Comment by UnoriginalGuy | Hacker News Reader

Comment by UnoriginalGuy | Hacker News Reader

I normally don't have much sympathy for companies which get egg-on-face because of their own incompetence, but I am very sympathetic to the employees and past employees who just had their SSN and other vitals leaked onto the internet.

As an aside SSNs really need a massive overhaul. In theory they're meant to only be used for government stuff, but their use is now so broad (finance, insurance, medical, et al) that their leakage is all too common and the potential cost of a leak too damaging.

With a little bit of investment the SSA could continue to generate SSNs (for historical reasons and government department usage) and generate a new SSID which is just a longer unique number which companies are legally prohibited from storing, however when they receive it they forward it to the SSA via an API and it returns a static unique customer number (UCN) which they can then in fact store.

This has the following advantages:

- The SSA can update your SSID a lot. Every few years, every new card, or when requested. Unlike SSNs which cannot be changed.

- Updating your SSID won't break existing accounts or similar, as companies won't store the old one anyway (only the resulting UCN). Unlike SSNs which break stuff if changed.

- Leaked UCNs are not as useful because you cannot enter them into a web-site or put them on a financial form directly (it would be a different length/format to SSIDs or SSNs on purpose). Unlike SSNs which can be directly reused.

- The system doesn't depend on complex cryptography. It is just a simple perhaps JSON request over HTTPS.

You could deploy this system over ten years at minimal cost. The system is relatively simply, and behind the scenes it can tie UCNs to SSNs in the SSA's database system. A single customer would have three things (in this system): Current SSID, static SSN, static UCN.

SSNs should be made public.

Then we could all stop pretending that knowing an SSN provides any sort of security. The pernicious idea that asking someone their SSN is like asking for a password needs to be killed, completely. To make organizations change their processes requires more than mere federal law forbidding the use of SSNs, and making SSNs public would make it obvious to _everyone_ that knowing an SSN doesn't mean anything. Make them public, and take away their power.

Interesting, but I think it has bad side-effects for privacy. I'm guessing this would mean a public mapping of at least full-name => SSN being published. AFAIK there's no such list of names currently -- is there a good reason for that? Would/should this list include more data like date of birth? My understanding is that SSN's from certain eras encode information on the place of birth. Might having a public, nearly unique number of any person allow buying/selling additional data from third parties more easily?

A Name<=>SSN mapping would be enough to force change. It wouldn't even have to be accurate or complete, just well known. If the government announced that it will release a list of SSNs and names, everyone would realize they can't ask for a SSN for "verification".

> My understanding is that SSN's from certain eras encode information on the place of birth.

It goes the other way too, from public info to SSN: http://arstechnica.com/science/2009/07/social-insecurity-num...

> Might having a public, nearly unique number of any person allow buying/selling additional data from third parties more easily?

The government has been trying to restrict the use of SSNs since their beginning, including commercial restrictions.

https://en.wikipedia.org/wiki/Social_Security_number#Identit...

Good points, thanks. I think you missed my point about commercial use, though. Allowing a public, universal, nearly unique identifier (apparently SSN's aren't always unique) for every resident of the US might make it easier to compile, buy, and sell information about people. I guess these companies already use {name, date of birth} as an ID to attach addresses etc., but having a more robust UID would allow more accuracy when considering name changes or variants. Also, publicizing SSN's risks retroactively publicizing everything that was ever privately collected under them. I can't quite put my thumb on this, so maybe it's a bit irrational, but I would want somebody to thoroughly disprove things like this before I could support the idea.

If, e.g., Facebook is completely allowed to know my SSN, they can more easily make deals with anyone else to share information about my finances, medicine, voting, etc., which are already tied to my SSN. Considering the "shadow profiles" some social companies reportedly compile, they might even be able to do this without my ever creating an account. The current situation in this area would still probably make me uncomfortable if I knew it all (as your links suggest, Facebook might already be able to guess a lot of SSN's), but I at least hope that having one "secret" and legally "regulated" element slows down some data mining and exchanging.

If you have confidence that business interests or laws will prevent my worst fears from being realized, consider we're talking about this in a thread about supposedly private information being publicly released when a company got hacked. Then there's the trading and compiling these hackers could be doing outside of the public view.

I agree that a government issued identifier is a bad idea, but that debate is long over and SSNs won.

The government can still stop corporations from using it by passing a law and enforcing it (and they have for some things), but that doesn't seem likely given the history and evolution of SSNs. It seems more likely that the government continues to require SSNs on more and more reporting, and continues to not punish other uses by corporations.

+1

I recently saw a demo of the "Aadhaar" project by Indian government in Nasscom Product Conclave event (in Bangalore). I was a skeptic & still am wary about security aspects of something at this scale by government.

But I was quite impressed by the progress & the use cases [1] themselves. They showed in real time, how a bank account authentication can be completed without bringing any other document.

Just IRIS scanner on a phone / tablet, that confirmed the identify of user by returning a photograph & other details. It was done in seconds with a 3G network. There were a few other use cases demonstrated and was pleasantly surprised to learn there are companies in valley that are building services on top of the API. [2]

[1] Overview of Aadhaar service: https://resident.uidai.net.in/aadhaar-services;jsessionid=B1...

[2] API: https://developer.uidai.gov.in/site/book/export/html/18

>I am very sympathetic to the employees and past employees who just had their SSN and other vitals leaked onto the internet.

What makes it even worse is that the SSA makes it virtually impossible obtain a new SSN. Even showing them that you were a victim in a high profile leak like this, for example, isn't enough. You have to prove actual misuse, such as someone taking a credit card out or being arrested in your name, before they will issue a new one. In almost all cases, police reports are required.

Given that a new SSN is essentially impossible, if I were a victim in this, I would immediately freeze my credit file at all 3 major credit bureaus. In most states this can be done for $0-$10 per bureau. This can cause hassles for instant credit approvals etc, but they provide mechanisms to unfreeze the file temporarily when necessary.

Why wait until you're a victim? It's much easier to prevent significant damage to your credit history than it is to repair it. The hassle with credit approvals is pretty minimal; people generally know ahead of time when they'll need a credit check, and it only takes ~15 minutes to put a temporary lift in place. Identity theft is often an expensive, massive headache that can take years to fully recover from.

Actual misuse isn't enough. There was the case of a woman whose ssn was used by hundreds of people. I think she eventually was able to get a new number but it took years and it's impossible for anyone else.

Somewhat related, I think the history of SSNs is a lesson in things like separation-of-concerns and scope creep. Social Security cards started in 1936 with the heading "Social Security Act." In 1946, "For Social Security Purposes Not For Identification." In 1961, "For Social Security and Tax Purposes -- Not For Identification." In 1972, they gave up on "not for identification." As of 2007, the card includes security features such as color-shifting ink and a latent image only viewable from certain angles. It seems the card progressed from simply a medium to convey an account number to the holder, to a high-security proof of eligibility and identity.

A system designed in the 30's, explicitly not for identification, is still in use 80 years later for everything from its original design for a single government agency, to medical care, financial credit tracking, taxation, voting, employment, etc. Might we have benefited from re-designing it at some point in the past, instead of overloading purposes beyond what it was created for?

http://www.ssa.gov/history/ssn/ssnversions.html

Companies just shouldn't use a government id number for any sort of authentication.

They might need such a number to carry out some level of authentication, but they shouldn't treat knowledge of the number as significant.

Perhaps you're right. But then they still need a way of uniquely identifying a specific individual across many products and services. If for combating fraud if nothing else.

There could always be an independant organisation who generates GUIDs for everyone, but you'd still want to improve on SSNs due to the limitations outlined above.

The unique id is fine. It's pretending that it can be a secret that causes all the problems. It should be treated as personally identifiable information and not distributed carelessly, but that shouldn't be mixed up with treating it as secret (which it needs to be to provide useful verification of identity).

If SSN was no longer the primary key for financial and marketing data, and UCNs were only locally significant, this would make data sharing rather difficult between companies. Think of banks and service providers talking with credit bureaus. Or they'd just use an even more inferior technique for UUIDs like "name-address". Or even more invasive (biometrics, or something)

You mean a system similar to what almost every non-USA country currently uses?

Here in sunny Australia we don't have anything like an SSN, at least not in terms of secrecy and potential personal disruption were it revealed. We have a TFN (Tax File Number) but lots of non-owners of that number need to, and do, have access to it.

Our bank accounts contain two parts - the branch (BSB) and account numbers. Anyone can get access to those, and in fact we frequently share them in order to receive payments.

The way the US, and I think the UK also, revere such evidently hard-to-protect information means the social designs around them are hugely fragile.

Really, it's not a hypothetical 'there has to be a better way', but simply 'there is a better way'.

Not aware of a UK equivalent of SSN.

Justin - you're quite right. NI number isn't anywhere near so powerful.

However I was thinking more of the assumption that your Sort code[1] + account number can be kept secret, and more importantly the profound risks to your finances if it is not.

[1] http://en.wikipedia.org/wiki/Sort_code

Sort code and account number is no risk at all. You can (and many do) quite happily give this information out.

Indeed, it allows you to pay me money, you can easily obtain them from invoices... they do not provide any authentication.

There is some risk in revealing these, for example: http://news.bbc.co.uk/1/hi/7174760.stm

They could just share UCNs instead.

SSIDs cannot be stored (or shared). But UCNs would function exactly like SSNs in the current system.

SSIDs just exist to "wrap" UCNs, they prove that you have the current SSID for whatever person you're claiming to be (kind of like a poor man's password) and make it more difficult for thieves to re-use the UCN number trivially (you'd have to be an insider to enter a UCN, outsiders need the SSID).

The reason to stop people storing or sharing the SSID is primarily so SSIDs themselves don't become the SSN replacement. Companies might get lazy and instead of converting the SSID at the SSA, they instead "cache" the SSID->UCN conversion in-house or worse just use the SSID directly.

You have to make SSIDs ephemeral. UCNs and SSNs are static. UCNs can be stored/shared, SSNs get outmoded eventually, and SSIDs are short-lived no storage-sharing numbers that provide the UCN.

great idea... which consultant gets to build it for 800 billion dollars?

Reply on news.ycombinator.com