Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Equifax Breach Exposes America's Identity Crisis

wired.com

Post reply on HN
Print view View original

31–40 of 132 posts

Re: The Equifax Breach Exposes America's Identity Crisis

#31

Post by jaclaz »

slau wrote: post #27
jaclaz wrote: post #21

Earlier quoted context omitted.

I believe that all EU has a similar approach, it is just the US that misuse the SSN. The way it is done in Italy (it is called "Codice Fiscale") it is composed through a public algorithm from name, surname, place and date of birth with a final "control" character (derived by the preceding characters) so - with the exception of the very few cases of total homonimy - it can be recreated "on the spot". Nowadays it is ho…

Thanks for the great content and information. Just a minor nitpick: your identity can't be authenticated. You, as an individual, can be identified, but the only thing that can be authenticated is the piece of plastic (ensuring it is not counterfeit). I wrote down an analogy for the different lingo some months ago: https://news.ycombinator.com/item?id=13635820

Yep, sure, you are correct, that's why I put it in double quotes, more accurately the identity can be "verified" or "vaidated" by the ID card (of course authentic) or even more strictly by comparing the photo (and other description data) on the ID card to the looks of the bearer.

I just checked and also en.wikipedia has a good description of the algorithm used, JFYI:

https://en.wikipedia.org/wiki/Italian_fiscal_code_card

Re: The Equifax Breach Exposes America's Identity Crisis

#32

Post by tim333 »

nmstoker wrote: post #29

The article goes a bit off the rails at the end, with all the focus on using a changeable identifier ("And if this new identifier were easy enough to change (unlike SSNs), breaches, leaks, and other unintended exposures would be less consequential.") There's no reason not to keep SSN as an identifier. Just the same as I wouldn't change my name if I suffered identity theft. Instead there needs to be authentication (eg…

The government could bring in an auth service adding a password to your SSN. Problem solved. Kinda.

Re: The Equifax Breach Exposes America's Identity Crisis

#33

Post by Lazare »

Any rational system needs to be able to: 1) Identify someone and 2) Authenticate someone. A moment's thought will suggest that the mechanism used to identify someone has different and at least somewhat conflicting goals to what the mechanism used to authenticate someone has, and these must be different systems.

For example: The identification token should be shareable, globally unique, and probably mostly immutable. The authentication token should be secret, not globally unique, and resettable if compromised.

The US system currently tries to use SSNs as both a means of identity and authentication: Telling someone your SSN both tells them who you are, and proves that you really are that person. Obviously, this can't work.

Either we need an actual unique ID number, and then we treat SSNs as a secret password, OR we need to treat SSNs as non-secret usernames, and add some form of actual authentication. Either will work I suppose, although the second seems more practical.

Re: The Equifax Breach Exposes America's Identity Crisis

#34

Post by jacquesm »

Lazare wrote: post #33

Any rational system needs to be able to: 1) Identify someone and 2) Authenticate someone. A moment's thought will suggest that the mechanism used to identify someone has different and at least somewhat conflicting goals to what the mechanism used to authenticate someone has, and these must be different systems. For example: The identification token should be shareable, globally unique, and probably mostly immutable.…

The only option is the second because SSNs are already widely distributed so have lost their use for authentication.

Re: The Equifax Breach Exposes America's Identity Crisis

#35

Post by harryh »

fit2rule wrote: post #18

I lived in the USA for long enough to get a SSN and a credit rating, but I left some time ago. I've now discovered that my details are in this leak. Does anyone have any advice for how a non-US citizen, not currently living in the USA, can secure their data and ensure that its not being used nefariously? I.e. is there a way to permanently retire a SSN and credit rating, remotely (which doesn't involve dying, lol)?

You can "freeze" your credit with each of the 3 rating agencies (Equifax, Experian, TransUnion) which will prevent anyone (including yourself) from applying for credit using your information.

Re: The Equifax Breach Exposes America's Identity Crisis

#36

Post by mcherm »

We HAVE a set of laws and regulations mandating that SSN numbers be kept secret. It doesn't work. We have laws restricting the use of SSNs (it is illegal for most situations to demand an SSN, except for the situations where it is mandatory). They don't work either.

There is, however, one simple solution. Inform banks and others who need to verify identity that they may not use knowledge-of-someone's-SSN as a means of verifying identity. After a brief adjustment period for them to change their processes, publish a public list of every citizen's SSN. (Note: the Equifax breach already did half the job here... so that part isn't hard.)

There is no problem with having SSN numbers, and we MUST have something of the sort if the government intends to keep track of its citizens. There is no problem with SSN numbers being public, and history has demonstrated that it is impossible to design a system that successfully keeps them secret. The only problem lies in the fact that we treat knowledge of this number as some kind of proof of identity.

Re: The Equifax Breach Exposes America's Identity Crisis

#37

Post by gaius »

codeulike wrote: post #16

I never realised till now that American's SSNs were supposed to be kept secret. That's absolutely ridiculous. The idea of trying to keep the UK equivalent (National Insurance Number) secret is laughable. How can anything function when an important id number is also supposed to be known by very few people?

One thing I've never really understood is that as well as an NI number we also have NHS numbers. Why aren't they the same thing?!

Re: The Equifax Breach Exposes America's Identity Crisis

#38

Post by Haul4ss »

Something non-US folks don't always get about the US -- in a lot of ways, the US is more analogous to the EU than it is to any one country of Europe. That is to say, the US Government is the national entity, but quite a lot of power is still held in the states. There is a 200+ year wariness of federal power here.

One of the ways this manifests itself is that identity is established and maintained largely by the states. Your driver's license is basically your national ID here, even though there are 50 different kinds of driver's licenses.

In the 1930s we had Great Depression, New Deal, etc. and Social Security. Once Social Security Numbers became a thing, they became wildly popular as a stand-in for a national identifier. And now they're crucial, and they get stolen all the time, and we have nothing better to replace them with.

National IDs are a nonstarter politically in the US. One side thinks it is undue encroachment on local rights, and the other side thinks requiring ID disenfranchises the poor and undocumented. That's the tl;dr version of course -- reality is more nuanced.

Re: The Equifax Breach Exposes America's Identity Crisis

#39

Post by gaius »

thesumofall wrote: post #4

Coming from another country I really have difficulties understanding why e.g., utilities would want to have your SSN. What do they get that they otherwise won’t get? Isn’t a validated address and a credit card number enough for them? What is the scenario that they try to protect against? That someone misses his 30 USD utility payment and has a CC that is not covered? That seems like a rather weak argument

I really have difficulties understanding why e.g., utilities would want to have your SSN. What do they get that they otherwise won’t get?

I suspect they need to unambiguously identify all customers/payments under anti money laundering regulations. Unintended consequences and all that.

Re: The Equifax Breach Exposes America's Identity Crisis

#40

Post by imdsm »

Haul4ss wrote: post #38

Something non-US folks don't always get about the US -- in a lot of ways, the US is more analogous to the EU than it is to any one country of Europe. That is to say, the US Government is the national entity, but quite a lot of power is still held in the states. There is a 200+ year wariness of federal power here. One of the ways this manifests itself is that identity is established and maintained largely by the state…

> in a lot of ways, the US is more analogous to the EU than it is to any one country of Europe

Interestingly, this is because the EU was modelled after the USA, though things didn't quite go according to plan so we have the EU instead of the USE.

Regardless of political standing, I do recommend https://www.amazon.co.uk/Great-Deception-European-survive-Re... for an in-depth history of the EU.

Post reply on HN