It's Still Easy for Anyone to Become You at Experian

Re:It's Still Easy for Anyone to Become You at Experian by michpoch on Sunday November 12, 2023 @07:42AM (#38239622)

It still sounds like a good way to uniquely identify a person? How else would an institution confirm that it's talking about the same person?

[ Parent | on HN ]

Re:It's Still Easy for Anyone to Become You at Experian by alistairSH on Sunday November 12, 2023 @08:11AM (#38239764)

The same way they do for people who aren’t from the US?

Some combination of name, address, birthdate, etc.

But the problem isn’t using the SSN as a semi-unique ID. It’s using it for that and also assuming it’s secret. SSN shouldn’t be any more secret than name or address (and shouldn’t be used to unlock or access accounts).

[ Parent | on HN ]

Re:It's Still Easy for Anyone to Become You at Experian by michpoch on Sunday November 12, 2023 @11:57AM (#38241905)

> The same way they do for people who aren’t from the US? Some combination of name, address, birthdate, etc.

Plenty of countries have SSN-like numbers: https://en.wikipedia.org/wiki/National_identification_number

It's really not that special.

> But the problem isn’t using the SSN as a semi-unique ID. It’s using it for that and also assuming it’s secret. SSN shouldn’t be any more secret than name or address (and shouldn’t be used to unlock or access accounts).

Of course. Shouldn't it be trivial to sue any institution that uses SSN as a way to confirm your identity?

[ Parent | on HN ]

Re:It's Still Easy for Anyone to Become You at Experian by alistairSH on Sunday November 12, 2023 @12:41PM (#38242347)

Shouldn't it be trivial to sue any institution that uses SSN as a way to confirm your identity?

You’d think, yet here we are, with one of the big three credit agencies letting people steal/resteal accounts with nothing more than some public info.

[ Parent | on HN ]

Re:It's Still Easy for Anyone to Become You at Experian by michpoch on Sunday November 12, 2023 @03:10PM (#38243664)

Isn't that like a classic American moment when you sue them and become a millionaire?

[ Parent | on HN ]

Re:It's Still Easy for Anyone to Become You at Experian by alistairSH on Sunday November 12, 2023 @03:21PM (#38243750)

If only real life was like the movies. ;)

[ Parent | on HN ]

Re:It's Still Easy for Anyone to Become You at Experian by WitCanStain on Sunday November 12, 2023 @08:08AM (#38239749)

It is used that way in Finland and a fair few other countries and works perfectly well.

[ Parent | on HN ]

Re:It's Still Easy for Anyone to Become You at Experian by noSyncCloud on Sunday November 12, 2023 @10:15AM (#38240809)

It's a terrible way to uniquely identify a person; it was never designed as such. For instance, there aren't nearly enough of them – they get re-issued all the time.

[ Parent | on HN ]

Re:It's Still Easy for Anyone to Become You at Experian by maxerickson on Sunday November 12, 2023 @06:37PM (#38245281)

They don't get reused. See Q20:

https://www.ssa.gov/history/hfaq.html

[ Parent | on HN ]

Re:It's Still Easy for Anyone to Become You at Experian by emodendroket on Sunday November 12, 2023 @11:46AM (#38241783)

It is treated like a secret, so if you come to know someone else’s Social Security number (thanks to a thriving black market you can buy up plenty of them) that’s enough for lenders to start giving you money and then chasing down that other person to pay them back. Are you starting to see an issue yet?

[ Parent | on HN ]

Re:It's Still Easy for Anyone to Become You at Experian by michpoch on Sunday November 12, 2023 @11:59AM (#38241920)

Well that's another thing, I don't see why would you need to get rid of SSNs. You just need to add another layer that will confirm that you're the "owner" of your SSN. Seems pretty easy to do?

[ Parent | on HN ]

Re:It's Still Easy for Anyone to Become You at Experian by BytesAndGears on Sunday November 12, 2023 @04:47PM (#38244414)

Agreed, except that nobody has done it. So SSN is your username and password anyways, despite everyone* knowing they’re all public knowledge at this point

*: except judges and juries, apparently

[ Parent | on HN ]

Re:It's Still Easy for Anyone to Become You at Experian by emodendroket on Sunday November 12, 2023 @10:35PM (#38246590)

I didn’t propose getting rid of the SSN without replacing it with an actual, secure national ID. If that involves legacy SSNs still somehow whatever.

[ Parent | on HN ]

Re:It's Still Easy for Anyone to Become You at Experian by vharuck on Sunday November 12, 2023 @07:49PM (#38245695)

Some people (especially older women) don't know their own SSN, just their husbands'. If they never had a job, there wasn't much use for an SSN. And if their spouse passed away, they always had to use the deceased's SSN to collect survivor's benefits (or whatever it's called).

I've seen it more than once when working with health records: two people have the exact same SSN, but different sex. If I need to match records, I'll use SSN and birthdate, knowing even that's not immune to errors.

[ Parent | on HN ]