN” that was apparently required to change any Amtrak points reservations. I had never needed to change any points reservations before so I didn’t have one.

Amtrak’s solution? I could set a PIN, right then and there, verbally with the agent over the phone. No logging into my account. No email or text message confirmation. They didn’t even ask to confirm my DoB or address. Nothing. I had only given him my reservation number.

And not 30 seconds after creating my new PIN the same agent was then able to “verify” my identity/account by asking me... for my PIN.

Based Amtrak.

ridiculous

Krebs wrote about this sort of problem with airline boarding passes back in 2015.

https://krebsonsecurity.com/2015/10/whats-in-a-boarding-pass...

Internet Archive copy of the IATA publication on boarding pass barcodes referenced in the Krebs piece.

https://web.archive.org/web/20120324074139/https://www.iata....

Though that also sort of illustrates some of tradeoffs involved.

Historically, something like that might well have been handled by snail-mailing a default pin to the address on record for the account and telling you to call back after you received it.

Of course, the problem is that a lot of people these days would think that was really poor customer service.

You can do the same thing to steal anyone's Delta Inflight wifi account to use wifi credit they've paid for and not used on a flight, just by knowing their email address.

Having only a password is just fine for many sites. The real problem comes up when you have to show it as an identifier to a third party. If you don't ever need to do that, all you need is a password, not a username. (Auditability of login information within a company notwithstanding -- isn't really something a user can try to enforce, and it can happen in a variety of ways. As a user, at the end of the day, you trust the company with your credentials, and assume they secure internal access in some fashion.)

Imagine all you have is a password, and I come along to register, attempting to set my password to "hunter2". Turns out someone else has already used this. Do you allow me to continue or tell me the password is already in use? If its in use - great, I'll just log in using that other guys account!

Of course, you could let the site specify the password, which would work if they're long and random. But social security numbers are neither of those.

Nobody said they should let you choose your own passwords. We were comparing with SSNs, which are assigned to you, not chosen by you. You'd do the same with such passwords. And nobody claimed SSNs are appropriate passwords either.

>And nobody claimed SSNs are appropriate passwords either.

Except for the US government, and most banks, medical providers, and cell phone companies.

This is a good point - not all services need both identification and authentication.

I've noticed some sites using identification only (like the days of IRC), so you can have a consistent identifier to interact with people but a username isn't actually secure or owned. The converse should also be possible, in the same sense that a bank PIN is used to authenticate with no public identifier involved.

That said, for many offerings we should consider "a company employee" to be a third party. There are already employees with access to my data, but the outsourced call center employee who answers the customer service number probably isn't one of them, and I want them to be able to look up my account details without being able to impersonate me.

Because of the Swedish constitution, everyone in Sweden's name, address, birth date and, yes, personal identity number is completely public information. Thus the systems and processes in Sweden have necessarily developed around a threat model of a potential attacker knowing all these details.

The solutions Sweden has to proving identity despite this are not exactly radical: photo ID documents, and secure ID apps (encrypted certificates) on phones or smartcards.

Don't forget a DVD rental card at Blockbuster. Yep, they used to ask for it just to become a member but you could of course not fill it in and they would still accept your membership.

I still remember them asking me for mine. Pure jokes.

Here's an article from almost 15 years ago where one of the Blockbuster locations dumped a bunch of customer forms in the street where most forms had people's SSNs on it: http://legalshred.com/east-side-new-york-blockbuster-dumps-c...

> The trash pile included recent membership applications, each revealing the customer’s birth date, address, phone number, driver’s license number and signature.

More alarming, each application also contained a credit card number and expiration date, and many included a Social Security number.

Talk about a violation of privacy and leaking sensitive information. This is why you can't trust big companies with anything sensitive.

What is Blockbuster?

A chain of video rental stores in the US

edit: US and elsewhere

https://en.wikipedia.org/wiki/Blockbuster_LLC

A now-defunct chain of video rental stores.

Old timers told me when Social Security was first started, the American people were promised that the number would never ever be used for anything but Social Security.

It's interesting, in Canada and probably other countries, the corresponding ID code cannot be used as primary key, like for employment records. And somehow their societies function.

In fact, in Canada you only have to give out your SIN when it is required by law, and you should never give it out otherwise: https://www.canada.ca/en/employment-social-development/servi...

Unfortunately, one of those lawful uses is to give one's SIN to banks who provide accounts that pay interest. That said, I don't think it's enough to impersonate someone.

Yep, but the US never developed any alternative form of universal identification so people gravitated towards the SSN for that purpose, even though it was explicitly not to be used for that.

What other options are there? Most other potential identifiers are full of pitfalls like input error, collisions, having things change, or simply being unknown by the citizen. Even something as simple as name, birthdate, and place of birth is chock full of problems. People transcribe records wrong, or were born out of the country in a place with no recordkeeping that no longer exists to parents who have since died.

SSNs are far less complex and error prone. Their only major downside is that they only work for people who have them, which means your app can only service legal citizen Americans.

Canada doesn't have a universal ID. Companies have to figure out a way to keep track of employees without using the Social number, for example.

Keeping track of employees isn't an issue. Everybody has some number they use or are small enough not to have run into issues with just using a name.

It's when you're talking about something that sticks with a person for their entire life. A prime example is credit scores. That's something that stays with you no matter how many times you change jobs, change names, change addresses, get married, etc... Federal taxes are another area where it's important to match the name with the correct record every single time.

It's coming. After October 1, 2020, a "Real ID" will be required for US domestic airline flights.

Glory to Artstozka! Cause no trouble.

Tip: I leave the social security number blank for medical providers, and have never been asked for it verbally except once. I told them I don't feel comfortable with it, and the person said that was fine and moved on.

An innocuous "I don't remember it" also works with the rare paperwork handler who insists on filling it out.

Or just a random string of digits if they won’t take no for an answer. Many ways to skin this cat.

Knowingly writing gibberish could get you in trouble for lying on an insurance related form.

Better to blame a “senior moment”.

If you're giving your SSN to your doctor you're doing it wrong. Just leave the field blank. End of story. You don't need to give them your SSN and the practice has been largely phased out due to HIPAA.

I don't have a SSN (I'm not an American citizen), but I've spent quite a bit of time in the US. I had a bank account, drivers license, registered a car in my name, etc. etc.

What stops you from just refusing to give out your SSN, or simply saying you don't have one (even if you do?)

Obviously getting a credit card might be annoying, but to get around that I just put down a $500 "bond" and got a Credit Card with a $500 limit (so the bank was guaranteed not to lose it's money).

Can you not just refuse to give out your SSN and still get on with life in America? (I get on OK without one)

> Can you not just refuse to give out your SSN and still get on with life in America? (I get on OK without one)

That's really strange, is it because you're not employed in the US?

I am not a US citizen but I have a US SSN because I lived there on a work visa (multiple times). Employers have always asked for my SSN to check my work authorization through e-Verify. Every time.

Right, I'm just a tourist (6 months at a time though, which gets me a drivers license, etc)

In other countries with ID numbers like this, I wonder how much of a difference is made by requiring that institutions be liable for fraud, rather than shielded from such fraud, forcing them to use more secure methods of verifying identity/possession by default.

Example is chip+pin, which is widespread in Europe but not really available in the US. Chip+nothing (which is still better than a 16-digit number) is become more commonplace as the liability protections that the magnetic strip enjoyed are disappearing. People react in self-interest, and the fact that you become liable for fraud if you take the strip instead of the chip mean that there's a large incentive to move away from the magnetic strip.

I'm sure if you dig into it you'd see similar provisions that protect other organizations, either throw law, regulation, or just protection of "industry standard practices", from being held directly liable if they use the SSN for identity verification rather than insisting on a more reliable hard-to-exfiltrate identifier.

The difference is that they require other information. The Italian tax ID number is just an encoded version of data that's already in the form (name, gender, date and place of birth), but the form also requires an ID or driving license number and I have to hand a copy physically with a matching number and picture.

Out of curiosity, who, specifically, is "they" -- is it the government for government services/taxes, or is it private companies for identifying you for taxation or employment eligibility purposes, or by private organizations (banks, credit cards) as an attestation of identity?

I was mostly referring to banks, but it's also mostly true for government offices (tax offices, retirement agencies, voting stations, also the municipalities if you need some certificate etc.). Technically public officials can authenticate you without photo id, but it's most common to provide one especially outside small towns.

> To that sorry list, I would add medical providers' offices (doctors and dentists), all of which seem to request social security numbers for some reason on their patient intake forms, when all they should need is the patients' insurance information as printed on their insurance card.

Insurance information changes over time though so it's simpler to just request the government issued GUID and use that to make sure you're associating the patient files correctly.

I think the only real solution would be for smart cards to come back into vogue and assign everyone a unique key along with their SSN. Proofs of identity for things that matter ie loans and other financial work could then be secured without significantly interfering with it's use as a unique identifier in cases where it doesn't need to be secure. (As wrong as it is to use SSNs that way it's ingrained enough in interactions and systems that trying to cut that off would be a big pain.)

Someone, somewhere, in US government needs to push for the same system Estonia uses for their national ID card.

https://e-estonia.com/solutions/e-identity/id-card/

Yeah it's tricky because the US is a bit shy about national IDs for vague reasons that seem loosely associated with anti-authoritarian reasons and distrust of government. Sure we can't be forced to 'show us your papers' because they don't physically exist but the government knows who 99% of citizens are if they wanted to work at it even a bit and it's not like states are going to be the bastions of fighting back and they do have IDs pretty much everyone gets.

Indeed. No one cries foul on a passport or driver's license, but a national ID card is so draconian /s

Maybe if you converted passports to smartcards, and then slowly turned it into a national ID you could make this work.

There is a passport card with a chip, but it is only usable at land crossings. Ostensibly because the world has agreed on what a passport is.

> No one cries foul on a passport or driver's license, but a national ID card is so draconian

Fair point, but it's worth noting that lots of people don't have either document. Hence, say, the voter ID law fight: many people genuinely have no standard identity document except SSN.

One other aside is that driver's licenses are a remarkably bad identification document. Even plenty of bars won't take out of state driver's licenses, or will outright declare real ones to be fake. And dealing with government offices, I've had several iterations of "that state's license ID has a different number of digits, so I can't use it in our system".

Yes, I agree entirely. Which is why the cost must be driven down for obtaining a national ID card, and you should be able to obtain one as easily as going to to a DMV. Someone in this thread suggesting using the postal service for such a task, which I would be in favor of with adequate controls in place for safeguarding the PII of citizens.

> One other aside is that driver's licenses are a remarkably bad identification document.

This is changing with REAL ID; all states are either compliant with new ID issuance and doc standards or have received an extension. https://www.dhs.gov/real-id

Yeah the only way I'd ever say election ID laws were ok and no discriminatory attempts to shape the electorate would be if it were accompanied by a) a massive expensive push to ensure everyone had and ID (mobile DMVs going and registering people who can't get out to an office, free licenses, etc) and automatic voter registration (because if you're going to say everyone needs to have this to vote I damn well be able to vote with just the ID).

> plenty of bars won't take out of state driver's licenses, or will outright declare real ones to be fake

Italians that have an id card predating electronic id are routinely bumped off American bars because to them it looks like it's just a piece of paper with a photo stitched on top. Yet, identity theft is a problem in the US and not in Italy...

In fact, even though that id card actually is relatively easy to forget, it does have some watermarks and special government stamps. In fact, it's probably easier to fake an electronic id card with a piece of plastic, if you know no one is going to try using the smartcard functionality.

the US is a bit shy about national IDs for vague reasons that seem loosely associated with anti-authoritarian reasons and distrust of government.

It's called "history." And as they say, those who don't learn from it are doomed to repeat it.

States give access to their driver's license databases to federal authorities. Any safety you perceive due to the lack of a national ID system is an illusion.

Those who over-apply historical lessons in an incorrect context may serve as a future historical lesson in mistakes made, though.

But aren't social security numbers effectively being used as national IDs right now? The fact that that they suck just makes fraud easier.

I don't see how modern society can function without some form of universal authentication. Alternately, if you live in a forest and don't need or want to participate in the financial system, I'm all for making a hypothetical national ID opt-in.

SSNs aren't really an ID they're an ID number, without looking at other databases and traces left there's only really a name associated with each and no biometric data so there's no real way to confirm that the person you're looking at is actually the person assigned XXX-XX-XXXX.

Which is what makes it such a huge problem- they're treated as ID's whether they're supposed to or not. Regardless of original intent, regardless of what you or the government or anyone else says, they are treated as ID's by the vast majority of business and organizations. That's the whole point of this discussion and why it's such a problem.

There's really no evidence that the USG doesn't already have everything it needs to oppress $GROUP if it wants to.

No federal IDs did absolutely nothing to inhibit Japanese internment. The federal government has vast powers already.

A lot of opposition to national IDs is based in religion.

Funny thing is, in Canada, SSN analog is called SIN.

Social Insurance Number, for the curious.

I was unaware that King George III was such a proponent of national ID cards.

There is a significant percentage of the US population that believes any attempt at a new national ID is the mark of the beast from the biblical book of Revelations. I shit you not. These are the same people that would consider a war in the middle East to be a good thing, because it means Jesus is coming to usher in the millennial reign of heaven on Earth.

I’m quite certain the US government demands “show us your papers” of many individuals within 100 miles of the US border on a daily basis.

Only if you're an immigrant. If you're a US citizen, you don't need to provide any proof.

How do you prove you don't need to provide proof? Or do the police have to prove that you do?

Nope if they think you should have proof and you don't you can be detained and there's no strict limits on how long you can be detained it's essentially till they're satisfied you've proven your citizenship.

Constitutional rights are as it relates to the fourth amendment are a bit fuzzy within 100 miles of the US border. Even as a citizen, you'll need to provide proof or sit in lockup until CBP is satisfied you belong in the country. The ability to provide oral attestation of citizenship was deprecated by the justice department many years ago.

https://www.aclu.org/other/constitution-100-mile-border-zone

Well, actually you need to prove you are a citizen if you fit the profile of an immigrant within 100 miles of the border. And if you don't do so to their satisfaction the border patrol will detain you indefinitely. Yes, in America. https://www.dallasnews.com/news/immigration/2019/07/22/dalla...

If you state you are a US citizen, the onus is on them to prove you aren’t.

There is no law saying that Us citizens have to carry identification pricing they are citizens.

And yes, if they have reasonable suspicion that you’re lying, they can detain you.

I have thought for a long time now that the national postal system was particularly well suited to take up this task.

I'm Canadian though, so it's quite possible that this would be reasonable here and not in the U.S.

Is there any harm in choosing random number as your Social Security number? Since it is supposed to be secret how can anyone verify it? Apart from special situations like filling taxes where one would use the real SSN. I am not a US citizen and I have no idea what is the real life use of SSN.

Insurance companies may request it for verification of the identity of patient.

If you would provide the same, but still random, SSN to the insurance company and hospital, what that be a problem? How would they ever find out it is not your real SSN?

It really depends on how the SSN is used, but using a false SSN is considered fraud.

If the party requesting it is using it for billing and collections, and you fail to pay a bill and they send it to collections, and subsequently report the collection to a credit agency, then it is a clear case of fraud. If you randomly happen to pick a valid SSN, then you are committing identity theft in addition to fraud.

If they are just using it as a Unique ID, they may not ever know that it's fake. None-the-less it is still fraud.

First of all that would be insurance fraud, and it would be illegal.

Secondly, that wouldn't work, the insurance company already knows your SSN. If your insurance is provided through your employer your employer already gave it to your insurance company when they set up your benefits. You need to give your employer your real SSN to pay taxes. If your insurance is provided through the government (medicaid, medicare, tricare) then the government already knows your SSN. You BEST not be giving the government a fake SSN to collect benefits, that's all sorts of illegal.

Thanks for the info. It seems like plenty of organizations legally know the SSN. I am amazed that US government considers SSN to be private.

Is it fraud without the intent to defraud?

>Secondly, that wouldn't work, the insurance company already knows your SSN

It could totally work, it’s really easy to get a card open with another SSN and then accurint or whatever the insurance company uses will just return multiple SSNs.

Generally, knowingly and willfully giving false information to certain entities is fraud and is illegal. Especially when the form has you sign off that the information provided is correct to your knowledge under plenty of perjury.

Even if you gave a fake SSN to, say, a landlord (they need it to run a background and credit check on you and to better chase you down if you don't pay your rent) that would almost certainly be considered either fraud or theft by deception.

Generally, you provide the entity your SSN because they have a legitimate need to identity you, and that includes identifying you as you outside their internal system.

They aren't completely random, so you'd probably at least want to pick one from the expected prefixes list:

https://www.ssa.gov/employer/stateweb.htm

That leaves you with six digits to choose.

> We’re asked to hand over this number again and again to institutions that have failed to guard it.

You’re asked to hand over the number, but you don’t always have to provide it. Really only the government needs to identify you with this number, and only for purposes related to the social security system. You don’t have to give it to your doctor’s office or bank. Often, a simple “I’d prefer not to disclose this because of identity theft” is fine. They may press you for it, and most people are too timid to resist. If they are insistent I’ll just make up a random string of digits and that’s always been ok. All they are looking for is nine digits so the computer form they are filling out lets them move on to the next page.

Reply on news.ycombinator.com