The Equifax Breach Exposes America's Identity Crisis
1–10 of 132 posts
Re: The Equifax Breach Exposes America's Identity Crisis
#2"We need laws that limit the collection and use of SSNs."
The problem shouldn't be defined as "let's still keep SSN secret, but limit its collection", because sooner or later your SSN will leak. The issue is that SSN number shouldn't be considered as secret and some other measures should be used to identify the person.
Re: The Equifax Breach Exposes America's Identity Crisis
#3In Sweden your SSN is public information. I posted the same comment on another Equifax thread and got some pretty interesting replies relevant to this discussion: https://news.ycombinator.com/item?id=15208223
Re: The Equifax Breach Exposes America's Identity Crisis
#4Coming from another country I really have difficulties understanding why e.g., utilities would want to have your SSN. What do they get that they otherwise won’t get? Isn’t a validated address and a credit card number enough for them? What is the scenario that they try to protect against? That someone misses his 30 USD utility payment and has a CC that is not covered? That seems like a rather weak argument
Re: The Equifax Breach Exposes America's Identity Crisis
#5I think we're mixing two different purposes here.
Authentication through knowledge of a SSN is an absurd practice, and is a non problem in countries which have a national ID card scheme. Introducing ID cards would be my obvious response to this leak. Not re-issuing SSN until the next major leak.
Having a universal unique identifier for every individual across systems is a different matter and I am not convinced this is even desirable. In a world where no organisation is able to protect its data (or even willing since most organisations now are looking for ways to monetize it), this is making it too easy to link an identity across breaches. I don't think your utility companies have any need to know your SSN.
Re: The Equifax Breach Exposes America's Identity Crisis
#6I think we're mixing two different purposes here. Authentication through knowledge of a SSN is an absurd practice, and is a non problem in countries which have a national ID card scheme. Introducing ID cards would be my obvious response to this leak. Not re-issuing SSN until the next major leak. Having a universal unique identifier for every individual across systems is a different matter and I am not convinced this…
For the purposes of fraud, it's fairly easy to link accounts across datasets even without a unique key like SSN. You can just guess based on name and address or something and if you're only right 90% of the time that's still a pretty big win.
Re: The Equifax Breach Exposes America's Identity Crisis
#7I think we're mixing two different purposes here. Authentication through knowledge of a SSN is an absurd practice, and is a non problem in countries which have a national ID card scheme. Introducing ID cards would be my obvious response to this leak. Not re-issuing SSN until the next major leak. Having a universal unique identifier for every individual across systems is a different matter and I am not convinced this…
perhaps allowing tokens/passwords to be established for existing SSNs would be an alternative to national IDs. You could even create a separate token each time you needed to supply the SSN, so that if it's ever leaked, the source of the leak could be investigated.
Re: The Equifax Breach Exposes America's Identity Crisis
#8I think we're mixing two different purposes here. Authentication through knowledge of a SSN is an absurd practice, and is a non problem in countries which have a national ID card scheme. Introducing ID cards would be my obvious response to this leak. Not re-issuing SSN until the next major leak. Having a universal unique identifier for every individual across systems is a different matter and I am not convinced this…
For the purposes of fraud, it's fairly easy to link accounts across datasets even without a unique key like SSN. You can just guess based on name and address or something and if you're only right 90% of the time that's still a pretty big win.
People move home, particularly in the US which has a quite mobile population. Many people have many variants of their names, including middle names or long composed last names, and you have a huge number of homonyms. So while you may get a 90% hit rate on two, perfectly current, and breached at the same time datasets, I would expect that number to reduce greatly in a typical real world breach.
Re: The Equifax Breach Exposes America's Identity Crisis
#9"We need laws that limit the collection and use of SSNs." The problem shouldn't be defined as "let's still keep SSN secret, but limit its collection", because sooner or later your SSN will leak. The issue is that SSN number shouldn't be considered as secret and some other measures should be used to identify the person.
Anything collected will eventually leak.
The issue is that companies shouldn't be collecting ANYTHING, and what they do collect should get purged ASAP.
The problem is that every company got addicted to collecting information and nobody made them pay the price for doing so.
Re: The Equifax Breach Exposes America's Identity Crisis
#10I think we're mixing two different purposes here. Authentication through knowledge of a SSN is an absurd practice, and is a non problem in countries which have a national ID card scheme. Introducing ID cards would be my obvious response to this leak. Not re-issuing SSN until the next major leak. Having a universal unique identifier for every individual across systems is a different matter and I am not convinced this…
perhaps allowing tokens/passwords to be established for existing SSNs would be an alternative to national IDs. You could even create a separate token each time you needed to supply the SSN, so that if it's ever leaked, the source of the leak could be investigated.
And the social security system would become the paypal of identity. I don't know if they want that.
But an ID card is exactly that. It is a time limited, physical token issued by the state that identifies you to third parties. You could make it more secure with public-private key cryptography, by signing the information on the card, including the photo, such that forgery would become impossible (under 21 kids would hate that).