News for hackers. Stuff that matters.
Re:U.S. military members' personal data being sold by online... by jcadam on Tuesday November 07, 2023 @01:23PM (#38180714)
I'm sure the military still has a SSN field on EVERY. SINGLE. FORM. they have you fill out while you're in the service. There was talk of replacing that with a "service number" but somehow I doubt they've got around to it yet.

Between VA employees leaving laptops full of PII laying around and that big OPM leak several years ago, I apparently have no private life.

Re:U.S. military members' personal data being sold by online... by RobRivera on Tuesday November 07, 2023 @01:33PM (#38180848)
Dipi keys are a thing and have been put to good use
Re:U.S. military members' personal data being sold by online... by RecycledEle on Tuesday November 07, 2023 @01:39PM (#38180934)
I've never heard of "dipi keys." Can you tell me about them?
Re:U.S. military members' personal data being sold by online... by LtWorf on Tuesday November 07, 2023 @01:24PM (#38180732)
The problem is treating the SSN as a username and a password.

It should not be the only information required to authenticate people.

Re:U.S. military members' personal data being sold by online... by user3939382 on Tuesday November 07, 2023 @01:25PM (#38180747)
It should be used for your social security account and nothing else.
Re:U.S. military members' personal data being sold by online... by tczMUFlmoNk on Tuesday November 07, 2023 @01:35PM (#38180878)
Huh. As a member of a generation that has grown up tacitly understanding that social security will very likely be insolvent/cancelled by the time that we're old enough to qualify for it, and thus we shouldn't rely on it whatsoever—it's surreal to consciously connect these two concepts. For me, "social security number" is just the name for the ID number that so many of us have and are used to writing everywhere. The name is just a string of symbols. It sounds silly, but I've never thought about it in relation to social security. Thanks for the mind-bender. :-)
Re:U.S. military members' personal data being sold by online... by SonicScrub on Tuesday November 07, 2023 @01:41PM (#38180960)
There's an interesting story about how the social security number evolved to being much more than just for social security. Quick 5 minute primer:

https://m.youtube.com/watch?v=Erp8IAUouus&pp=ygUYY2dwIGdyZXk...

Re:U.S. military members' personal data being sold by online... by askiiart on Tuesday November 07, 2023 @04:02PM (#38182784)
Short link without tracking id (si=): https://youtu.be/Erp8IAUouus
Re:U.S. military members' personal data being sold by online... by dragonwriter on Tuesday November 07, 2023 @01:47PM (#38181047)
> As a member of a generation that has grown up tacitly understanding that social security will very likely be insolvent/cancelled by the time that we're old enough to qualify for it

Is it “tacitly understanding” when you've been bathed your whole life in active propaganda promoting an idea? Because, on this, if you are in any cohort from Gen X, or maybe the trailing edge of thr Boomers, on, you have been.

Re:U.S. military members' personal data being sold by online... by jcadam on Tuesday November 07, 2023 @02:13PM (#38181390)
Nah, we'll get our SS checks - the Fed will turn the money printer up to 11 if they have to cover the program.

Inflation will make them worthless, but we'll get our checks :)

Re:U.S. military members' personal data being sold by online... by dragonwriter on Tuesday November 07, 2023 @02:23PM (#38181518)
SS benefits are indexed to a wage index (which has been greater than inflation consistently since thr mid-1980s) over working life and to inflation from retirement on.

Cranking the money printer just drives up nominal social security benefits to compensate (for current retires) or more (because easy money drives higher wages).

Re:U.S. military members' personal data being sold by online... by burkaman on Tuesday November 07, 2023 @02:32PM (#38181642)
> social security will very likely be insolvent/cancelled by the time that we're old enough to qualify for it

This is not true, it's propaganda promoted by rich people who want to get rid of social security. It could be eliminated for political reasons, but spreading this idea that it's going to "run out of money" only makes that more likely. The government cannot run out of its own money. It can cause inflation, but continuing to pay social security benefits is not going to suddenly cause massive inflation. The only way social security could end is if politicians and voters decide they don't want it anymore.

Re:U.S. military members' personal data being sold by online... by cheeseomlit on Tuesday November 07, 2023 @02:49PM (#38181868)
>The government cannot run out of its own money. It can cause inflation, but continuing to pay social security benefits is not going to suddenly cause massive inflation.

Social security is a massive portion of federal spending, indefinitely printing money to fund it is not sustainable and will cause significant inflation

Re:U.S. military members' personal data being sold by online... by burkaman on Tuesday November 07, 2023 @03:14PM (#38182150)
Why hasn't that happened yet? Also, the government is going to continue indefinitely printing money whether or not we have social security.
Re:U.S. military members' personal data being sold by online... by cheeseomlit on Tuesday November 07, 2023 @03:32PM (#38182400)
It has, inflation is rising rapidly in no small part due to the gov printing money to cover its obligations, of which social security is one of the largest and will only become larger as the cost of living increases due to said inflation- a vicious cycle. If contributions don't cover the payouts (which they don't, and never will unless you tax the younger generations to death) then the difference has to be made up with printing, which will of course cause inflation

You are right that they will continue printing money regardless, and at this point it's too late for a 20% reduction to fix anything. Might as well just take the checks while you can and make the most of it, not much else you can do. But that doesn't mean its sustainable or will last forever.

Re:U.S. military members' personal data being sold by online... by burkaman on Tuesday November 07, 2023 @04:00PM (#38182755)
But social security has been a constant ~20% of spending for 50 years. Inflation has not been constant at all during that time, and has even dipped below 0. How is that possible if social security is a major contributor to inflation?
Re:U.S. military members' personal data being sold by online... by TheCleric on Tuesday November 07, 2023 @05:31PM (#38183953)
> inflation is rising rapidly in no small part due to the gov printing money to cover its obligations

“US Inflation Rate is at 3.70%, compared to 3.67% last month and 8.20% last year. This is higher than the long term average of 3.28%.”

I would hardly call something that’s only slightly above average (and less than half of what it was a year ago) as “rising rapidly“.

https://ycharts.com/indicators/us_inflation_rate

Re:U.S. military members' personal data being sold by online... by gedy on Tuesday November 07, 2023 @03:22PM (#38182257)
They've been throwing money left and right for years, they can throw some when we are unable to work.
Re:U.S. military members' personal data being sold by online... by dragonwriter on Tuesday November 07, 2023 @02:52PM (#38181905)
> This is not true, it's propaganda promoted by rich people who want to get rid of social security.

Exactly: “social security is going to be gone by the time you would get it” is a line peddled almost entirely by political activists looking to build support for eliminating social security, and it has been such a line for the entire life span of people who are now old enough to receive SS old age retirement benefits.

Re:U.S. military members' personal data being sold by online... by tczMUFlmoNk on Wednesday November 08, 2023 @02:04AM (#38187537)
Fascinating. Thank you (and siblings) for the correction.
Re:U.S. military members' personal data being sold by online... by vkou on Tuesday November 07, 2023 @02:27PM (#38181574)
What should we use for all the other government services that need to uniquely identify you?

(This a trick question, not a rabbit hole you actually want to go down, because no matter what you suggest, I'll happily poke a thousand holes in it.)

Re:U.S. military members' personal data being sold by online... by BOOTRACER on Tuesday November 07, 2023 @03:19PM (#38182222)
DNA scan
Re:U.S. military members' personal data being sold by online... by kwhitefoot on Tuesday November 07, 2023 @02:40PM (#38181737)
It's used for everything here in Norway: banks, insurance companies, tax, social security, health, etc. It's just a Globally Unique Identifier not a password, it doesn't grant you access.
Re:U.S. military members' personal data being sold by online... by stonogo on Tuesday November 07, 2023 @01:42PM (#38180979)
The US military does not use the SSN as a username or a password. They've had smartcards, even on Linux, as far back as 20 years ago or more. Users without smartcards have to go through 2FA with a username/password combination and codes over SMS or proper TOTP (depending on agency).

The problem is that the entire Department of Defense is still very much a paper-oriented organization, and they got rid of service numbers in the 1970s, leaving the SSN as the only meaningful unique identifier. As a result it gets put on every piece of paperwork associated with a service member. Their own recordkeeping practices have the consequence that if you get almost any paperwork regarding a soldier, it has enough information to gain access to other personal information.

Re:U.S. military members' personal data being sold by online... by swells34 on Tuesday November 07, 2023 @02:51PM (#38181894)
You've hit the nail mostly on the head. Paper is a problem, for obvious reasons, especially the amount of triplicate hand filled forms that require all of your PII every time. The second issue is access control vs. expediency. Millions of people, all over the world, can digitally access huge amounts of your personal information at a whim, by only having your name, or your military email address.

This is an important requirement for quickly checking on a person or their orders or their training status, but at the sacrifice of personal information security for you. It gets even worse going to the VA, which I can say from personal experience, will happily allow just about anyone to have whatever information they want about you. I got a happy surprise letter from them stating that my DD-214, a super identity document, containing information found on a birth certificate, a social security card, a driver's license, plus so much more, had been put on a thumb drive by a third party contractor, along with thousands of other service members info, and sold to a dark web information broker. So, the problem is just that it's to the military's benefit to not protect you.

Re:U.S. military members' personal data being sold by online... by LtWorf on Tuesday November 07, 2023 @03:09PM (#38182093)
I wasn't talking about the military per se. I was talking about how you can open a bank account just by knowing someone else's ssn
Re:U.S. military members' personal data being sold by online... by hindsightbias on Tuesday November 07, 2023 @03:33PM (#38182408)
You should sit in on a call to dfas.mil sometime. Where they ask an 80 year old over a dozen obscure questions on their service record and hang up when you get one of them wrong, resetting the clock 24 hours.
Re:U.S. military members' personal data being sold by online... by kube-system on Tuesday November 07, 2023 @02:09PM (#38181333)
The government doesn't do this though, it's mostly banks that are guilty.
Re:U.S. military members' personal data being sold by online... by LtWorf on Tuesday November 07, 2023 @03:08PM (#38182080)
The government should regulate the banks.
Re:U.S. military members' personal data being sold by online... by kube-system on Tuesday November 07, 2023 @03:28PM (#38182345)
I am sure the executive branch would require banks to use a better identifier, if the legislative branch allowed the executive branch to create one.
Re:U.S. military members' personal data being sold by online... by randombits0 on Tuesday November 07, 2023 @02:01PM (#38181224)
Chinese hackers stole over 70 million records of current/past military members from the Office of Management and Budget back in April of 2014.
Re:U.S. military members' personal data being sold by online... by warner25 on Tuesday November 07, 2023 @03:11PM (#38182118)
I think you're thinking of the Office of Personnel Management (OPM), not OMB (although I did just learn that the Trump administration proposed to merge parts of OPM into OMB).

https://en.wikipedia.org/wiki/United_States_Office_of_Person...

But yeah, compared to that, sadly, this acquisition of much less detailed information about 30,000 service members seems moot.

Re:U.S. military members' personal data being sold by online... by trvrsalom on Tuesday November 07, 2023 @02:31PM (#38181631)
There are DOD ID numbers, but they've updated the forms to just ask for both.
Re:U.S. military members' personal data being sold by online... by jcadam on Tuesday November 07, 2023 @02:34PM (#38181665)
... sounds like DoD.
Re:U.S. military members' personal data being sold by online... by warner25 on Tuesday November 07, 2023 @03:16PM (#38182185)
In my experience, though, people now freak out if you fill in the SSN field on the form, because that makes it PII with a bunch of requirements for proper storage and transmission. This is despite the fact that most of the other information on the form already makes it PII, regardless of the presence of a SSN.

It did take a few years in the mid-2010s for the forms to catch up and replace the SSN field with the DOD ID number. In 2021, I think I was supposed to get new ID tags (dog tags) that would have my DOD ID number instead of my SSN.

Re:U.S. military members' personal data being sold by online... by herewulf on Wednesday November 08, 2023 @03:45AM (#38188064)
I wish my experience was people freaking out but instead it's continued carelessness and near indifference. Oftentimes with HR NCOs even. I would like to see loss of PII given the same treatment as classified spillage.