I never realised till now that American's SSNs were supposed to be kept secret. That's absolutely ridiculous. The idea of trying to keep the UK equivalent (National Insurance Number) secret is laughable. How can anything function when an important id number is also supposed to be known by very few people?
One thing I've never really understood is that as well as an NI number we also have NHS numbers. Why aren't they the same thing?!
The Equifax Breach Exposes America's Identity Crisis
61–70 of 132 posts
Re: The Equifax Breach Exposes America's Identity Crisis
#62Earlier quoted context omitted.
It's a form of decentralisation. Your doctor doesn't need to know your tax details. The tax inspector doesn't need to know your medical history.
So it _is_ used as a secret then? I'm confused.
Re: The Equifax Breach Exposes America's Identity Crisis
#63I don't know. I found the argument convincing that even naming the breach "identity theft" is beginning to push responsibility away from Equifax and make it seem a personal problem of those affected, or a general societal phenomenon. When in reality it's just Equifax's poor security practices. As you probably know, the exploit basically is using Java's ability to dynamically execute code from JVM bytecodes (supplied…
Ability to execute data as code is present in many languages. Almost all of them these days. I think you are saying that banks should only use C or C++ ??
Obvs, you should do this on every box that accepts connections from the outside world.
Obvs, it's no easier to get people to do this in practice than it is to get people to quit using string formatting to get parameters into their SQL queries.
Re: The Equifax Breach Exposes America's Identity Crisis
#64I never realised till now that American's SSNs were supposed to be kept secret. That's absolutely ridiculous. The idea of trying to keep the UK equivalent (National Insurance Number) secret is laughable. How can anything function when an important id number is also supposed to be known by very few people?
Greater legibility, management, and taxation are values not shared by a very sizable section of the US citizenry. Without digressing into a pointless and stupid flamewar over Humean oughts around these points of fact, we can acknowledge that every attempt thus far to implement a national ID scheme has been, and no doubt any future such attempt will be, energetically and, thus far at least, very effectively countered by those who so strongly prefer that no national ID scheme exist. Unfortunately, the US federal bureaucracy being what it is, we will have a national ID scheme whether well-designed as such or otherwise, and the wide adoption of Social Security and (generally) 1:1 mapping between SSNs and citizens made it the obvious candidate for a de facto national ID. Businesses followed government in adopting it as such.
Now, instead of a proper, admitted national identification scheme which would at least have a chance of being marginally secure, we have a motley collection of the world's most hilariously shitty zero-factor authentication methods, making a wide variety of frauds so trivially simple to perform that we've had to spin them off into a new category of their own, "identity theft", which we regard as just one of those unfortunate things that happens sometimes, like cancer. Even after the Equifax breach, it'll probably still be cheaper to continue looking at the problem this way than to roll back the eight decades of technical debt that have gone into creating it. So it goes.
Re: The Equifax Breach Exposes America's Identity Crisis
#65Earlier quoted context omitted.
The same holds for bank account numbers which seems just as ridiculous to us Europeans.
Bank account numbers are on cheques. How would anyone keep them secret? By never using cheques?
Re: The Equifax Breach Exposes America's Identity Crisis
#66Earlier quoted context omitted.
Bank account numbers are on cheques. How would anyone keep them secret? By never using cheques?
I moved from the US to the UK last year. I have seen two paper cheques in that time. It is much more common over here to pay electronically, though both Direct Debit (receiver pull) and Standing Orders (payer push) require one person giving their bank details to someone.
Re: The Equifax Breach Exposes America's Identity Crisis
#67I don't know. I found the argument convincing that even naming the breach "identity theft" is beginning to push responsibility away from Equifax and make it seem a personal problem of those affected, or a general societal phenomenon. When in reality it's just Equifax's poor security practices. As you probably know, the exploit basically is using Java's ability to dynamically execute code from JVM bytecodes (supplied…
Ability to execute data as code is present in many languages. Almost all of them these days. I think you are saying that banks should only use C or C++ ??
Re: The Equifax Breach Exposes America's Identity Crisis
#68I don't know. I found the argument convincing that even naming the breach "identity theft" is beginning to push responsibility away from Equifax and make it seem a personal problem of those affected, or a general societal phenomenon. When in reality it's just Equifax's poor security practices. As you probably know, the exploit basically is using Java's ability to dynamically execute code from JVM bytecodes (supplied…
Ability to execute data as code is present in many languages. Almost all of them these days. I think you are saying that banks should only use C or C++ ??
Re: The Equifax Breach Exposes America's Identity Crisis
#69The article goes a bit off the rails at the end, with all the focus on using a changeable identifier ("And if this new identifier were easy enough to change (unlike SSNs), breaches, leaks, and other unintended exposures would be less consequential.") There's no reason not to keep SSN as an identifier. Just the same as I wouldn't change my name if I suffered identity theft. Instead there needs to be authentication (eg…
Re: The Equifax Breach Exposes America's Identity Crisis
#70Earlier quoted context omitted.
There are legitimate use cases where collecting and storing (in some manner at least) is necessary. You cannot just stop companies from collecting information, and furthermore stop them from storing any of it. Thats just naive.
The private university I went to used to issue student emails that were first three letters of last name followed by last four digits of social security number. It always seemed odd to me. Years later, they've switched and we don't have that problem any more. Companies can generate a unique identifier without using SSN. Of course, the main problem is that they can't do authentication based on that identifier. So why…