Here's a number: 147334572. Have I stolen it?
This is yet another alarming signal that the whole idea that your SSN/SIN or credit card number is somehow secret and can be used for authentication is flawed. We need to work on fixing this. At the very least, we should stop talking about "stolen numbers". And even if the breach in question resulted in attackers gaining access to names + numbers (unclear from the article), it should not cause any serious consequences.
Here's a name: jwr. Have I stolen it?
This is yet another alarming signal that the whole idea that your colloquial identifying information (name, phone, SSN/SIN, credit card number) is somehow a natural resource that anyone can use as they like. We need to work on fixing this. At the very least, we should stop pretending that identifiers are just tags that anyone can use without consequence. And even if the breach in question resulted in no harm done (those associated with the identifiers suffer no direct liabilities), it should not be treated lightly.
Possession of particular identifiers cannot be brushed off as "it's just a number" et al. You picked 14334572 precisely because it is not meaningful to anyone; short of such particular & peculiar use, we don't pick and retain numbers (or other identifiers) for no good reason. Out of a given range, the odds of picking 14334572 is very very small...if it happens to have a particular social meaning, and you possess it along with other information which likewise has an odd lack of meaninglessness, then you have malicious intent constituting "stolen numbers".
Don't pretend information is meaningless. We're not dealing with the Library Of Babel here.
You having a 'jwr' string does not enable you to do much — you can't use it to gain access to anything, no one will ask you for this string to authenticate you, you can't use it to pay for services. So if you "stole" it (or produced it out of thin air), it would not be a problem.
Now, I picked 14334572 specifically because it looks like a social security number (and might, for all I know, actually correspond to one). The point here was that you can't 'possess' a number, and you can't 'steal' one. You can steal complete personal information (that includes the number), but that is not what the original article was about.
My main point was that the real problem is with the whole idea of social security numbers (and credit card numbers) being both public identifiers (which is fine) and authentication tokens (which is not). If they were just public identifiers, then "stealing" a list of such numbers would not be a problem for anyone. It is the embedded trust we place in those numbers that causes us problems. SSNs are not secret key material, and treating them as such causes all kinds of issues.
As a side note: looking at the downvotes, I am increasingly worried about knee-jerk reactions here. I am finding that unless I craft my comment carefully and surround it with disclaimers, it will get misread. This is worrying, because it leads to watered-down and needlessly verbose discourse, words playing the role of guards against all the detail-pickers out there.
I might not be able to do much with "jwr", but I could build an entire profitable identity around your SSN.
Your real concern is that identifiers and authentication must be separate and treated as such, while in practice one number/string is used for both purposes - hence the concern of "stealing numbers", as having the identifier means having the authentication. Insofar as there may be a separate authenticating token, all too often it is so weak that the identifier is used as part of the authentication; having the identifier may be enough for access, or enough that deducing the remaining authentication token may be fairly trivial (say, a 4-digit PIN); this being tax day in the USA, we're quite aware that many tax returns will be fraudulent, requesting large refunds based on mere possession of a SSN identifier and a smattering of other public data. We should be using real cryptographic private keys of substantial length for authentication, leaving the public identifier public so that having one (or a slew) gets one nowhere without the hard-to-obtain authentication tokens.
As for the downvotes and the need to craft comments carefully: yes, the need for careful wording is the norm. We're trying to cram a lot of information and opinion into a very small space, which will be read very quickly by a great many people of wildly varying perspectives interpreting the post, making it very easy to misinterpret intent (doesn't help that there are a lot of dumb & ill-advised posts, setting expectations quite low). The greatest problem is refining short easily-read posts to withstand accusations which demand encyclopedic thoroughness. One of my motivations for prolific posting around the 'net is precisely to exercise & refine my ability to post views in a concise & persuasive manner (and if that gets bizarrely construed as "he must have multiple accounts, know a lot of people, and persuades others to downvote opposing views" then I must be getting somewhere with that ability).
The same way someone might "steal" your password. All data can be encoded as a number.
> the whole idea that your SSN/SIN or credit card number is somehow secret and can be used for authentication is flawed.
I don't disagree, but "how can you steal a number?" isn't a valid argument for your assertion.
However, even if we all had a unique 4096 bit private key with which we identified ourselves, it would still essentially be a number and it would certainly be able to be stolen. Stealing a number is more or less the same as stealing a private key or stealing a classified electronic document - it's the unauthorised access and copying of information. Society has broadly come to accept that this is considered stealing.
Secret information is required for practical authentication. Some examples:
Private keys (ssh, gpg, SSL/TLS certs, bitcoin wallets)
passwords
session ids
api secrets
auth tokens
As a comparison, your SSN is used all over the place, you will need to disclose it regularly (rent an apartment and your landlord is likely to request a credit check, you'll give him your SSN). A number of people and institutions will have access to it. It is not a secret. It should not be used for authentication and no one should assume it somehow secret, because it is not.
That said, the SIN in Canada is actually meant to be kept secret between you, your employer(s), the CRA, and a few other situations[1]. You should never give it to anyone else, write it down anywhere, etc. I memorized mine long ago and keep the actual card locked in a box somewhere, and I never give it out except to the government or new employers.
[1] http://www.servicecanada.gc.ca/eng/sin/protect/provide.shtml
People use all sorts of zany things to try to prove identity. I think public education is the first line of defence against the misuse of things like SSN/SIN.
For most other things though you can refuse to disclose it (i.e. telecom providers, debt-only financial institutions like credit card providers)
Hilariously enough, if you call them, you can change the address on file if you have SIN + DOB, making the "PIN" pointless (and irritating, since you have to wait several weeks)
Still a pain to get it setup, but once you are setup it is much better now.