Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Equifax Breach Exposes America's Identity Crisis

wired.com

Post reply on HN
Print view View original

51–60 of 132 posts

Re: The Equifax Breach Exposes America's Identity Crisis

#51

Post by bonzini »

slau wrote: post #27
jaclaz wrote: post #21

Earlier quoted context omitted.

I believe that all EU has a similar approach, it is just the US that misuse the SSN. The way it is done in Italy (it is called "Codice Fiscale") it is composed through a public algorithm from name, surname, place and date of birth with a final "control" character (derived by the preceding characters) so - with the exception of the very few cases of total homonimy - it can be recreated "on the spot". Nowadays it is ho…

Thanks for the great content and information. Just a minor nitpick: your identity can't be authenticated. You, as an individual, can be identified, but the only thing that can be authenticated is the piece of plastic (ensuring it is not counterfeit). I wrote down an analogy for the different lingo some months ago: https://news.ycombinator.com/item?id=13635820

That's why the piece of plastic is only used together with an ID card, driver's license or passport---the plastic has a smartcard but no photo, so the two complement each other.

Alternatively the smartcard can be used as a second factor together with a password but, as you correctly pointed out, it is not enough alone.

Re: The Equifax Breach Exposes America's Identity Crisis

#52

Post by codeulike »

arianvanp wrote: post #46
edent wrote: post #44

Earlier quoted context omitted.

It's a form of decentralisation. Your doctor doesn't need to know your tax details. The tax inspector doesn't need to know your medical history.

So it _is_ used as a secret then? I'm confused.

It's about as secret as your phone number I suppose. I.e. you probably won't write it on the side of your house but you will give it to lots of people.

The NHS having their own number is also to do with the NHS treating people who don't have NI numbers, and various historical reasons, eg the NHS started in the 1950s and I expect it was easier to just start a new number system than persuade the treasury to wheelbarrow over all the paper.

Re: The Equifax Breach Exposes America's Identity Crisis

#53

Post by dboreham »

tannhaeuser wrote: post #49

I don't know. I found the argument convincing that even naming the breach "identity theft" is beginning to push responsibility away from Equifax and make it seem a personal problem of those affected, or a general societal phenomenon. When in reality it's just Equifax's poor security practices. As you probably know, the exploit basically is using Java's ability to dynamically execute code from JVM bytecodes (supplied…

Ability to execute data as code is present in many languages. Almost all of them these days. I think you are saying that banks should only use C or C++ ??

Re: The Equifax Breach Exposes America's Identity Crisis

#54

Post by bga »

tim333 wrote: post #32
nmstoker wrote: post #29

The article goes a bit off the rails at the end, with all the focus on using a changeable identifier ("And if this new identifier were easy enough to change (unlike SSNs), breaches, leaks, and other unintended exposures would be less consequential.") There's no reason not to keep SSN as an identifier. Just the same as I wouldn't change my name if I suffered identity theft. Instead there needs to be authentication (eg…

The government could bring in an auth service adding a password to your SSN. Problem solved. Kinda.

or a digital signature, or a MAC. Something where we could verify against a publicly-known value safely, and without giving that secret part away to anyone else. The secret would be between the Federal Government and the citizen.

Re: The Equifax Breach Exposes America's Identity Crisis

#55

Post by afarrell »

arjie wrote: post #50
raarts wrote: post #17

Earlier quoted context omitted.

The same holds for bank account numbers which seems just as ridiculous to us Europeans.

Bank account numbers are on cheques. How would anyone keep them secret? By never using cheques?

I moved from the US to the UK last year. I have seen two paper cheques in that time.

It is much more common over here to pay electronically, though both Direct Debit (receiver pull) and Standing Orders (payer push) require one person giving their bank details to someone.

Re: The Equifax Breach Exposes America's Identity Crisis

#56

Post by tannhaeuser »

dboreham wrote: post #53
tannhaeuser wrote: post #49

I don't know. I found the argument convincing that even naming the breach "identity theft" is beginning to push responsibility away from Equifax and make it seem a personal problem of those affected, or a general societal phenomenon. When in reality it's just Equifax's poor security practices. As you probably know, the exploit basically is using Java's ability to dynamically execute code from JVM bytecodes (supplied…

Ability to execute data as code is present in many languages. Almost all of them these days. I think you are saying that banks should only use C or C++ ??

Or use other statically compiled languages instead.

Or at least use Java or O/S sandboxing features.

At least in the web-facing parts of their apps.

In any case, this requires some planning ahead, and a mindset different from "agile".

Maybe Java 9's AOT compilation can help in the process, but even if it could produce stand-alone programs, I think the dynamisms in Java code (reflection, annotations, dynamic class loaders) will make this infeasible for most code bases.

Re: The Equifax Breach Exposes America's Identity Crisis

#57

Post by wschroed »

dboreham wrote: post #53
tannhaeuser wrote: post #49

I don't know. I found the argument convincing that even naming the breach "identity theft" is beginning to push responsibility away from Equifax and make it seem a personal problem of those affected, or a general societal phenomenon. When in reality it's just Equifax's poor security practices. As you probably know, the exploit basically is using Java's ability to dynamically execute code from JVM bytecodes (supplied…

Ability to execute data as code is present in many languages. Almost all of them these days. I think you are saying that banks should only use C or C++ ??

He is saying they should practice process isolation. Example architecture: https://cr.yp.to/qmail/guarantee.html

Re: The Equifax Breach Exposes America's Identity Crisis

#58

Post by usr1106 »

jaclaz wrote: post #21
Kiro wrote: post #3

In Sweden your SSN is public information. I posted the same comment on another Equifax thread and got some pretty interesting replies relevant to this discussion: https://news.ycombinator.com/item?id=15208223

I believe that all EU has a similar approach, it is just the US that misuse the SSN. The way it is done in Italy (it is called "Codice Fiscale") it is composed through a public algorithm from name, surname, place and date of birth with a final "control" character (derived by the preceding characters) so - with the exception of the very few cases of total homonimy - it can be recreated "on the spot". Nowadays it is ho…

> I believe that all EU has a similar approach

Not at all. At least Finland and Sweden do have a social security number assigned at birth (or immigration). They can be seen as a primary key in many contexts, not only when dealing with social security or the public sector. I guess there could be more such countries. In Finland the official recommendation these days is that you should be very cautious with your social security number, because it allows identity theft. But that is a bit ridiculous recommendation, because there are many cases where you have to give your social security number. Persons appearing to be 29 our younger need to show an ID when buying alcohol. So they show their social security number to every supermarket cashier. It would be illegal for the cashier to write them down and collect them, but easy to do for someone who trains a bit to memorize a birthdate plus 4 digits for a minute or 2. Nearly impossible to track.

In Germany on the other side having such universal primary key (a personal identifier) is deemed unconstitutional. Those who have been employed have a social security number, but it's not used for any other purpose than pensions. Probably most health insurances assign a number to the insured person, but it is meaningless outside of that insurer. A life-long tax number was only introduced a couple of years ago. It was quite much criticized by privacy activists that it is too close to a forbidden person identifier. Person identifiers existed in GDR (former East), but their usage was forbidden by law after re-unification (except in some cases where facts of the past need to be tracked).

Re: The Equifax Breach Exposes America's Identity Crisis

#59

Post by Simon_says »

bga wrote: post #54
tim333 wrote: post #32

Earlier quoted context omitted.

The government could bring in an auth service adding a password to your SSN. Problem solved. Kinda.

or a digital signature, or a MAC. Something where we could verify against a publicly-known value safely, and without giving that secret part away to anyone else. The secret would be between the Federal Government and the citizen.

Why should the government have it at all? Just let private citizens manage their own private key.

Re: The Equifax Breach Exposes America's Identity Crisis

#60

Post by bpicolo »

codeulike wrote: post #16

I never realised till now that American's SSNs were supposed to be kept secret. That's absolutely ridiculous. The idea of trying to keep the UK equivalent (National Insurance Number) secret is laughable. How can anything function when an important id number is also supposed to be known by very few people?

> were supposed to be kept secret

It's especially laughable because you have to give it to -everybody-. Phone service, cable service, schools, employers, etc etc etc.

Post reply on HN