Oh, and the password is almost impossible to change, and you're required to use it to sign in on a host of other sites.
Amtrak’s solution? I could set a PIN, right then and there, verbally with the agent over the phone. No logging into my account. No email or text message confirmation. They didn’t even ask to confirm my DoB or address. Nothing. I had only given him my reservation number.
And not 30 seconds after creating my new PIN the same agent was then able to “verify” my identity/account by asking me... for my PIN.
https://krebsonsecurity.com/2015/10/whats-in-a-boarding-pass...
https://web.archive.org/web/20120324074139/https://www.iata....
Historically, something like that might well have been handled by snail-mailing a default pin to the address on record for the account and telling you to call back after you received it.
Of course, the problem is that a lot of people these days would think that was really poor customer service.
Of course, you could let the site specify the password, which would work if they're long and random. But social security numbers are neither of those.
Except for the US government, and most banks, medical providers, and cell phone companies.
I've noticed some sites using identification only (like the days of IRC), so you can have a consistent identifier to interact with people but a username isn't actually secure or owned. The converse should also be possible, in the same sense that a bank PIN is used to authenticate with no public identifier involved.
That said, for many offerings we should consider "a company employee" to be a third party. There are already employees with access to my data, but the outsourced call center employee who answers the customer service number probably isn't one of them, and I want them to be able to look up my account details without being able to impersonate me.
The solutions Sweden has to proving identity despite this are not exactly radical: photo ID documents, and secure ID apps (encrypted certificates) on phones or smartcards.
SSN and NIN could reasonably be used for identification of the form of "this person's data is different from that person's data". (identification as in primary/unique key)
They can't/shouldn't be used for authentication that this person is who they claim to be. (identification as in password)
100% agreed, perhaps I should have worded my comment better. My point was that this seems to be common practice in the US but not over here.
SSN's were only ever meant to be used for identification (as in a username). In the beginning the worst that could happen is that someone else would file their payroll taxes with your SSN, and make you eligible for more Social Security benefits when you retired. It was never meant to be a password.
For employment, the I-9 form is what we fill out as authorized US workers and to document same.
https://www.uscis.gov/i-9 (the "paper version" link works best)
You'll note that Social Security card is in List C "documents that establish employment authorization" and not in List B "documents that establish identity" nor in List A "documents that establish both identity and employment authorization"
I guess you can look at it as a form of off-line multi-factor authentication. You are using the Social Security card as proof of eligibility for the person whose identity you have already established using another factor. In that case, it's the card that acts as the factor, not the number (which if you've ever seen a social security card, it's ridiculous to think that it's in any way secure or even durable).
The closer equivalent in Germany is probably the Personalausweisnummer (ID card number). Basically everyone has an ID card, and sometimes the number of the ID card is used as age verification or is written down as part of identity verification at a bank or similar. Assuming you verified that the ID card is genuine it's a good unique identifier that survives name changes; however its usefulness doesn't come from secrecy but the forgery-proof piece of plastic it's printed on. Also you can change it at any time within a few weeks by just getting a new ID card, and it naturally expires every ten years or so.
I think a fundamental problem in the US is the requirement to verify identity via phone. In Germany that's just assumed to be impossible without a prearranged passphrase; when opening a bank account you verify identity by showing ID at the bank or a postal station or by waving your ID in front of a webcam during a live call.
- If you want to pay bills you just do a bank transfer (they are free and fast within the EU), transferring the money to a published bank account with my invoice id or similar in the subject. If somebody else wants to pay my invoice neither I nor the company will have any objections, so no need for authentication.
- If I want to check a bank account or a credit account or something similar I have a password that was set up when the account was created
- If I want to set up an account I can authenticate either via webcam (showing off the security features of my ID card) or via PostIdent (where I have to go to a post office)
- When talking on the phone you have an authentication problem (unless a "phone passphrase" is prearranged, but for anything with lasting consequences you usually have to send them a written version per email or snail mail for papertrail reasons anyways, or alternatively they send you a confirmation per snail mail that you can object to in a reasonable time frame.
The new ID card has online features that in theory solve the problem completely for online systems, but few places implement that so far.
One can still ask a Canadian for their SIN for reasons not on that list, but it is illegal to refuse service for not providing a SIN [2].
[1] https://www.canada.ca/en/employment-social-development/servi...
[2] https://www.canada.ca/en/employment-social-development/progr...
Well, TIL. I guess no one ever asked me for it.
I still remember them asking me for mine. Pure jokes.
Here's an article from almost 15 years ago where one of the Blockbuster locations dumped a bunch of customer forms in the street where most forms had people's SSNs on it: http://legalshred.com/east-side-new-york-blockbuster-dumps-c...
> The trash pile included recent membership applications, each revealing the customer’s birth date, address, phone number, driver’s license number and signature.
More alarming, each application also contained a credit card number and expiration date, and many included a Social Security number.
Talk about a violation of privacy and leaking sensitive information. This is why you can't trust big companies with anything sensitive.
A now-defunct chain of video rental stores.
edit: US and elsewhere
It's interesting, in Canada and probably other countries, the corresponding ID code cannot be used as primary key, like for employment records. And somehow their societies function.
Unfortunately, one of those lawful uses is to give one's SIN to banks who provide accounts that pay interest. That said, I don't think it's enough to impersonate someone.
What other options are there? Most other potential identifiers are full of pitfalls like input error, collisions, having things change, or simply being unknown by the citizen. Even something as simple as name, birthdate, and place of birth is chock full of problems. People transcribe records wrong, or were born out of the country in a place with no recordkeeping that no longer exists to parents who have since died.
SSNs are far less complex and error prone. Their only major downside is that they only work for people who have them, which means your app can only service legal citizen Americans.
It's when you're talking about something that sticks with a person for their entire life. A prime example is credit scores. That's something that stays with you no matter how many times you change jobs, change names, change addresses, get married, etc... Federal taxes are another area where it's important to match the name with the correct record every single time.
Glory to Artstozka! Cause no trouble.
Better to blame a “senior moment”.
What stops you from just refusing to give out your SSN, or simply saying you don't have one (even if you do?)
Obviously getting a credit card might be annoying, but to get around that I just put down a $500 "bond" and got a Credit Card with a $500 limit (so the bank was guaranteed not to lose it's money).
Can you not just refuse to give out your SSN and still get on with life in America? (I get on OK without one)
That's really strange, is it because you're not employed in the US?
I am not a US citizen but I have a US SSN because I lived there on a work visa (multiple times). Employers have always asked for my SSN to check my work authorization through e-Verify. Every time.
Example is chip+pin, which is widespread in Europe but not really available in the US. Chip+nothing (which is still better than a 16-digit number) is become more commonplace as the liability protections that the magnetic strip enjoyed are disappearing. People react in self-interest, and the fact that you become liable for fraud if you take the strip instead of the chip mean that there's a large incentive to move away from the magnetic strip.
I'm sure if you dig into it you'd see similar provisions that protect other organizations, either throw law, regulation, or just protection of "industry standard practices", from being held directly liable if they use the SSN for identity verification rather than insisting on a more reliable hard-to-exfiltrate identifier.
Insurance information changes over time though so it's simpler to just request the government issued GUID and use that to make sure you're associating the patient files correctly.
I think the only real solution would be for smart cards to come back into vogue and assign everyone a unique key along with their SSN. Proofs of identity for things that matter ie loans and other financial work could then be secured without significantly interfering with it's use as a unique identifier in cases where it doesn't need to be secure. (As wrong as it is to use SSNs that way it's ingrained enough in interactions and systems that trying to cut that off would be a big pain.)
Maybe if you converted passports to smartcards, and then slowly turned it into a national ID you could make this work.
Fair point, but it's worth noting that lots of people don't have either document. Hence, say, the voter ID law fight: many people genuinely have no standard identity document except SSN.
One other aside is that driver's licenses are a remarkably bad identification document. Even plenty of bars won't take out of state driver's licenses, or will outright declare real ones to be fake. And dealing with government offices, I've had several iterations of "that state's license ID has a different number of digits, so I can't use it in our system".
> One other aside is that driver's licenses are a remarkably bad identification document.
This is changing with REAL ID; all states are either compliant with new ID issuance and doc standards or have received an extension. https://www.dhs.gov/real-id
Italians that have an id card predating electronic id are routinely bumped off American bars because to them it looks like it's just a piece of paper with a photo stitched on top. Yet, identity theft is a problem in the US and not in Italy...
In fact, even though that id card actually is relatively easy to forget, it does have some watermarks and special government stamps. In fact, it's probably easier to fake an electronic id card with a piece of plastic, if you know no one is going to try using the smartcard functionality.
It's called "history." And as they say, those who don't learn from it are doomed to repeat it.
No federal IDs did absolutely nothing to inhibit Japanese internment. The federal government has vast powers already.
I don't see how modern society can function without some form of universal authentication. Alternately, if you live in a forest and don't need or want to participate in the financial system, I'm all for making a hypothetical national ID opt-in.
There is no law saying that Us citizens have to carry identification pricing they are citizens.
And yes, if they have reasonable suspicion that you’re lying, they can detain you.
https://www.aclu.org/other/constitution-100-mile-border-zone
I'm Canadian though, so it's quite possible that this would be reasonable here and not in the U.S.
Even if you gave a fake SSN to, say, a landlord (they need it to run a background and credit check on you and to better chase you down if you don't pay your rent) that would almost certainly be considered either fraud or theft by deception.
Generally, you provide the entity your SSN because they have a legitimate need to identity you, and that includes identifying you as you outside their internal system.
https://www.ssa.gov/employer/stateweb.htm
That leaves you with six digits to choose.
Secondly, that wouldn't work, the insurance company already knows your SSN. If your insurance is provided through your employer your employer already gave it to your insurance company when they set up your benefits. You need to give your employer your real SSN to pay taxes. If your insurance is provided through the government (medicaid, medicare, tricare) then the government already knows your SSN. You BEST not be giving the government a fake SSN to collect benefits, that's all sorts of illegal.
>Secondly, that wouldn't work, the insurance company already knows your SSN
It could totally work, it’s really easy to get a card open with another SSN and then accurint or whatever the insurance company uses will just return multiple SSNs.
If the party requesting it is using it for billing and collections, and you fail to pay a bill and they send it to collections, and subsequently report the collection to a credit agency, then it is a clear case of fraud. If you randomly happen to pick a valid SSN, then you are committing identity theft in addition to fraud.
If they are just using it as a Unique ID, they may not ever know that it's fake. None-the-less it is still fraud.
You’re asked to hand over the number, but you don’t always have to provide it. Really only the government needs to identify you with this number, and only for purposes related to the social security system. You don’t have to give it to your doctor’s office or bank. Often, a simple “I’d prefer not to disclose this because of identity theft” is fine. They may press you for it, and most people are too timid to resist. If they are insistent I’ll just make up a random string of digits and that’s always been ok. All they are looking for is nine digits so the computer form they are filling out lets them move on to the next page.
This is the problem right here.
To that sorry list, I would add medical providers' offices (doctors and dentists), all of which seem to request social security numbers for some reason on their patient intake forms, when all they should need is the patients' insurance information as printed on their insurance card.