Live data from Hacker News

The Equifax Breach Exposes America's Identity Crisis

wired.com

61–70 of 132 posts

Re: The Equifax Breach Exposes America's Identity Crisis

#61
post #37

I never realised till now that American's SSNs were supposed to be kept secret. That's absolutely ridiculous. The idea of trying to keep the UK equivalent (National Insurance Number) secret is laughable. How can anything function when an important id number is also supposed to be known by very few people?

One thing I've never really understood is that as well as an NI number we also have NHS numbers. Why aren't they the same thing?!

Because not everyone needs NHS numbers, and not everyone needs NI numbers, and neither is a subset of the other

Re: The Equifax Breach Exposes America's Identity Crisis

#62
post #44

Earlier quoted context omitted.

It's a form of decentralisation. Your doctor doesn't need to know your tax details. The tax inspector doesn't need to know your medical history.

So it _is_ used as a secret then? I'm confused.

NHS numbers are typically more secret than NI numbers (though they needn't be necessarily) and many people don't know their NHS number at all

Re: The Equifax Breach Exposes America's Identity Crisis

#63

I don't know. I found the argument convincing that even naming the breach "identity theft" is beginning to push responsibility away from Equifax and make it seem a personal problem of those affected, or a general societal phenomenon. When in reality it's just Equifax's poor security practices. As you probably know, the exploit basically is using Java's ability to dynamically execute code from JVM bytecodes (supplied…

Ability to execute data as code is present in many languages. Almost all of them these days. I think you are saying that banks should only use C or C++ ??

I don't know Java well, but at least in .NET it's possible to set a flag that disable execution of dynamically emitted code.

Obvs, you should do this on every box that accepts connections from the outside world.

Obvs, it's no easier to get people to do this in practice than it is to get people to quit using string formatting to get parameters into their SQL queries.

Re: The Equifax Breach Exposes America's Identity Crisis

#64

I never realised till now that American's SSNs were supposed to be kept secret. That's absolutely ridiculous. The idea of trying to keep the UK equivalent (National Insurance Number) secret is laughable. How can anything function when an important id number is also supposed to be known by very few people?

The scheme was designed in 1935 as a way of identifying people enrolled in the then-new Social Security program (hence the name), and was gradually made a de facto national ID number over the intervening decades as the increasing scale of national population and economic activity prompted a desire for greater legibility to facilitate management and taxation.

Greater legibility, management, and taxation are values not shared by a very sizable section of the US citizenry. Without digressing into a pointless and stupid flamewar over Humean oughts around these points of fact, we can acknowledge that every attempt thus far to implement a national ID scheme has been, and no doubt any future such attempt will be, energetically and, thus far at least, very effectively countered by those who so strongly prefer that no national ID scheme exist. Unfortunately, the US federal bureaucracy being what it is, we will have a national ID scheme whether well-designed as such or otherwise, and the wide adoption of Social Security and (generally) 1:1 mapping between SSNs and citizens made it the obvious candidate for a de facto national ID. Businesses followed government in adopting it as such.

Now, instead of a proper, admitted national identification scheme which would at least have a chance of being marginally secure, we have a motley collection of the world's most hilariously shitty zero-factor authentication methods, making a wide variety of frauds so trivially simple to perform that we've had to spin them off into a new category of their own, "identity theft", which we regard as just one of those unfortunate things that happens sometimes, like cancer. Even after the Equifax breach, it'll probably still be cheaper to continue looking at the problem this way than to roll back the eight decades of technical debt that have gone into creating it. So it goes.

Re: The Equifax Breach Exposes America's Identity Crisis

#65
post #50
post #17

Earlier quoted context omitted.

The same holds for bank account numbers which seems just as ridiculous to us Europeans.

Bank account numbers are on cheques. How would anyone keep them secret? By never using cheques?

I don't, except among family members. Any payee I don't strongly trust and who won't accept an electronic payment gets a bank check instead - I'd rather pay a few dollars to have one of those made, than save them and risk having my entire account cleaned out through lack of diligence or scruple on the receiving end.

Re: The Equifax Breach Exposes America's Identity Crisis

#66
post #50

Earlier quoted context omitted.

Bank account numbers are on cheques. How would anyone keep them secret? By never using cheques?

I moved from the US to the UK last year. I have seen two paper cheques in that time. It is much more common over here to pay electronically, though both Direct Debit (receiver pull) and Standing Orders (payer push) require one person giving their bank details to someone.

FWIW paper checks are not nearly as popular in the US as they once were. Especially hand written. They are ironically useful as a "secure" form of receiving payment because ACH is such a big gaping security hole. Receiving paper isolates you from handing out an account number.

Re: The Equifax Breach Exposes America's Identity Crisis

#67

I don't know. I found the argument convincing that even naming the breach "identity theft" is beginning to push responsibility away from Equifax and make it seem a personal problem of those affected, or a general societal phenomenon. When in reality it's just Equifax's poor security practices. As you probably know, the exploit basically is using Java's ability to dynamically execute code from JVM bytecodes (supplied…

Ability to execute data as code is present in many languages. Almost all of them these days. I think you are saying that banks should only use C or C++ ??

Buffer overflow

Re: The Equifax Breach Exposes America's Identity Crisis

#68

I don't know. I found the argument convincing that even naming the breach "identity theft" is beginning to push responsibility away from Equifax and make it seem a personal problem of those affected, or a general societal phenomenon. When in reality it's just Equifax's poor security practices. As you probably know, the exploit basically is using Java's ability to dynamically execute code from JVM bytecodes (supplied…

Ability to execute data as code is present in many languages. Almost all of them these days. I think you are saying that banks should only use C or C++ ??

DEP and ASLR provide significant mitigation of the threat posed by this capability in statically-compiled languages, so it is definitely an issue that should be considered, along with others. Having said that, it is unlikely that there is any merely technical solution for the problem, which arises from the whole system being predicated on a falsehood - the assumed confidentiality of SSNs.

Re: The Equifax Breach Exposes America's Identity Crisis

#69

The article goes a bit off the rails at the end, with all the focus on using a changeable identifier ("And if this new identifier were easy enough to change (unlike SSNs), breaches, leaks, and other unintended exposures would be less consequential.") There's no reason not to keep SSN as an identifier. Just the same as I wouldn't change my name if I suffered identity theft. Instead there needs to be authentication (eg…

I agree with you. Switching to another id system will mean we use that instead of SSN and have the same potential issues. I think the biggest problem here is our approach to credit and credit fraud. We need mandatory CC2 online, mandatory 2FA (not SMS!), chip and PIN, our credit should be frozen by default with out of band approval for new credit and credit granted without approval is the lender's responsibility. Steps like these would remove most of our exposure to credit fraud.

Re: The Equifax Breach Exposes America's Identity Crisis

#70
post #14

Earlier quoted context omitted.

There are legitimate use cases where collecting and storing (in some manner at least) is necessary. You cannot just stop companies from collecting information, and furthermore stop them from storing any of it. Thats just naive.

The private university I went to used to issue student emails that were first three letters of last name followed by last four digits of social security number. It always seemed odd to me. Years later, they've switched and we don't have that problem any more. Companies can generate a unique identifier without using SSN. Of course, the main problem is that they can't do authentication based on that identifier. So why…

SSN is the only reliable way to disambiguate duplicate names. Differentiating all the John Smiths by mailing address is too intractable, especially when you have JS Jr. and JS III living together. It is used to construct a primary key for the database.
Post reply on HN