undefined | Better HN

0 pointsdragontamer7y ago0 comments

That fundamentally misunderstands the problem.

SSNs are fine and useful. They just shouldn't be the "password" to financial systems. When every damn bank uses "Whats your pin and SSN" to gain access to an account... that's the problem.

The issue is that private companies use SSNs for security. There's nothing wrong in using SSNs as an identifier.

The USA needs to start assuming that SSNs are public information, and to build security through other means. SSNs were never a secret number to be used for authentication / authorization purposes.

0 comments

2 comments · 1 top-level

tialaramex7y ago· 1 in thread

> There's nothing wrong in using SSNs as an identifier.

There's plenty wrong with this. SSNs were already a pretty bad identifier when they were invented and didn't get better.

There's no check digit, so if you make any mistake at all it's probably a different person's valid SSN.

Until relatively recently they were assigned both chronologically and geographically, so one digit error in SSN plus Address plus date of birth... Causes no red flags, it looks about right. Modern ones are randomly assigned, but it'll be decades before that's most people.

Like most similar systems the US SSN also very explicitly says it isn't suitable for any purpose except numbering Social Security recipients. People you want numbers for may or may not have SSNs. Don't worry though, since they all look pretty similar and there's no check digit the people who don't have one long learned to give a bogus SSN, probably belonging to somebody else. Somebody you know probably does this today. What a useful "identifier".

dragontamerOP7y ago

What you say is true, but is entirely tangential to the topic of Equifax breaches.

> Don't worry though, since they all look pretty similar and there's no check digit the people who don't have one long learned to give a bogus SSN, probably belonging to somebody else.

Its trivial to use US Government sources to do a name-check on the SSN, to ensure that you've got the right person.

https://www.ssa.gov/employer/ssnv.htm

https://www.ssa.gov/cbsv/

The latter costs money, but not much money in terms of doing business.

---------

The fact remains: People use SSNs because the Social Security Administration is very good about keeping SSNs in order. Perhaps the number could be designed a bit better, but the system has been in use since the 1930s and there's no better number to use in the USA in most cases.

j / k navigate · click thread line to collapse