Hacker News Reader

Comment by SoftTalker | Hacker News Reader

> SSNDOB listed the personal information for approximately 24 million individuals in the United States, including names, dates of birth, SSNs, and credit card numbers

Great, good to shut it down, but how long until its replacement springs up? It probably already has.

Instead of going through all this effort and expense to track the sellers of this information, it would be better to make "names, dates of birth, SSNs, and credit card numbers" valueless on their own. I'm not sure what the alternative looks like, but posession of this kind of personal information about someone should not be useful or valuable.

View on HN

Whatever tokens you use to identify someone will be a target for identity theft. You can make the tokens harder to guess or harder to replicate, but with an associated decreased accessibility. The convenient thing about names and DOBs is that most people have them, and most people remember them. The issue with most surrogate tokens is that a remediation process is necessary for when people lose or forget them, and those processes fall back on, you guessed it, name/DOB, etc.

Fraud is just a very difficult problem to solve.

No, it's not. Estonia solved it by issuing ID cards with a private key that signs for a public key identifier. [1] Then proving your identity requires the presence of the physical token rather than just the identifier. Unfortunately most Western nations are so embroiled in bureaucracy that this obvious solution will not be available for a long time.

[1] https://en.wikipedia.org/wiki/Estonian_identity_card

What do you do when you lose it though? Or it burns in a fire? A surrogate token still needs a replacement mechanism

It's pretty easy to implement that if you have a central authority to manage the public keys, which a government can do.

A bigger issue is how to handle it being stolen (if the "card" also needs something like a passphrase it can reduce this risk, but it's probably better to make it relatively easy to "cancel" if you lose yours, and then you have to head to the DMV or whatever to procure a replacement).

Certainly better than knowing 10 digits and where you were born and to whom.

"Better" depends on which specific problem that someone is experiencing.

If your problem is that someone stole the token, then you're better off with a PKI token.

If your problem is that you have lost your token, then you're better off with a non-PKI memorable token.

Go to a government office and use biometric identification methods, then remove the old public key from databases and replace it with a new public key from a newly issued ID card.

SSN already suffers from the same exact problem and has ways to request a new SSN card. You are limited to 3 replacement cards in a year and 10 during your lifetime.

That is mitigated by the fact that SSNs can often be used without the physical card.

Estonia was exactly what I had in mind when I wrote my comment. You can't just guess PKI keys, but they are less accessible. You need the physical card, you must have a process for issuing/reissuing, and the technology must be available to use it. There are trade-offs. They can be good trade offs, but they exist.

>you must have a process for issuing/reissuing

Can't you piggyback off of the processes for social security cards?

You can. But, if I lose my SSN card I can still (usually) use my SSN because it exists in a functional form inside of my head. If it was a PKI card, I would physically need to have the card.

I have family who tried to get a replacement SSN card during COVID and the process has been entirely impossible. This a drawback to using physical tokens.

Also, this doesn't eliminate identity theft, the point of issuing is the weak-point for fraud.

Ok, but I got a replacement card several years ago and it was really not too hard. Took a few minutes at the SSA office with my passport (advice is to get their obscenely early to avoid waiting), and then waiting for the mail. Took a while to get in the mail, but wasn't hard, just slow.

Normally, it shouldn't be. But, my family ran into issues such as:

1. The office was physically closed for business during COVID.

2. They needed to get documentation which was physically in another country.

3. They could not travel to that country due to travel restrictions.

Lost my card, can confirm it's entirely tedious to replace

In Mexico the SAT (IRS) adopted something similar: A PKI to identify taxpayers for which you have to sign electronic documents with your password-protected private key. So far it has worked quite well, and it is being used for things other than taxes.

I consider people in Mexico way less technically sophisticated than people in the US, and adoption has been going well. So I believe implementing something like that would be possible in the US as well.

The issuing/reissuing process has been solved and is working fine, reissuing can even be done online (key-pairs have a longevity limit).

You can't just transfer a process/technology that works in Estonia to a country like the U.S. which has 300x the population and decades of processes that are dependent on SSNs, many of which aren't controlled by the government.

Want to open a bank account? Need an SSN. Healthcare: SSN Employment: SSN

Want a STATE driver's license? Need some form of government ID, depending on the state. An SSN card is often an option.

My point is, to adopt a system like you suggest would require reforming ALL of these systems across public (federal, state and local) and private sectors.

It's not just bureaucracy. Doing this at scale across public/private domains is hard.

I do not see what is wrong with starting somewhere, that somewhere being what Estonia has already proven works.

> Want to open a bank account? Need an SSN. Healthcare: SSN Employment: SSN

You don't need a SSN to open a bank account. Health, I believe it depends on the provider, not sure.

I never miss a plug for the idea that the United States Postal Service should get into the PKI game and issue hardware tokens. They have immense infrastructure they could leverage to be a very effective trust provider.

They already serve in that capacity to some extent evidenced by the various government entities who accept an addressed piece of mail as proof of residency. I don't think there'd be enough bipartisan support to make it happen, but I think it'd work great.

Totally agree with you. I think they should get into simple banking too. Even just a no fee simple savings account with debit cards would do wonders for the unbanked.

There are so many things we could do though. At least make it so I can easily rotate my SSN if it gets leaked. Currently I'm stuck with a SSN that gets used for fraud every once in a while. While it can be changed, it isn't easy.

We should just expect financial institutions to stop using primary keys as secret keys. SSNs were never supposed to be secrets, they're supposed to be fixed identifiers.

It's not easy, but victims of identity theft can request a new SSN.

https://faq.ssa.gov/en-us/Topic/article/KA-02220

As a practical matter, the best approach for most consumers is to freeze all of your credit reports. That way if an identity thief gets your SSN, at least they can't apply for loans in your name.

Put it in a public phone directory and maybe SSN will finally not be used as some layer of security. Credit card numbers likewise.

It would certainly be a darkgrayhat move to do such a thing. It would be effective at deprecating SSNs as identifiers but would cause a lot of pain and suffering for a lot of people in the interim.

I don’t have much worry about the use of SSNs as an identifier; it’s the fact of knowing them being used as an authentication mechanism which continues to puzzle me.

Sorry, I misspoke, but yes deprecating them for authentication would be the goal.

Credit card numbers aren't supposed to be private, are they? We use them all the time to send money. It's the expiry date and the CVC that should be kept secret, but even then 3dsecure is a thing.

We give the cards to strangers in restaurants etc. The CVC or date should not be on the card really if it is some sort of safe guard.

The whole credit card setup is quite insane when you think about it.

The checking system is so much worse. The only parameters needed to make an ACH payment are a name, a routing number, and the account number -- all of which are printed on every check. There is very little fraud protection, and it is difficult for an account holder to dispute an incorrect or fraudulent transfer.

There is very little fraud protection, and it is difficult for an account holder to dispute an incorrect or fraudulent transfer.

I see a cause and effect here. Make it easier (by law) for the account holder to dispute a transfer, and I'm sure the banks will suddenly spend more effort on fraud prevention.

There is a whole layer of security and compliance around the handling of credit card numbers that anyone who processes them has to go through. They are not considered publish information.

SSNs are coincidentally almost the same number of digits as US phone numbers, so just make it so you can register your SSN as an alternate phone number for your cell phone.

You'd probably need a separate country code for it ...

Yup. This stuff is all so deeply compromised at this point it's almost surprising you can still sell it. I guess fraud is still rare enough that companies would rather ask for SSN and say "hey we tried" than actually bother to look deeper.

FULLZ (a text file containing this information) sell for about $.99 per file/person on darknet markets, mostly to build up the seller's reputation.

There are 20,000,000 from just this one source and sellers seemingly randomly chose them. Thats just a lot of people. The buyer can use the same social security number for a different purpose than the last buyer.

Like, maybe the prior buyer wanted to try something easy like opening a credit card. The compromised person has a low but improving chance of noticing and locking their credit report, making their social security number useless(-ish) for credit card applications. The next buyer though may have never considered that and might just open a bank account with an online bank. You wouldn't know if a bank account has been opened in your name. And the account itself doesn't have to be used for anything flag worthy or that could frame you (I wanted to say "anything criminal" but obviously some laws are being violated even if the funds are clean).

On darknet markets, many people chose to skip laundering money, and just open bank and brokerage accounts in any developed nation under anyone's name. They just trade stocks and accumulate dollars. Eventually, whenever they want, they will laundering to cash out completely. But people can fly under the radar for a very long time, staying liquid, and not really doing any kind of consumptive spending from those accounts.

So the same social security numbers can be used many times, and there are also too many social security numbers for the level of interest in this, for now.

Places that ask for your SSN are usually not doing so for auth, it's mostly as a taxpayer ID, or a unique identifier because names aren't unique. (banks, employers, etc)

For fraud prevention they typically do behavior analysis or use a composite of personal data. SSN + DOB + Name + last address you lived at + etc.

"Don't hold criminals accountable because there will always be more criminals"

This is an unnecessarily reductionist interpretation.

“Don’t clean and bandage the gaping wound because it’ll just keep bleeding”

The point isn’t to stop going after criminals, the point is that just going after criminals is as pointless in the long run as just dressing a wound that actually requires a different solution - stitches.

Given limited resources, addressing the root of the problem would be more valuable than continuing to go after the symptoms.

Since I doubt the same agency would be part of a real solution, it probably becomes a conversation about where funding is directed.

I agree with the core of your argument but I think it's more complicated. If SS weren't important criminals would move onto something else. If you stop going after criminals would there be more or less SS theft?

If the solution is to phase out whatever criminals are using against people then you'll just be on a different path that never ends.

I think this is fair. The ideal path is probably not just one or the other, but a combination of both.

The problem is that a SSN was designed to be secret, and then everyone decided to use them as a UUID for people, which are generally not secret.

The solution is to split them. Give everyone some kind of citizen ID number that isn't private, but is unique. Then give everyone some kind of auth mechanism that identifies a person when combined with their ID number.

What we currently do is using SSN as the identifier, with DOB as the auth mechanism. That's terrible because the SSN is supposed to be secret, and DOB is basically public knowledge at this point.

They also can't be easily re-issued, which is it's own problem.

There are obvious and substantial differences between SSN and some of the newer cryptography-based ID cards other countries are using.

It's the other way around. SSNs were designed to be UUIDs, and everyone decided to use them as a secret.

> At its inception, the SSN's only purpose was to uniquely identify U.S. workers

> The card was never intended to serve as a personal identification document—that is, it does not establish that the person presenting the card is actually the person whose name and SSN appear on the card.

https://www.ssa.gov/policy/docs/ssb/v69n2/v69n2p55.html

You're right that it wasn't intended that way, but it's incredibly incompetent of them to think it would work that way. They discarded the idea of using names/addresses to identify people because it was unmanageable, so how did they propose people authenticate to these systems if it wasn't via SSN?

I.e. if your SSN is a UUID, then what's the password to authenticate into these systems? Your name? That's even less secret than your SSN. Your address?

Historically and today, if you want to update the address your checks get sent to, you can send them a letter with your name, SSN, old address and new address. One of those obviously has to be a secret, or anyone can reroute your SSA checks wherever they want. Which one of those is meant to be a secret? Names and addresses are void due to phone books, which only leaves the SSN.

That means the SSA is using SSNs as a personal identification document, regardless of whether they claim it was designed that way or not.

Identity theft can be solved by going more hands-on. Make KYC really mean KYC.

If you couldn't get a line of credit without an in-person appearance and fingerprint, that form of identity theft becomes unviable. You have detailed info as to who tried to commit fraud, that can immediately be used for prosecution or tracking repeat offenders.

Reply on news.ycombinator.com