News for hackers. Stuff that matters.
Re:DOJ: Hackers broke into an SEC database and made millions... by wtvanhest on Wednesday January 16, 2019 @11:53AM (#18922419)
IMO, everyone's SSN should be public. Mine has already be compromised by both my undergrad and grad school. At this point, I operate under the assumption that it is public knowledge for bad actors.

Hiding SSNs is false security at best. If they were public, banks would stop hiding behind "identity theft" and would start having to acknowledge that its their responsibility to confirm who they are lending money to.

Re:DOJ: Hackers broke into an SEC database and made millions... by rando444 on Wednesday January 16, 2019 @02:30PM (#18924146)
The problem with identity in the USA has always been a religious problem more than anything else.

All legislation aimed around allowing people to be identified by numbers has been killed due to the whole "mark of the beast" .. "can't buy sell or trade without your number" revelations rhetoric.

As religion has less of an impact on people's daily lives, I expect this to change, but in the past it's been the one thing that's always prevented proper identity management in the USA.

I am curious to know though, if there are other countries that don't identify their citizens with a public id number?

Re:DOJ: Hackers broke into an SEC database and made millions... by toomanybeersies on Thursday January 17, 2019 @02:05AM (#18928941)
Australia doesn't have a national ID number, and neither does New Zealand.

You have a TFN [1] (tax file number) in Australia, which are similar to an SSN, except somewhat more limited. My TFN is only used for income tax, not for identification, and I'm not actually legally required to supply it to anybody, even my employer (although it does make paying taxes a real pain as they withhold the maximum amount). You aren't even legally required to have a TFN, although once you get one you have it for life, and without one you pay the maximum income tax.

TFNs are specifically forbidden to be used for anything other than income or benefit purposes too. Businesses aren't allowed to ask for it as a form of ID.

[1] https://en.wikipedia.org/wiki/Tax_file_number

Re:DOJ: Hackers broke into an SEC database and made millions... by nradov on Wednesday January 16, 2019 @03:39PM (#18924907)
Religious concerns were only a minor factor. Other objections to having a national identifier include: wasteful "big government" spending, encroachment on states' rights, potential for civil liberties abuses, and lack of consensus over whether it's a real problem that needs to be solved.

I don't necessarily agree with those objections but there have been multiple reasons.

Re:DOJ: Hackers broke into an SEC database and made millions... by cheeseomlit on Thursday January 17, 2019 @10:25AM (#18931422)
I'm not a Christian, but those concerns are not without merit. It's a slippery slope to "the only way we can eliminate identity theft is to use biometric authentication via implanted chips to validate financial transactions"
Re:DOJ: Hackers broke into an SEC database and made millions... by darkpuma on Thursday January 17, 2019 @01:56AM (#18928902)
>"All legislation aimed around allowing people to be identified by numbers has been killed due to the whole "mark of the beast" .. "can't buy sell or trade without your number" revelations rhetoric."

This is easy to solve; simply make it illegal to use the identification number so capriciously. Define a narrow use-case for it, narrow enough to allay religious fears, and forbid anything other use if the ID number. Make it illegal to require customers to provide their ID number while making purchases, etc.

But once you do that, most of the desire to implement the system starts to disappear...

Re:DOJ: Hackers broke into an SEC database and made millions... by tetrep on Thursday January 17, 2019 @10:09AM (#18931266)
> This is easy to solve; simply make it illegal to use the identification number so capriciously.

Hmmmmm, that sounds familiar... https://en.wikipedia.org/wiki/Social_Security_number#/media/...

While it wasn't law, I don't see why legislature wouldn't renege on their promise to not use a unique identifier, already conveniently assigned to all people, for identification purposes.

Re:DOJ: Hackers broke into an SEC database and made millions... by darkpuma on Thursday January 17, 2019 @11:28AM (#18932078)
Yes that's what I had in mind. It worked that time too, the general public accepted SSNs.

Maybe it's cynical, but I don't believe there is any limit on how many times you can lie to the public. There's only a limit to the frequency.

Re:DOJ: Hackers broke into an SEC database and made millions... by gknoy on Thursday January 17, 2019 @06:19PM (#18935600)
> a unique identifier, already conveniently assigned to all people, for identification purposes

One problem is that it's not unique. :)

Re:DOJ: Hackers broke into an SEC database and made millions... by TheOperator on Wednesday January 16, 2019 @02:39PM (#18924242)
If its primarily a religious problem why do countries less religious than the US have similar concepts? SINs in Canada, NINs in the UK, etc. etc
Re:DOJ: Hackers broke into an SEC database and made millions... by richardw on Wednesday January 16, 2019 @10:01PM (#18927960)
ID number in South Africa. Assigned at birth, used for opening of any account. Not considered private at all, can be requested by any company who might want to check that you are you. Also: ID card with number, photo and details on it, separate from drivers license.
Re:DOJ: Hackers broke into an SEC database and made millions... by bjelkeman-again on Thursday January 17, 2019 @09:05AM (#18930809)
More or less the same in Sweden.
Re:DOJ: Hackers broke into an SEC database and made millions... by toweringgoat on Wednesday January 16, 2019 @03:28PM (#18924781)
NIN is rarely used in the UK. You need one for student financing... and later for your employer to correctly relay your taxes to HMRC. Certainly it's not needed for banks/credit cards/phones/brokerages/etc.
Re:DOJ: Hackers broke into an SEC database and made millions... by kurtisc on Thursday January 17, 2019 @10:08AM (#18931264)
The last time I opened a bank account in the UK involved me sitting in a bank employee's office with two forms of proof of identity and proof of income. I could have used my birth certificate for one but AFAIK the second would cost money.
Re:DOJ: Hackers broke into an SEC database and made millions... by bobwaycott on Thursday January 17, 2019 @11:11AM (#18931897)
The parent means implementing national IDs provokes religious opposition in the US.
Re:DOJ: Hackers broke into an SEC database and made millions... by aboutruby on Wednesday January 16, 2019 @12:46PM (#18922989)
And yet many services rely on SSN for identity verification in the US (e.g. banks, telecoms, etc.)
Re:DOJ: Hackers broke into an SEC database and made millions... by briffle on Wednesday January 16, 2019 @02:23PM (#18924065)
that is what wtvanhest is talking about. If everyone has your social, its no longer considered a secret (like a password) its more like a unique identifier (an email address) just like it was intended to be.
Re:DOJ: Hackers broke into an SEC database and made millions... by jgust on Wednesday January 16, 2019 @03:50PM (#18925017)
When you think about it that way & then combine it with some type of 2FA, it starts to make a lot of sense.
Re:DOJ: Hackers broke into an SEC database and made millions... by axlee on Wednesday January 16, 2019 @06:44PM (#18926800)
That's how it works in Sweden.
Re:DOJ: Hackers broke into an SEC database and made millions... by anonymfus on Wednesday January 16, 2019 @04:05PM (#18925238)
> its more like a unique identifier

AFAIK they are not ever unique

Re:DOJ: Hackers broke into an SEC database and made millions... by TomVDB on Wednesday January 16, 2019 @04:43PM (#18925665)
Article written in 2014:

> To date, 450+ million SSNs have been issued, but with just under 1 billion possible number combinations, there has never been a need to recycle numbers, and the SSA notes that it does "not reassign a Social Security number (SSN) after the number holder's death."

https://gizmodo.com/what-happens-to-your-social-security-num...

Re:DOJ: Hackers broke into an SEC database and made millions... by ben509 on Wednesday January 16, 2019 @04:47PM (#18925715)
They're not reliably unique: a nontrivial percentage of the population has multiple numbers associated with them, and a nontrivial percentage of the numbers are associated with multiple people.

If you have two systems and you want to correlate data between them, you can use something like the SSN to assist in that process, but usually it will need additional information.

Generally you can't use something someone supplies as a shared identifier. You can't start the process of verifying it, after all, without an identifier. You might think of all sorts of ways around this, but they all boil down to either tolerating errors or making the SSN a secondary attribute rather than a bona fide identifier.

Re:DOJ: Hackers broke into an SEC database and made millions... by aboutruby on Thursday January 17, 2019 @07:00AM (#18930096)
> In the peak year of 1943, 5,755 people were using Hilda's number.

https://www.ssa.gov/history/ssn/misused.html

There are actually lots of dummy SSNs that are used by a lot of people (including illegal workers).

Re:DOJ: Hackers broke into an SEC database and made millions... by gtirloni on Wednesday January 16, 2019 @01:26PM (#18923441)
You mean they rely solely on someone dictating a SSN number? That's insane. They should ask for a official ID with photo, as the very minimum.

Is that something that goes against the American culture? The other day I had to give all 10 fingerprints to renew my driver's license (location: South America) and nobody seemed to care.

Re:DOJ: Hackers broke into an SEC database and made millions... by bobthepanda on Wednesday January 16, 2019 @02:38PM (#18924239)
America historically was not very federalized, and being able to just abandon your life and move out west is a key part of the country's mythology, if not the DNA of the country. So there have always been attempts to resist a national ID system, and the SSN was originally not supposed to be used for this purpose.

Of course in 2019 this is basically a moot point if you want to be integrated into society, but even then there are people who are legitimately not integrated into the modern US economy by choice.

Re:DOJ: Hackers broke into an SEC database and made millions... by Jedi72 on Wednesday January 16, 2019 @04:45PM (#18925691)
I have thought about this a little bit. If this is something Americans believe in, its time to make it official. Make a legal proceeding where you can "start again", so that nobody from your old life can trace you.
Re:DOJ: Hackers broke into an SEC database and made millions... by solotronics on Friday January 18, 2019 @12:57AM (#18937324)
From what I can tell you can go to California and say you are an immigrant and get an ID under any arbitrary name. It seems you can do anything with this so it's essentially a new identity.

https://www.nerdwallet.com/blog/banking/undocumented-immigra...

Re:DOJ: Hackers broke into an SEC database and made millions... by darkpuma on Thursday January 17, 2019 @02:00AM (#18928919)
Formalizing the process kind of misses the point.
Re:DOJ: Hackers broke into an SEC database and made millions... by LeifCarrotson on Wednesday January 16, 2019 @05:09PM (#18925968)
> Is that something that goes against the American culture?

Conservative Christian fundamentalist groups have, ever since Reagan, likened a national ID card to "the mark of the beast", citing Revelation 13's prophecy that no one could buy or sell goods without the number of the beast, and the reference to God's chosen people that refuse the mark of the Beast.

When a small but meaningful fraction of your constituents fervently believe that giving them a national ID literally damns them to Hell, it's a hard sell.

Much easier if you attach it to a tool (Social Security) with which they can get money.

There's also the angle of State's Rights and whether the federal government can require people to have national ID over just amalgamating the various state IDs.

Finally, Americans generally distrust their government. Not without reason, they believe a national ID would reduce their privacy and allow the government to more easily spy on and track them.

Re:DOJ: Hackers broke into an SEC database and made millions... by jessaustin on Wednesday January 16, 2019 @05:14PM (#18926018)
Then again, you could be like my uncle. His SSN is 666-66-6666. He's not particularly religious...
Re:DOJ: Hackers broke into an SEC database and made millions... by jrpelkonen on Wednesday January 16, 2019 @10:09PM (#18927997)
There’s a chance your uncle made that one up himself: “No SSNs with an area number of 666 have been or will be assigned.”[0]

[0] https://www.ssa.gov/policy/docs/ssb/v69n2/v69n2p55.html

Re:DOJ: Hackers broke into an SEC database and made millions... by jessaustin on Thursday January 17, 2019 @07:46PM (#18936070)
There's a chance I made up that uncle myself... it's easier than using Google to find this information.
Re:DOJ: Hackers broke into an SEC database and made millions... by jandrese on Wednesday January 16, 2019 @03:28PM (#18924775)
SSN is often used as an account verification, which is a problem because social engineers can get your SSN pretty easily.

It's hard for a phone bank operator to ask for a photo ID.

Re:DOJ: Hackers broke into an SEC database and made millions... by __david__ on Friday January 18, 2019 @04:02AM (#18938005)
I used to give out fake SSNs to everyone that insisted on one (normally I just leave that part of a form blank). The first time someone asked for the last four digits of one of my fakes I had to scramble to remember what random number I had given out. I never considered that might actually be better security.
Re:DOJ: Hackers broke into an SEC database and made millions... by jandrese on Friday January 18, 2019 @02:00PM (#18941860)
Downside of this solution is that many companies ask for it so they can do a credit check. Giving them a fake number could technically be fraud.
Re:DOJ: Hackers broke into an SEC database and made millions... by rootusrootus on Wednesday January 16, 2019 @03:31PM (#18924814)
We don't require a full set of fingerprints to renew your driver's license, but we do require proof of citizenship and residence. As a practical matter, for most people that means birth certificate and a utility bill with their address on it.

I assume the fingerprints thing is for future crime solving?

Re:DOJ: Hackers broke into an SEC database and made millions... by jessaustin on Wednesday January 16, 2019 @05:19PM (#18926055)
A giant database of fingerprints is more likely to "solve" crimes than solve them. This statistical mistake even has a name: "the prosecutor's fallacy". (It could be that police detectives deserve to name this trope more than prosecutors do, but it's probably too late now.)
Re:DOJ: Hackers broke into an SEC database and made millions... by mplewis on Wednesday January 16, 2019 @01:35PM (#18923527)
That'll be leaked eventually, too.
Re:DOJ: Hackers broke into an SEC database and made millions... by gtirloni on Wednesday January 16, 2019 @01:43PM (#18923640)
That's a fact of life. I'm talking about how they are determining identity. Just asking for a SSN number is mostly like dealing with anonymous people (thus my question about culture).
Re:DOJ: Hackers broke into an SEC database and made millions... by blancheneige on Wednesday January 16, 2019 @03:53PM (#18925053)
there are places here that will let you vote for the president of the united states without requiring proof that you are a US citizen. what do you expect.
Re:DOJ: Hackers broke into an SEC database and made millions... by wtvanhest on Wednesday January 16, 2019 @04:31PM (#18925520)
That really isn't a big deal since you need to prove residence to register. There are a limited number of votes that can be made. If two people show up saying they are the same person, that will create a red flag.
Re:DOJ: Hackers broke into an SEC database and made millions... by ThomPete on Wednesday January 16, 2019 @02:47PM (#18924322)
But they are not really secret just like your email isnt. Its using it as if it is thats the problem imo
Re:DOJ: Hackers broke into an SEC database and made millions... by freshhawk on Wednesday January 16, 2019 @02:06PM (#18923869)
And some places "rely" on knowing a full name or just a phone number.

We would call that an error on their part, and I don't see why the same logic doesn't apply here.

Re:DOJ: Hackers broke into an SEC database and made millions... by josh2600 on Wednesday January 16, 2019 @02:14PM (#18923975)
It’s risk management. Some products just have greater risk associated with them.
Re:DOJ: Hackers broke into an SEC database and made millions... by jason46 on Wednesday January 16, 2019 @02:44PM (#18924296)
Best Buy credit. I never have my card on me, but I can use my credit account with my Soc.
Re:DOJ: Hackers broke into an SEC database and made millions... by wuliwong on Wednesday January 16, 2019 @02:53PM (#18924372)
Not saving my SSN along with my transaction is different than my SSN being "public".
Re:DOJ: Hackers broke into an SEC database and made millions... by the8472 on Wednesday January 16, 2019 @03:20PM (#18924693)
Why don't they just assign a new one from time to time? It's just a number after all, much easier to change than fingerprints.
Re:DOJ: Hackers broke into an SEC database and made millions... by mikepurvis on Wednesday January 16, 2019 @03:24PM (#18924740)
The whole point is that it's not supposed to change, unlike your name, address, gender, occupation, and everything else.

Which makes it all the more ridiculous that as an immutable identifier, it's also supposed to be a secret.

Re:DOJ: Hackers broke into an SEC database and made millions... by nradov on Wednesday January 16, 2019 @03:28PM (#18924779)
It is supposed to change. The Social Security Administration explicitly allows people to obtain new SSNs in limited circumstances.
Re:DOJ: Hackers broke into an SEC database and made millions... by k_sh on Wednesday January 16, 2019 @04:04PM (#18925222)
supposed !== possible
Re:DOJ: Hackers broke into an SEC database and made millions... by smaddox on Wednesday January 16, 2019 @01:32PM (#18923495)
This is actually a great idea, as long as the government makes clear the plan to do this, and gives banks et al time to adjust.