Stripe Atlas Vendor Leaked SSNs

Though identity and authentication should be different things, as an identifier the only real problem with SSNs is that we should be using UUIDs instead.

The hard part is authentication, which should have a far more secure process than merely knowing 9 digits everyone (re)uses.

Re: Stripe Atlas Vendor Leaked SSNs

#5

Post by JBerlinsky » Sat, Jan 04, 2020, 6:06 AM UTC

nedwin wrote: post #2

Why are they notifying folks via mail instead of good old fashioned email? Haven't got a letter yet but would be super easy for me to check my inbox...

Each state has different laws about how people need to be notified about data breaches. U.S. mail is generally the lowest common denominator across states. See https://info.digitalguardian.com/rs/768-OQW-145/images/the-d... for more information if you're curious.

Re: Stripe Atlas Vendor Leaked SSNs

#6

Post by rolltiide » Sat, Jan 04, 2020, 6:13 AM UTC

getting your identity stolen in any way that’ll effect you is all random

they’re all leaked now and people borrow them for things that would never show up on your credit report

hope you don’t get framed! Good luck

Re: Stripe Atlas Vendor Leaked SSNs

#7

Post by loganfrederick » Sat, Jan 04, 2020, 6:19 AM UTC

duxup wrote: post #3

Is there any verification / info other than a tweet?

As a Stripe Atlas customer, I received a snail mail letter from Stripe about this issue. It included some suggestions from them to prevent identity theft.

As I texted a tech friend of mine: if I’m receiving a physical letter from a leading tech co like Stripe, then it’s at least a moderately serious issue.

Re: Stripe Atlas Vendor Leaked SSNs

#8

Post by 3fe9a03ccd14ca5 » Sat, Jan 04, 2020, 6:21 AM UTC

rolltiide wrote: post #6

getting your identity stolen in any way that’ll effect you is all random they’re all leaked now and people borrow them for things that would never show up on your credit report hope you don’t get framed! Good luck

Not me though! Equifax gave me 4 years of credit monitoring! I’m in the safe right? /s

Re: Stripe Atlas Vendor Leaked SSNs

#9

Post by etaioinshrdlu » Sat, Jan 04, 2020, 6:26 AM UTC

Is this relevant to LLC formation only or also c corps?

Re: Stripe Atlas Vendor Leaked SSNs

#10

Post by mjevans » Sat, Jan 04, 2020, 6:27 AM UTC

mjevans wrote: post #4

I agree with https://twitter.com/constmontague/status/1213309357204688899 "... we need a new personal identifier, SSNs are all stolen at this point" Though identity and authentication should be different things, as an identifier the only real problem with SSNs is that we should be using UUIDs instead. The hard part is authentication, which should have a far more secure process than merely knowing 9 digits everyone (r…

Maybe it would be more clear if I used some examples.

Identity: mjevans on news.ycombinator.com

Authentication: is allowed to post as (Identity), is allowed to vote on things, etc.

Identity alone should not imply authorization, when someone is asking for a proof of identity what they really want is a record that you are actually an identity (authorization).