Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

T-Mobile: Breach Exposed SSN/DOB of 40M+ People

krebsonsecurity.com

Post reply on HN
Print view View original

161–170 of 282 posts

Re: T-Mobile: Breach Exposed SSN/DOB of 40M+ People

#161

Post by jandrewrogers »

adzm wrote: post #142
jandrewrogers wrote: post #131

Earlier quoted context omitted.

It is illegal for the US government to create a mandatory national identity system or coerce the States into creating one. The limits of this have been pretty thoroughly tested in the US Supreme Court. Every time things like this come up, everyone asks why don't we just thing that looks like a national identity system to fix the issue, as if that never occurred to anyone in Congress. This is why: it violates the Cons…

Things like the Real ID Act seem to be as close as we can get without constitutional changes. Something like the above could potentially be implemented like that, but still would not be as widespread as an SSN.

The Real ID Act has not been tested in court yet because it has not gone into effect, having been delayed a decade now. As soon as it goes into effect, lawsuits will immediately drop on several grounds. Furthermore, many States have declined to implement the part of the Act that requires them to share their identity databases with the Federal government, only complying with the "identity standards" part.

Prior Supreme Court cases have ruled that the Federal government cannot coerce the States, e.g. via taxation or regulatory authority, to do something for the Federal government that the Federal government is prohibited from doing itself. Without the voluntary compliance of the States, which is like herding cats, with respect to creating a national identity database, the net effect of Real ID will basically be more standardized State IDs.

Re: T-Mobile: Breach Exposed SSN/DOB of 40M+ People

#162

Post by dharmab »

the-dude wrote: post #126
rank0 wrote: post #81

Earlier quoted context omitted.

This is just nonsense. Where are you coming up with this theory? Everyone has an ssn already wouldn’t that qualify for the mark?

Are SSN's assigned at birth?

They were not originally, but now they are. There is an interesting case of a Texas woman who was born "off-radar" to libertarian parents and had no government documentation of her existence. This caused major problems with access to services and employment in her adult life until a senator intervened and introduced legislation for the situation.

SSNs are not universal, either. There are some unions and religious groups that have legal exemptions.

Re: T-Mobile: Breach Exposed SSN/DOB of 40M+ People

#163

Post by renewiltord »

jandrewrogers wrote: post #131
iknowstuff wrote: post #36

The EU has a federated public key cryptography based identity system. The member states recognize identities issued by other member states, but there is no central system. In any case, the private key is stored on a plastic ID, which acts as a smart card and can be hooked up to a smartphone/PC for identity verification and document signing online. The key is only released with a PIN, and the databases online only sto…

It is illegal for the US government to create a mandatory national identity system or coerce the States into creating one. The limits of this have been pretty thoroughly tested in the US Supreme Court. Every time things like this come up, everyone asks why don't we just thing that looks like a national identity system to fix the issue, as if that never occurred to anyone in Congress. This is why: it violates the Cons…

Well, we could just make it just as mandatory as the social security system. And since the SSN is constitutional, so can this private/public pair system.

Re: T-Mobile: Breach Exposed SSN/DOB of 40M+ People

#164

Post by iknowstuff »

jandrewrogers wrote: post #131
iknowstuff wrote: post #36

The EU has a federated public key cryptography based identity system. The member states recognize identities issued by other member states, but there is no central system. In any case, the private key is stored on a plastic ID, which acts as a smart card and can be hooked up to a smartphone/PC for identity verification and document signing online. The key is only released with a PIN, and the databases online only sto…

It is illegal for the US government to create a mandatory national identity system or coerce the States into creating one. The limits of this have been pretty thoroughly tested in the US Supreme Court. Every time things like this come up, everyone asks why don't we just thing that looks like a national identity system to fix the issue, as if that never occurred to anyone in Congress. This is why: it violates the Cons…

Thanks for bringing that up. Denmark, an EU member state, does not have ID cards, so it's not exactly mandatory over there.

Seems weird that a SSN is not considered a national identity system? What if the federal government sunset SSNs after a bunch of big states implemented an equivalent of EIDAS on their own volition?

Re: T-Mobile: Breach Exposed SSN/DOB of 40M+ People

#165

Post by dragonwriter »

jandrewrogers wrote: post #131
iknowstuff wrote: post #36

The EU has a federated public key cryptography based identity system. The member states recognize identities issued by other member states, but there is no central system. In any case, the private key is stored on a plastic ID, which acts as a smart card and can be hooked up to a smartphone/PC for identity verification and document signing online. The key is only released with a PIN, and the databases online only sto…

It is illegal for the US government to create a mandatory national identity system or coerce the States into creating one. The limits of this have been pretty thoroughly tested in the US Supreme Court. Every time things like this come up, everyone asks why don't we just thing that looks like a national identity system to fix the issue, as if that never occurred to anyone in Congress. This is why: it violates the Cons…

> It is illegal for the US government to create a mandatory national identity system or coerce the States into creating one. The limits of this have been pretty thoroughly tested in the US Supreme Court.

No, they haven't. There are people who have speculated that it is illegal since the idea started being discussed (serious discussions are actually fairly new, mostly a burst in the late-1990s and another one shortly after 9/11, though speculative strawman negative arguments go back a bit further, at least to discussions around HIPAA in the mid-1990s.) Those speculations have extrapolated from cases that are quite distant from a national ID (e.g., weirdly, critics of the idea have suggested a national ID would violate the protection of the eight to anonymous political speech found in the first amendment under McIntyre v. Ohio Elections Commission (1995), which aside from the WTF of what a national ID even has to do with that right, is clearly false because the First Amendment applies to the states under the 14th Amendment, so if somehow the creation of a federal ID would violate a First Amendment right, the creation of a state ID would equally violate the application of that right under the 14th. In fact, we have federal (directly issued or state-issued under federal regulations) ID cards required for certain federally regulated purposes, notably:

(1) Passports (or, for certain cases, state-issued under federal rules Enhanced Driver's Licenses) for border crossing;

(2) Passports, state-issued ID’s meeting federal Real ID standards, or certain other federal or federally-regulated IDs for air travel and access to federal facilities.

There are usage or production requirements that government might adopt for ID that violate Constitutional protections that have been firmly articulated by the courts, but those generally apply to state and federal ID equally.

Re: T-Mobile: Breach Exposed SSN/DOB of 40M+ People

#166

Post by Bhilai »

dotcommand wrote: post #135
LeifCarrotson wrote: post #73

No, the US has far more religious fundamentalists than the EU. They believe that such a system is tantamount to taking the Mark of the Beast, quoting Revelation 13:16-17: > And he causes all, the small and the great, and the rich and the poor, and the free men and the slaves, to be given a mark on their right hand or on their forehead, and he provides that no one will be able to buy or to sell, except the one who has…

Or, we just have a natural/historical aversion to centralized power. Much of the nation initially started out believing that power should be local. Or you can simply make up nonsense about 'mark of the beast'. It's crazy how a nation of "religious fundamentalists" created the modern world. Crazy how "religious fundamentalists" created the wealthiest nation. There has always been a backlash against centralized/federal…

> Or, we just have a natural/historical aversion to centralized power.

And yet support a sprawling state government machinery almost as powerful as the central/federal government so much so that states can dictate terms and laws they want and "local" cities and counties have to abide by it.

Re: T-Mobile: Breach Exposed SSN/DOB of 40M+ People

#168

Post by casefields »

lostcolony wrote: post #160
jandrewrogers wrote: post #131

Earlier quoted context omitted.

It is illegal for the US government to create a mandatory national identity system or coerce the States into creating one. The limits of this have been pretty thoroughly tested in the US Supreme Court. Every time things like this come up, everyone asks why don't we just thing that looks like a national identity system to fix the issue, as if that never occurred to anyone in Congress. This is why: it violates the Cons…

Citation needed. "It's against the constitution" - where? Cite an article, quote a paragraph, something. You say the Supreme Court has decided this; fine, quote a court case. I'm not saying you're wrong, but I have no idea what you're talking about. We have plenty of de facto ID systems. But I'd argue they aren't mandatory because -there is no political will to make them mandatory-. What is achieved by doing so? Hell…

Voting is not a constitutional right.

Voting Rights Act is statutory like most of our laws.

Re: T-Mobile: Breach Exposed SSN/DOB of 40M+ People

#169

Post by dharmab »

swiley wrote: post #148
Retric wrote: post #122

Earlier quoted context omitted.

How is this worse than a SSN?

SSN should not be used for ID.

Specifically SSNs have none of the security features of an ID. No biometric info or photo, numbers used to be assigned in sequence, only a few of the digits are unique, no parity/checksum check bits.

Re: T-Mobile: Breach Exposed SSN/DOB of 40M+ People

#170

Post by toast0 »

the-dude wrote: post #126
rank0 wrote: post #81

Earlier quoted context omitted.

This is just nonsense. Where are you coming up with this theory? Everyone has an ssn already wouldn’t that qualify for the mark?

Are SSN's assigned at birth?

Not exclusively, but Enumeration at Birth is pushed hard and I saw a stat that I believe said 99% of infants were enumerated at birth (it may have said that 99% of enumerated infants were enumerated at birth, however). This process began in 1987.

Since you need a SSN for a child to get the tax benefits of a child (as of 1986), and most parents will want those, it's an easy sell to get a SSN while processing the rest of the birth paperwork, rather than doing it later. I was born before 1986 and I believe my parents applied for SSNs for me and my siblings around then because it was needed for tax purposes.

Post reply on HN