Hacker News Reader

Comment by michpoch | Hacker News Reader

What's the issue with SSN being an ID?

It was creating for the purpose of tracking an individual's account by the Social Security Administration. It later became a de facto identifier and, even worse, is many times abused as a form of authentication, but it was never designed to be either.

As a result, we have processes that ask for or require a social security number that aren't even related to the purpose for which it was created: Health care, loans, debt collection.

Notably, some citizens of certain religious sects, like the Amish, do not have social security numbers.

It still sounds like a good way to uniquely identify a person? How else would an institution confirm that it's talking about the same person?

It is used that way in Finland and a fair few other countries and works perfectly well.

The same way they do for people who aren’t from the US?

Some combination of name, address, birthdate, etc.

But the problem isn’t using the SSN as a semi-unique ID. It’s using it for that and also assuming it’s secret. SSN shouldn’t be any more secret than name or address (and shouldn’t be used to unlock or access accounts).

> The same way they do for people who aren’t from the US? Some combination of name, address, birthdate, etc.

Plenty of countries have SSN-like numbers: https://en.wikipedia.org/wiki/National_identification_number

It's really not that special.

> But the problem isn’t using the SSN as a semi-unique ID. It’s using it for that and also assuming it’s secret. SSN shouldn’t be any more secret than name or address (and shouldn’t be used to unlock or access accounts).

Of course. Shouldn't it be trivial to sue any institution that uses SSN as a way to confirm your identity?

Shouldn't it be trivial to sue any institution that uses SSN as a way to confirm your identity?

You’d think, yet here we are, with one of the big three credit agencies letting people steal/resteal accounts with nothing more than some public info.

Isn't that like a classic American moment when you sue them and become a millionaire?

If only real life was like the movies. ;)

It's a terrible way to uniquely identify a person; it was never designed as such. For instance, there aren't nearly enough of them – they get re-issued all the time.

They don't get reused. See Q20:

https://www.ssa.gov/history/hfaq.html

It is treated like a secret, so if you come to know someone else’s Social Security number (thanks to a thriving black market you can buy up plenty of them) that’s enough for lenders to start giving you money and then chasing down that other person to pay them back. Are you starting to see an issue yet?

Well that's another thing, I don't see why would you need to get rid of SSNs. You just need to add another layer that will confirm that you're the "owner" of your SSN. Seems pretty easy to do?

Agreed, except that nobody has done it. So SSN is your username and password anyways, despite everyone* knowing they’re all public knowledge at this point

*: except judges and juries, apparently

I didn’t propose getting rid of the SSN without replacing it with an actual, secure national ID. If that involves legacy SSNs still somehow whatever.

Some people (especially older women) don't know their own SSN, just their husbands'. If they never had a job, there wasn't much use for an SSN. And if their spouse passed away, they always had to use the deceased's SSN to collect survivor's benefits (or whatever it's called).

I've seen it more than once when working with health records: two people have the exact same SSN, but different sex. If I need to match records, I'll use SSN and birthdate, knowing even that's not immune to errors.

> some citizens of certain religious sects, like the Amish, do not have social security numbers.

Fun story: many years ago, I worked on some consumer tax prep software. Specifically because of the Amish, the SSN field was optional. Imagine that - an Amish person using tax prep software.

Some Amish/Mennonite sects have exceptions for business, so I'll sometimes see them with cell phones. Tax software would probably fall under that exception. Honestly, I'm more amazed any company spent time catering to such a small portion of the market.

I’m no Amish expert but I lived near them for a while and it seems to be more about how they choose to lead their lives and there’s a (fuzzy) line between ownership and usage of technology. I’d bet many would be quite fine with using tax software on someone else’s computer. They’ll also use a contractor’s power tools, ride in someone else’s car, own flashlights, etc.

It should always be optional as not everyone using tax prep software will actually be a citizen of the country where they're paying tax or registered with said country's social welfare system. I found navigating bureaucracy a nightmare when I first moved to the UK because so many systems were set up to require a National Insurance (Social Security) number which I wasn't able to get until after I started paying tax. Notably I was denied a bank account until I complained about it on Twitter.

My first driver license from Mississippi in 1990 used my SSN as my driver license number…so anyone who saw my ID knew my SSN.

Additionally, because the Social Security Administration only issues an SSN if you are eligible to pay into and eventually receive Social Security, there are some legal temporary residents of the US that are not eligible and do not get an SSN.

While the government says that an SSN is not necessary to open a bank or credit card account, all the ones that I’ve encountered require it to proceed with the application, and the government doesn’t do any enforcement of that.

I'm late to the party, but CGP Grey has an excellent video detailing the flaws of how SSNs are utilized.

https://youtu.be/Erp8IAUouus?si=KzjB2v3bimLE79Ny

Reply on news.ycombinator.com