Every American's Social Security number, address may have been stolen in hack
Every American's Social Security number, address may have been stolen in hack
Take your social security number. Change the last number by one. Congrats, you have stolen someones number.
It isn't secure or random in any way. Infact, by doing the above you will have the number of a person born probably in the same hospital as you.
Isn't it the address being leaked with it that makes this notable?
You can't add a number to a SSN and also add a number to the street address to then narrow down which full names are associated with that SSN to then possibly be able to use it.
I didn't think the number had any use on its own
The address does make it a lot more useful, but the point that I am making is simply that the number itself has never been secure, and this kinda failure was inevitable due to only needing slightly more info than the number itself. A number which itself is already partially identifying.
We shouldn't use social security numbers like we do.
Is usa numbering just incremental? Canadian ones use a checksum type setup to determine if it is a valid SIN
There's some brackets based on area and similar https://www.ssa.gov/history/ssn/geocard.html
First 3 digits are the area number assigned to a geographic. Next 2 are a group number and are not used serially but have a rather unusual usage sequence. The last 4 are a serial number assigned in order.
Yeah, the SSN system is the stupidest freaking thing ever for all the crap we use it for. but trying to implement a better system is met with cries of "GOVERNMENT OVERREACH, COMMUNISTS! OH GOD IN HEAVEN, MUH RIGHTS!!!1!". So....we haven't really done anything about it, and probably won't in my lifetime.
It's unfortunate that SSN has come to be used as a form of proof of existence as a person, but I'm glad at least that more effective means of formally tracking and quantifying us have been successfully fought back. Banks, governments, service providers and employers having some friction and uncertainty in whether their database entry accurately corresponds to you is itself a valuable form of privacy.
I've been reading the book Seeing Like A State and I think it has some pretty good points about how civic legibility and record keeping is established as a tool of centralized control and can be a dangerous double edged sword.
Why do those numbers even exist? In my country we got ID cards and passports, plus some tax identifier that is used for social security and tax payments by our employer into the accounts, and that's that. All that's required for actual identification is a valid ID (including passport as long as you have a recent address registration). Their numbers change every 10 years, or you could apply to have it replaced earlier.
SSN isn't even meant to be used to verify identity, really. It's just supposed to be used to track people paying into the social security system. Somehow it got tied up in identity verification even though all it is is some essentially random number.
They aren't secret and never were meant to be. If you can't change it (biometrics, ssn, etc) it's not a password.
Maybe we should use something better for identity, geez.
bruh
Can't wait until it leaks into the public
Already has...
There was another post or comment about this topic and a person posted a list of websites to freeze your credit. Does anyone know where that comment went?
Might be worth investing in a credit monitoring service. I use aura, it was definitely the simplest way to freeze each one from the same portal. I also use their call filtering service so any unknown number that calls me gets silenced before my phone rings and a message says, “I’m a spam filter, please state the nature of the call.” It’s saved me so much goddamn looking at who’s calling.
On top of that, gives me alerts, credit scores on the regular so I can notice if anything is up, it’s been systematically requesting takedowns of all my info on those data broker sites…other shit too, honestly. I forget. But it’s definitely made my life much more pleasant.
I'm pretty sure mine has been stolen a dozen times at this point. You should never assume your SSN is private information, but you should treat it as such to limit how many people have it.
The main issues here are:
Honestly, we really need to stop using the SSN as identification.
And it even says so right on the card. 🤦🏼♂️
Wait, is the SSN used to verify a person's identity?
Why would a static key ever be used like that?
It's not supposed to for anything but government. And it's not a key, it's an ID number. Not sure how else other than static you could do that.
It's also not supposed to be used for anything, but government (specifically, Social Security), and it even says so on the card.
Because the US doesn’t have a federal identification card. At the state level you can use the id number of someone’s drivers license or state id for identifying them, which is marginally better since it changes with new id cards.
SSNs weren’t intended to be used for identification, but since there’s no other national option they effectively are.
To further protect yourself, you can also:
Yeah, I only use credit cards or cash these days, and leave my debit cards frozen/locked. The only time I would need my debit card is to use an ATM, and it's easy enough to login on my phone and unlock it. I've had several fraudulent charges on various cards, and so far it has been resolved with a short phone call and a reissue, and my replacements seem to come faster than new credit cards. The rewards are nice, but the purchase protections are the real reason I use them.
Biometrics are really nice, and on newer phones, way more secure than a PIN. They're also local-only, so they're quite privacy-friendly.
But absolutely have a backup. I use a long PIN as my backup, and my bank lets me use a long PIN on my debit card as well, so I keep them the same (easier to remember that way). I use my fingerprint for pretty much everything, but I also have my phone reboot itself after a period of inactivity, which forces a PIN login (again, helps me remember it). Oh, and it's a random PIN, so not something anyone could guess (I'm a developer, so I used a small Python script:
import random; ''.join(str(random.randint(9)) for _ in range(N))where N is your desired length). I ran three of those and picked one.And yeah, Bitwarden is fantastic. I apparently have >300 logins, and there's no way I'd be able to remember that many unique passwords.
Laughing in EU
Eh, there are good parts to it as well. The only Federal ID I have is my passport, so there's no reason for them to track me across state lines. If I get pulled over in Oregon, they don't necessarily know my driving history in California or Nevada, so I'm more likely to get a warning than a ticket. If I had a Federal ID, they'd probably communicate across state lines more.
It's mostly bad, but with a silver lining.