Hacker News Reader

Comment by fuoqi | Hacker News Reader

Hopefully, it will result in finally dropping use of SSNs as "secret" identifying person's identity and instead it will become an opaque ID which is safe to share.

View on HN

Agreed. This could be a blessing in disguise. However, my money is on: nothing changes— it all simply keeps getting less secure, more complex and brittle until the heat death of modernity.

There is a whole growing industry depending on it..

I've already seen the change in my lifetime.

Need to bring water bills, credit cards, etc... Although not sure how this would work for a 18 year old with 0 of these ahead of time.

Most likely. Except:

> it all simply keeps getting less secure, more complex and brittle until the heat death of modernity

Is it modernity? Seems more likely to be archaic economic systems captured by elites and incentivizing the wrong behaviors on all levels.

As I am someone from EU, please explain me what can you do with this SSN number?

I mean is it like a unique database row id which happens to be a non-changeable-lifetime password which is stored in multiple places in plain-text and you can use it to... "unlock some doors"? Make legally binding agreements remotely... ? Or what?

Or it is PII - privately identifying information which is more of a privacy issue here?

Yes, to all of the above, unfortunately

As an example, if you call your bank to report a lost credit card, and that you'd like it shipped to a different address than the one you registered with them, they'll ask you for the last 4 digits of your SSN.

So yeah, someone who knows (name, SSN) or especially (name, address, phone, SSN) can do a lot of harm.

It's used for all sorts of "prove you are who you are" situations. It's most commonly associated with applying for credit/loans, and taxes, but definitely not limited to those things. It's ridiculous that an immutable 8-digit number + name is used for authentication in the USA. It even says on the card "FOR SOCIAL SECURITY AND TAX PURPOSES - NOT FOR IDENTIFICATION" but apparently we've all lost our minds and ignore that. It can be very difficult to go through business processes if you refuse to give your SSN - some healthcare providers will just refuse to serve you.

With it, people can take out loans in your name, get into your accounts, file fake tax returns and get tax refunds in your name, and generally act as if they're you. Things are getting a little better nowadays (with additional information required) but we still don't have a secure method of identification online / over the phone.

Over here we use a PKI cert for that. A smartcard providing the root of that trust is provided by the government after verifying your identity using the typical stuff used for identity documents (any biometric data on file, birth certificate, etc.). That still doesn't mean that it's impossible to steal an identity, or acquire a made up one, but it does make it a whole lot harder.

The thing about social security is that it was supposed to be used for a fairly narrow system, and the physical cards even have text like "not to be used as identification" on them. And then we used it for that anyway

The German equivalent to the SSN in it's ubiquity, the "federal tax id", is illegal to use for non-tax purposes.

As a German that feels about correct.

SSN is technically the same. The Social Security Act, actually has that point explicitly called out. Did anyone listen? Nope.

Do they have penalties in the 5+ digits for each such offense?

Wouldn't matter. No one is interested in enforcing it, and there is too much value in the datapoint to credit rating agencies to tear the entire edifice down. Hell, back in 2011, I was part of a group migrating away from SSN usage at the Federal level. The biggest delay? Waiting for another semantically compatible I'd to manifest. TIN (taxpayer identification number) could be synthetically combined with a couple other ID's in the dataset such that they could finally retire the SSN's we weren't supposed to be using in the first place.

It's often used as a way to verify identity. Historically it's been one of the more secret pieces of information about someone, so while name and birthday are not very secret, if someone wanted to steal an identity, it's generally the SSN that is hardest to figure out. As a result though, I think a lot of places treat it as "If you know the SSN, then you are who you say you are."

Basically in the EU, you usually have an ID card (or a passport/driving license/visa card, they're recorded on all of those too) that has a combination of a citizen ID and a document ID. Both of these details are combined considered to be "you" for the purposes of anything to do with the government. The government has a registration of every citizen ID+document ID combination and knows as a result what documents are in circulation. They're technically not required in most of Europe, although you must be able to procure one at request for legal reasons (ie. getting your employment properly sorted, opening a bank account, or a law enforcement official asking for your identity). Revoking a combination is as easy as getting a new ID card/passport since the combination is what counts. ID documents also usually expire eventually, so there's also an inherent time limit to what a leaked combination can cause issues with.

They're also as I understand it, used to handle things like sending everyone voter IDs for elections in advance; this is how the government knows who to send the voting cards to.

Bafflingly, the US does NOT have a national identification method that works like this. There's no country-wide identity document that provides the same assurances. As a result, most US entities (government branches & corporations) have settled on a "closest possible"... which is the social security number. A number that's used to identify every person with attachment to the US in some form since social security is something every US citizen has to interact with. (It also includes a ton of non-citizens since as I understand it, social security is something foreign workers also have to interact with, but that's besides the point.) It's a 9 character long numeric string that identifies you as a person... and has almost no revocation mechanism, even if it ends up in a data breach.

Yet in spite of this, it's still used as a country-wide ID mechanism for a lot of different things and replacing it with a proper ID mechanism has as I understand it (not American) very poor support as it's a culture war issue.

Reply on news.ycombinator.com