How could Stripe Atlas even require SSNs? Wasn't the whole point of that service giving access to the U.S. market for people from other countries?
It could be used equally by US-based founders.
Stripe Atlas Vendor Leaked SSNs
51–60 of 64 posts
Re: Stripe Atlas Vendor Leaked SSNs
#52Earlier quoted context omitted.
As a Stripe Atlas customer, I received a snail mail letter from Stripe about this issue. It included some suggestions from them to prevent identity theft. As I texted a tech friend of mine: if I’m receiving a physical letter from a leading tech co like Stripe, then it’s at least a moderately serious issue.
Google sends Google adwords ads with physical letters in Germany at least.
I've received similar solicitations in the US.
Re: Stripe Atlas Vendor Leaked SSNs
#53Why was Stripe sharing something as critical as [SSN+Name] with a third party? If Atlas is simply a white labeled service of another service, then I hope it was prominent in Stripe's communication with customers/potential-customers. I say this because the market has many competitive offerings in the space, and among the primary reasons to pick Stripe is the assumption of better security, given it's multi billion dollar venture funding and valuation
Re: Stripe Atlas Vendor Leaked SSNs
#54I agree with https://twitter.com/constmontague/status/1213309357204688899 "... we need a new personal identifier, SSNs are all stolen at this point" Though identity and authentication should be different things, as an identifier the only real problem with SSNs is that we should be using UUIDs instead. The hard part is authentication, which should have a far more secure process than merely knowing 9 digits everyone (r…
UUIDs are a terrible idea, as you're completely ignoring the UX of SSNs (short, just numbers, easy to remember, structured, etc.)
SSNs are account numbers, and only account numbers, for your social security benefits, not an all-purpose resident identity number. they've only been co-opted to be such identifiers because everyone wants to piggyback on, and not additionally pay for, the extra measures the SSA has taken to uniquely identify workers when granting the numbers so we can't easily steal each others' retirement benefits.
tl;dr: SSNs are (financial) account numbers, not people identifiers, and should be treated like bank account numbers (for example).
Re: Stripe Atlas Vendor Leaked SSNs
#55Strange to not see an official statement and post Mortem from Stripe mentioned anywhere. Can someone who got a letter post a (redacted as necessary) scan of it?
For whatever reason there seems to be a semi-official version hosted by Vermont: https://ago.vermont.gov/blog/2019/12/31/stripe-legalinc-noti...
IIRC, some states have laws requiring all data breaches to be reported to the state. I know WA has one, apparently Vermont does too.
Re: Stripe Atlas Vendor Leaked SSNs
#56I agree with https://twitter.com/constmontague/status/1213309357204688899 "... we need a new personal identifier, SSNs are all stolen at this point" Though identity and authentication should be different things, as an identifier the only real problem with SSNs is that we should be using UUIDs instead. The hard part is authentication, which should have a far more secure process than merely knowing 9 digits everyone (r…
SSNs are much too short, and were mostly issued in a foolish and predictable way (if you're a kid you might have a random SSN but most Americans still have ones issued the old way). Given the US plausible population load, issuing a randomly chosen 12 digit number incorporating a check digit would have been a better start. But the authentication problem is the tricky part though, governments don't have a reliable way…
> governments don't have a reliable way to authenticate their citizens today
Yours might not but mine (Norway) seems to work quite well.
Re: Stripe Atlas Vendor Leaked SSNs
#57Is this relevant to LLC formation only or also c corps?
Unfortunately, C Corps are affected, too. I created a C Corp through Atlas and was hoping that I dodged this issue, but I just received the notification of the breach in the mail today.
Re: Stripe Atlas Vendor Leaked SSNs
#58I agree with https://twitter.com/constmontague/status/1213309357204688899 "... we need a new personal identifier, SSNs are all stolen at this point" Though identity and authentication should be different things, as an identifier the only real problem with SSNs is that we should be using UUIDs instead. The hard part is authentication, which should have a far more secure process than merely knowing 9 digits everyone (r…
This will never happen in a useful fashion at the federal level unless the Republicans get the house, Senate, and Presidency again and don't waste the time bickering with themselves. It would have to be implemented on a state by state basis. A national identifier would be able to exclude illegal immigrants too easily for the Democrats to support it. Over 1/3 illegal immigrants in America use ssn's of other people, most stolen but some belonging to friends or relatives. I realize this might seem inflammatory as a post but this simply isn't a situation that can be removed from American politics in this instance.
Edit: And for people who think I'm making this up, the GAO literally inquired with the IRS about the fraudent ssn use matter.
Edit 2: Lots of metric input but no comments. If you're browsing idly, let this be an example of HN culture for you.
Re: Stripe Atlas Vendor Leaked SSNs
#59I agree with https://twitter.com/constmontague/status/1213309357204688899 "... we need a new personal identifier, SSNs are all stolen at this point" Though identity and authentication should be different things, as an identifier the only real problem with SSNs is that we should be using UUIDs instead. The hard part is authentication, which should have a far more secure process than merely knowing 9 digits everyone (r…
I think we need a worldwide, federated identity system. There should be multiple identity providers, mostly governments and organizations who already have lots of info about you, for example banks. This already works in Poland and several other european countries. Such organizations should verify that you are you the way they currently do, and give you a way of authorizing yourself, i.e. sms, mobile app, one time pas…
Trying to control data by by format restrictions seems a little iffy.
If you offered a "isOver18" call to avoid exposing an actual age or date of birth record, you'd have to offer a whole range of others for a lot of legitimate needs (isOver21 for alcohol sales, isOver59.5 for some retirement account stuff, isOver55/60/65 for senior discounts, etc).
You could chain a bunch of those to at least pull a marketing-sufficient age category, and potentially a full age or DOB depending the number of such functions offered.'
If the identity providers asked users each time for consent a verification request cane in, that could limit that abuse pattern, but I suspect it would be the sort of thing where users got notification fatigue very fast and just start clicking "don't ask me again".
Re: Stripe Atlas Vendor Leaked SSNs
#60If anyone needs a Stripe Atlas alternative that doesn't require SSN and also less expensive ($350 vs Stripes $500 + $400/yr) check out https://www.blook.io/stripe-atlas-alternative