Hacker News Reader

Comment by leephillips | Hacker News Reader

The damage from incidents such as this would be at least somewhat limited if organizations did not collect SS numbers when they have no legal purpose for doing so, and if people did not automatically comply when asked to supply these numbers. Whenever I go to the doctor and am asked to fill out the usual form while waiting the usual 90 minutes past my scheduled appointment time, I leave the ubiquitous space for my SS number blank. They are not paying me a salary, so have no legitimate need for this number. I know why they want it, and that purpose does not benefit me. Not once has this led to a problem: they know that there is no legal basis for demanding the number, but ask for it anyway, as they have nothing to lose by doing so.

View on HN

I said this just a couple of days ago re: a data breach:

The US needs to just scorch the earth re: social security numbers. Set a date when all liability for fraud enabled by improper use of SSN's for "authentication" is the responsibility of the party misusing SSNs and publish the entire list.

The list has, arguably, already been published (thanks, Equifax!). We just need to close the loop.

Unlikely to unfold that way (we are 20 years into the RealID standard recommendation and it has been delayed again).

As I’ve mentioned elsewhere, SSN is not the only fact used for authentication. We need to move away from all pure fact-knowledge proofs of ID and to MfA preferably with one factor based on a government issued ID and asymmetric encryption.

I agree that it's unlikely unless there's massive public outcry, and even then I don't see it happening. The status quo is too entrenched and until elected leaders feel the pain from their constituents nothing is going to change.

I concentrated on SSN because it's the government-issued fact-based "authentication" factor. The other fact-based factors are just as bad.

I wish we could have a government-sponsored PKI but between concerns from citizens about "freedom" (either freedom for business to "innovate" in the space, or freedom from individuals to be "tracked" by the government) and from surveillance advocates who will want to include key escrow/recovery provision I don't see it flying.

In some other comments on this post I mentioned the USPS would be a great "trust" provider. They already serve in that capacity to some extent evidenced by the various government entities who accept an addressed piece of mail as proof of residency. I don't think there'd be enough bipartisan support to make it happen, but I think it'd work great.

While I agree that the world would be a better place if people refused giving as much information as possible, the specific fix here is to not consider social security numbers private information in the first place - they're clearly identifiers, not shared secrets. There is nothing about them that verifies anything - it's basically the database-friendly version of your name.

But yes, this could have all been headed off if the social security act had prohibited private organizations from requesting, using, or storing these identifiers in the first place, for anything but immediately passing them on to tax authorities. A Customer ID is good enough for all non-credit uses, and credit should require actual in-person verification to issue. But this is the general shape of totalitarianism in the US. The government mandates the barest minimum of systems, companies lobby against any restrictions that would prevent their abusing it, and we end up with a legally-mandated freedom-destroying system invading most aspects of our lives.

PS I've got to wonder about a blockchain solution for keeping a public catalog of leaked PII that gets abused for verification. Make the "exploit" plain as day and companies will have to change. Right now the carding community keep this to themselves, and out of sight is out of mind for the companies that continue to abuse it.

Schools are required by law to file 1098-T tuition statements with the IRS for almost all students.

That requires collecting social security numbers.

As a recent expat to the US, I don't actually know, why DOES the medical office want my SSN?

So they can take you to small claims/civil court if you or your insurance doesn't pay up.

And it helps in collection efforts in general. There is no benefit to you in divulging it, only potential harm. So don’t do it.

Often this is how they verify you are insured.

They have no problem verifying my insurance without a SS #.

Depends on the insurer, probably. That's how my dental is verified since my dental insurance doesn't bother sending out a card...

For medical insurance it’s usually only needed if they you don’t have your member ID number or just recently enrolled. More common for vision or dental insurance to use SSN though.

I think some just want a stable unique identifier to prevent duplicate accounts. Many use Name + Date of Birth, but that's not always unique.

Give the wrong ssn on every form you possibly can. Many databases are filled with fake ssns, nobody cares or checks. A lot of Americans don’t even have one.

>A lot of Americans don’t even have one.

Citation?

Mostly immigrants who haven’t become citizens yet. But there are others.

Consider that the IRS provides an ITIN number for tax filing purposes to anyone who doesn't have a SSN. Millions of undocumented immigrants pay their taxes and operate in society without a SSN.

Undocumented immigrants definitionally are not Americans.

And I'm not sure that ~3% counts as “lots” in any event. Also, that 3% includes people who may have overstayed a work authorization (although that's probably a small enough fraction of the total to ignore).

Some Americans, mostly older women, don't know their SSN because they never used it. Their husbands handled taxes, opened bank accounts, and collected Social Security. If you've ever dealt with medical data, SSN is not a reliably unique identifier. Couples will share a number because each gives the "relevant" number instead of their own.

Universities do a lot of financial interactions with students, including credit checks, housing, financial aid, and very high levels of payments. They also often employ students. They also need to be able to track your records through name changes. They need your SSN.

Not disagreeing with you points. My issue is, when I went to school, they wanted you to put your SS on your papers and tests as that is really what they used as your student id.

A law was passed about 15 years ago that prohibited using SSNs as student IDs.

Now I feel ancient. If you ran our highschool ID cards through a magstripe reader it would display your SSN.

There was a huge problem a few friends and I caused our first year there when we got bored in the computer lab. Every student account on a school computer had a folder named PUBLIC. Out of curiosity we dug down a few folders and found the txt file that was referenced by the simple visual basic program the IT guy wrote for class scheduling. That program used your name and SSN as login credentials. So there was a txt file that was simply a list of everyone's name and SSN for it to reference.

We being the idiots we are copied the file because it was a public folder anyone could access. The only reason we didn't get expelled was because one of the kids had a lawyer father who threatened to go public about them being that irresponsible with our data.

When I was in college SSNs were still used as our ID numbers. Every dept had folders in the hall outside the office for each student. They'd put grades out in those folders. Guess what was printed on those grades.

If you had a mag stripe writer you could grab a random person's grades, encode their SSN on a student ID, and then use the card to buy stuff on campus.

They need your SS# if they are paying you and need to withhold taxes. They don't need to do a credit check unless you are borrowing from them, which is unusual. For financial aid, if they want to verify your income, they can request that you have the IRS send them a transcript, which they will receive directly from the IRS with SS # redacted. The “need to be able to track your records through name changes” does not mean that they need your SS #. “They need your SSN”: Usually they do not, but US citizens have been trained to believe that they do.

EDIT: It’s been a long time since I was in school, and, frankly, I was expecting someone with fresher knowledge to come up with a counter-example. So, see the comment above about an IRS form 1098-T.

>They need your SS# if they are paying you and need to withhold taxes.

They also need it for the 1098-T (Tuition Statement). That's not to say they couldn't design better systems and not use SSN as an identifier, but there is a legitimate need for it.

LOL not that long ago (late 90s early 00s in my case), student ID number WAS your SSN... [facepalm]

Anecdote: I've been told previously that my state kept vaccine records in a shared database indexed by SSN--as a way of easing loss of medical records when patience switched providers.

It's possible they were doing something similar.

I've also had to give my SSN to verify my identity to my insurance carrier at my dentist.

SSN is the de facto userID for lots of government systems.

It’s sad for lots of reasons, but understandable considering that it is useful. for whatever reason there isn’t much political will to make an honest effort at a federal government ID (even though we de facto have multiple)

Reply on news.ycombinator.com