Inside the "3 billion people" national public data breach

3,000,000,000 leaked Social Security Numbers is a statistic.

-Joseph "Social Credit" Stalin

...Is it obvious I, as an American who can confirm my SSN (and whatever else) was leaked by this, sincerely couldn't care less because this is leak incident number 897165176548795647564576415671?

That $10 UberEats gift card from CrowdStrike would be more valuable than another batch of Free Credit Monitoring(tm).

I hope this helps you

Edit: I missed you said Windows. Probably Powershell have similar utilities, so you can do `ReadFileLineByLine \r \d big_file | ReturnHitBySearchTerm \v \t \s my_term` or something similar.

Freeze your credit reports, folks.

> ... but it was the first time since the overhead of managing the service had gone off the charts.

Around 2020 he decided not to: https://www.troyhunt.com/project-svalbard-have-i-been-pwned-...

He then reveals source of stress and the way it impacted HIBP: https://www.troyhunt.com/sustaining-performance-under-extrem...

Just think about it: HIBP hinges on a person doing his stuff, putting in his time and finances. That affects personal life. However that is a very valuable utility that guy is doing. Good that CF donates cache and help is here and there... but do you think you would have managed that service better?

Would it have been better if HIBP was sold and managed by a real company? Who knows. But long term it is of course healthier if HIBP isn't affected by a single person personal life situations.

Yes, I agree that there is a cultural undercurrent of fear around a national ID system, and I also agree that politicians are likely to game their political capital for the greatest return in their career.

What I do NOT believe is that the Social Security number just sort of came about and started being used by government services such as the IRS without anyone being responsible for that huge organizational decision or the initial (current?) lack of security controls around its implementation.

To me, it seems to be an almost certainty that it is both an organizational problem at the government service level AND (as a result) a funding problem.

I think we are going to discover, once people do the research, that HIPAA has done net harm by delaying flow of information for critical-care patients resulting in lack of patient compliance, confusion, and treatment error.

Yes, there is harm potential in insurance companies denying coverage or claims because they are privy to too much information about clients (a scenario that, I'd note, we could address directly by law via a national healthcare system or banning denial of coverage for various reasons) or by employers or hostile actors (including family) discovering medical facts about a patient. I have to weigh that harm potential against my day-to-day of having to fight uphill to get quality care because every specialist, every facility, and every department needs a properly-updated HIPAA directive for a patient (and the divisions between these categories aren't clear to the average non-medical observer).

There are definitely exceptions, but it puts strict scrutiny on any novel prior constraint of speech.

When you tell a data broker to delete all of the data about you, how can you be sure they get ALL of the data about you, including the ones where your name is misspelled or the DoB is wrong or it lists and old address or something? Even worse if someone comes around later and discovers the orphan data when adding new data about you and fixes the glitch, effectively undoing the data delete.

It's a catch-22 that if you want them to not collect data about you they need a full profile on you in order to be able to reject new data. A profile that they will need to keep up-to-date, which is what they were doing already.

If these devs that scrape/dump/collate all this info are anything like the ones I've seen, and they're functioning in countries like the US and UK whereby you don't have individual identifiers that are pretty unique, then I'd say the chance of them being able to get such a "unique" key on you to remove you perpetually, is next to impossible. And if it's even close to being "hard", they'll not even bother. Doubley-so if this service/people/data is anything like the credit-score companies, which are notoriously bad at data de duplication and sanitation.

Likewise, if you want them to do some sort of removal using things other than a unique identifier, then you have to have some sort of function that determines closeness between the two records. From what I've heard, places like Interpol, countries' border-control and police agencies usually use name, surname and dob as a combination to match. Amazingly unique and unchanging combination, that one! /s

But how would they keep making money that way?

You store a hashed version of my SSN, or my phone number, to represent my opt-out? Someone can just hash every number from 000-00-0000 to 999-99-9999 and figure out mine from that.

You hash the entire contents of the profile - name+address+phone+e-mail+DOB+SSN - and the moment a data source provides them with a profile only containing name+address+email - the missing fields mean the hashes won't match.

A trusted third party will work a lot better IMHO.

And of course none of the data brokers have much reason to make opt-outs work well, in the absence of legislation and strict enforcement - it's in their commercial interests to say they "can't stop your data reappearing"

They would leak that in the next data breach.

Which is how it plays out when someone dies, generally, and the family is there dealing with the aftermath. FYI.

>probably a paperwork mixed up around pensions when his ex-spouse died

Unfortunately that strategy is deeply flawed and dangerous because nobody cares if the data they have on you is accurate or not. They still can, and still will, use it against you at every opportunity. Every scrap of data they have, accurate or not, can be used to hurt you.

The only way to flood data brokers with garbage data that can't hurt anyone is to fill it with entirely fictitious people who somehow can't be mistaken for any actual people. Even that runs the risk of hurting real people though. For example, an insurance company might go to a data broker and ask for the number of people within a certain neighborhood or zip code who bought fast food more than once a week in the last year and how many have a gym membership. If the number of frequent fast food buyers is higher than it was last year and/or the number of gym members is lower the insurance company might decide to raise the rates of every single member within that neighborhood or zip code. Even fake people could skew those numbers if their fake data said they lived in those zip codes or neighborhood and ate out a lot or didn't have a gym membership. Indirectly, the fact person is mistaken for being a real one in that community.

The best way to deal with data brokers is to regulate them with strong data protection laws. Anything you give them risks hurting someone and gives them another data point to sell.

(Granted, most people here with an SSN should be older than that.)

... over SMS!

Paging patio11: https://www.bitsaboutmoney.com/archive/optimal-amount-of-fra...

Note that payments or deposits to a given account require little authentication over the destination though more for the payee. I've long been amused by US banks which require me to authenticate to an ATM to make a payment but will accept cheques dumped into a deposit slot.

I agree that the system mostly works, but fraud costs are in the billions, and that's U.S. credit cards alone:

"As Nationwide Fraud Losses Top $10 Billion in 2023, FTC Steps Up Efforts to Protect the Public " (2024) <https://www.ftc.gov/news-events/news/press-releases/2024/02/...>

The denominator is roughly $4 trillion, so it's an 0.25% fraud rate:

"The Average Number of Credit Card Transactions Per Day & Year" <https://www.cardrates.com/advice/number-of-credit-card-trans...>

That info is, in fact, already easily obtained trough leaks, but I just wanted to give your "utilities" case some clarity. Now the fraudster can apply for a creditcard in your name, and before the month has passed you are on the hook for $3000 in cc charges/debt which cost the fraudster a mere 12 minute phone call and 10 minutes skimming trough the leaked records from this HN post to find your SSN.

Are we saying that if you can show you have enough income / assets, it'll be that much more likely that you'll be fine in those cases?

The problem with putting a value judgement on this is that it will precondition people to assume good faith or bad faith on the validity of the assessment based on how they interpret the fairness of the court system.

Instead, we could just say that the majority of the cases are people trying to get out of legitimate debts. If we wanted to go farther, we could say that's because some people just don't feel responsible for their own debts and some people make a choice that a last ditch effort to get out of a debt they know they should pay rather is the lesser of two evils when the alternative is to continue to fail to provide adequately for their family given their circumstances, and how different people may draw that line at different points.

That's harder to articulate and a larger discussion that may be a tangent people aren't interested in discussing though, so it's probably just simpler to keep the value judgements out of it if the intent is to keep the discussion productive.

Isn't that the opposite of innocent until proven guilty?

For example, when you purchase online, some merchants do not check who is the owner of the card, or the address. It's done on purpose, because some people borrow the card of the others, some people don't want to use their card, etc. And overall it's all about risk management, but if the holder is really the one in front of you is just one factor among others.

I hate when this stuff happens. I setup an email address like that for myself and I have never used it because I’m so afraid it will have something like that happen.

My dad is guilty of doing stuff like that often. He was renting a VRBO for the family and wanted us all to see the invite, but he threw in my email address that I only use for family correspondence. When I went to sign up (because he didn’t tell me this), I used a different address and it was a mess. I had to get him to re-invite me to the trip with the new email, but VRBO still started sending me some nonsense to my good email. He also gave it to some financial planner he uses and they started emailing me left and right. I was really upset. Like you said, he means well with it, but I don’t think anyone should be handing out other people’s email addresses.

The other thing that can get you are social sites that ask users to upload their contacts to find people they know. If your friend or family member uploads their address book, you’re account ends up in the Facebook, LinkedIn, Twitter, or whatever other site might do it. I’ve never used that feature for this reason, I don’t want to do that to people. But I know some of my friends and family have done it and my addresses are sitting in other DBs because of it, probably with my name, phone number, address, and maybe even birthday as well.

Think of it as being the username and password. That's how many institutions have treated it for a long time.

Because far too many businesses, esp. financial ones (banks/credit unions/etc.) have also incorrectly used it as a password to authenticate that "voice on phone" is really John Q. Public and/or that "grifter in chair across desk" is really John Q. Public. I.e., they used the fact that "person X" knew number Y as proof that person X was really person X.

We can argue that it was never intended to be used this way (a true statement), that knowledge of it provides no such proof (also true), and that using it as such was always wrong on the part of these businesses (also true), but the fact is, many did use it this way, and, sadly, many still do use it this way. And it is this misuse that is the "issue" with everyone knowing everyone's SSN.

Voting requirements and eligibility are set individually by each state, sometimes even in finer detail, New York City wanted to give immigrants the right to vote in local school board elections for example.

SSN are administered by the federal government and are opt-in(however most people apply for one) so it is not something a state can really use as a voting requirement.

State I currently live in(GA), you need to bring a photo ID for in person voting: - Drivers License(from any state or federal government) - State ID card - Student ID card - ID badge from any state or federal workplace - Passport - Military ID - Tribal ID Data was cross check to an online voter registration database.

Prior state (NC), I think the ID requirements were similar(possibly more relaxed) but at that time the data was checked to the voter roll, a book with the name and address of all the people in the precinct. When you went to vote, you signed by your name and then it was crossed off the list.

https://beeckcenter.georgetown.edu/wp-content/uploads/2021/1...

People are calling these "religious fears" because they are fears very often based on religion. People who fear the Mark of the Beast aren't simply worried about being tracked by powerful institutions, they're looking for prophetic signs of the antichrist and Satanic one world government that their holy book says will lead to the second coming of Christ and Armageddon. Even though it was really talking about Nero Caesar. You can't separate the fear from the religion.

>You do not want to make it easy for every rapacious for-profit corporation to pressure every citizen to cough up an identifier that can be used to track their every move.

Then ban cellphones. Those are far more useful as a means of surveillance and control than any serial number in a database. They're also held in the hand and to the head, and used to buy and sell goods, which conforms far more closely to the mark of the beast than, say, RFID chips or SSNs or serial numbers on currency. Which the mark of the beast people were all against, in their time.

Unless you want to go full Kaczynski and run off into the woods to live off the grid, you can't avoid having identifiers attached to you. Your birth certificate, vaccination history, criminal record, credit score, address and phone number, the license plate on your car. Even the cookie that leaves you logged in to Hacker News. Governments and corporations already know who you are and where you are. Are there massive negative externalities to having our identities controlled by forces we have no agency over? Absolutely. But fearing every number as a slippery slope to a global satanic dystopian hellscape isn't reasonable. Unfortunately that's the context in which many people have this conversation, and that needs to be recognized.

That’s what the people making those claims are talking about. If you haven’t talked with paranoid religious extremists before, it’s eye-opening: they are literally saying that a mandatory government ID will serve the beast mentioned in Revelations.

That’s not the only concern or group raising it by any means but I mentioned it because governments have to consider edge cases - if you make SSN a required field you have to figure out how to avoid turning away children from those households. If you’re building a website to sell t-shirts, that’s fine but if its government services you might be breaking the law and especially might be harming people who need help (a 17 year old who ran away from that house might have trouble getting the ID they need to live independently).

> a central authority gives everyone a serial number then it will be used to track them by powerful institutions, which is a tool of oppression.

It’s only a tool of oppression if you have a government prone to abuse and without constraints. If that’s true, since the computer age the distinction increasingly useless. The Stasi paid clerks to move paper around and if you’re comparing IDs by hand having a single number is a huge timesaver. In 2024, however, all not having one means is that they use software to link them – the context for this story is the huge industry doing that for all kinds of data, and they don’t mind having to link a couple of different identifiers. Faced with an oppressive government, we should be calling for legal restrictions and accountability for leaders. Not having a unique identification number is like wearing a breastplate into battle after the invention of the machine gun.

The anti-government types do hate the idea of a national ID, but they're already forced to carry a drivers license/state ID, and SS card so they've pretty much lost the battle already.

I'm afraid that it's the business owners who are our biggest hurdle.

Make the ID card optional, so that it simplifies things if you have it, but still allows operation without it. If 80% of law-abiding population has the card, only the stubborn deniers will remain targets of easy identity theft and fraud based on it. Partly it will stop being worth the effort, partly it will serve as a good control group.

Allow but do not require to use the card for employee identification. Whoever insists on hiring undocumented immigrants, could continue. Most industries don't do that, and would reap the benefits of a more secure identification.

Don't make the card universal. A bank card with a chip does not identify you for governmental agencies, but prevents a lot of PoS fraud. It could prevent credit fraud if banks allowed me to require the card to take a loan in my name, or to make a transfer larger than $10, and provided the card identity check service to each other and to credit unions. Phones with NFC can read bank cards, so it's a good way to say "it's me, I confirm" in a secure way.

Evolutionary, opt-in, piecemeal solutions often have higher chances to succeed than abrupt all-at-once changes.

Big one, but even though employing illegal immigrants is a crime, it's almost never prosecuted.

One doesn’t need to be anti-government to fear governmental intrusion on one’s rights without due process. Our current government does that now.

Any proposal for modern ID needs to have Constitutional protections, checks, and balances or it will eventually devolve into a digital police state.

It's not like it's rocket science to have the reader application detail what the request is used for, and encoding it in the request/response, verified when used, so that it can't be used for anything but the approved purpose.

My country's version uses separate mechanisms with separate passwords for "identify me, revealing my name/DoB/number" and "sign something". Obviously not impossible to pretend that you're signing an innocuous document and have you sign something else, but it at least removes some of the low-hanging fruit.

But I am by tendency an optimist, and the open-source part (if they do that) means we can have eyes on their crypto assumptions behind the protocol and whats on the device.

MyGovID, which I think they're baking into it has been pretty solid. thats distinct from your mygov account, many of which have been hacked, in part because so few people used MyGovID.

(if you've got better info always happy to see it)

If your phone is on, your position in time and space to some circular error is also known, continuously.

To say nothing of Bluetooth that's with the advertising hoardings and inside the store mainly.

Basically, any privacy nut with a phone and simcard is in denial.