How can you steal a name?

Here's a name: jwr. Have I stolen it?

This is yet another alarming signal that the whole idea that your colloquial identifying information (name, phone, SSN/SIN, credit card number) is somehow a natural resource that anyone can use as they like. We need to work on fixing this. At the very least, we should stop pretending that identifiers are just tags that anyone can use without consequence. And even if the breach in question resulted in no harm done (those associated with the identifiers suffer no direct liabilities), it should not be treated lightly.

Possession of particular identifiers cannot be brushed off as "it's just a number" et al. You picked 14334572 precisely because it is not meaningful to anyone; short of such particular & peculiar use, we don't pick and retain numbers (or other identifiers) for no good reason. Out of a given range, the odds of picking 14334572 is very very small...if it happens to have a particular social meaning, and you possess it along with other information which likewise has an odd lack of meaninglessness, then you have malicious intent constituting "stolen numbers".

Don't pretend information is meaningless. We're not dealing with the Library Of Babel here.

I think you (and some others who are downvoting my comment) are missing the point.

You having a 'jwr' string does not enable you to do much — you can't use it to gain access to anything, no one will ask you for this string to authenticate you, you can't use it to pay for services. So if you "stole" it (or produced it out of thin air), it would not be a problem.

Now, I picked 14334572 specifically because it looks like a social security number (and might, for all I know, actually correspond to one). The point here was that you can't 'possess' a number, and you can't 'steal' one. You can steal complete personal information (that includes the number), but that is not what the original article was about.

My main point was that the real problem is with the whole idea of social security numbers (and credit card numbers) being both public identifiers (which is fine) and authentication tokens (which is not). If they were just public identifiers, then "stealing" a list of such numbers would not be a problem for anyone. It is the embedded trust we place in those numbers that causes us problems. SSNs are not secret key material, and treating them as such causes all kinds of issues.

As a side note: looking at the downvotes, I am increasingly worried about knee-jerk reactions here. I am finding that unless I craft my comment carefully and surround it with disclaimers, it will get misread. This is worrying, because it leads to watered-down and needlessly verbose discourse, words playing the role of guards against all the detail-pickers out there.

This is a more sensible expression of the concern. Your initial post was easily confused with a common ill-advised perspective.

I might not be able to do much with "jwr", but I could build an entire profitable identity around your SSN.

Your real concern is that identifiers and authentication must be separate and treated as such, while in practice one number/string is used for both purposes - hence the concern of "stealing numbers", as having the identifier means having the authentication. Insofar as there may be a separate authenticating token, all too often it is so weak that the identifier is used as part of the authentication; having the identifier may be enough for access, or enough that deducing the remaining authentication token may be fairly trivial (say, a 4-digit PIN); this being tax day in the USA, we're quite aware that many tax returns will be fraudulent, requesting large refunds based on mere possession of a SSN identifier and a smattering of other public data. We should be using real cryptographic private keys of substantial length for authentication, leaving the public identifier public so that having one (or a slew) gets one nowhere without the hard-to-obtain authentication tokens.

As for the downvotes and the need to craft comments carefully: yes, the need for careful wording is the norm. We're trying to cram a lot of information and opinion into a very small space, which will be read very quickly by a great many people of wildly varying perspectives interpreting the post, making it very easy to misinterpret intent (doesn't help that there are a lot of dumb & ill-advised posts, setting expectations quite low). The greatest problem is refining short easily-read posts to withstand accusations which demand encyclopedic thoroughness. One of my motivations for prolific posting around the 'net is precisely to exercise & refine my ability to post views in a concise & persuasive manner (and if that gets bizarrely construed as "he must have multiple accounts, know a lot of people, and persuades others to downvote opposing views" then I must be getting somewhere with that ability).

Actually, ctdonath is pretty well known for using multiple accounts and getting friends to downvote people who disagree with his posts (and to upvote his own). I'd advise against replying to him, as he will try to get you hellbanned.

You funny. I've only one account, know nobody on HN, and don't know squat about hellbanning except that it exists. I'm quite amused that anyone would impute such influence & power to me, even as a joke.

Ironically the person behind the account that made those accusations is certainly guilty of at least some of the things he accused you of. Probably a nice example of some good projection. (That account was created just for that post, so at the very least the person behind it is creating multiple accounts.)

> How can you steal a number?

The same way someone might "steal" your password. All data can be encoded as a number.

> the whole idea that your SSN/SIN or credit card number is somehow secret and can be used for authentication is flawed.

I don't disagree, but "how can you steal a number?" isn't a valid argument for your assertion.

I agree that the short and commonly used numbers that are often considered to be proof of ID are no longer suitable. When a computer can easily guess every possible combination of numbers in a set in seconds, it's not really sensible to use it for validation.

However, even if we all had a unique 4096 bit private key with which we identified ourselves, it would still essentially be a number and it would certainly be able to be stolen. Stealing a number is more or less the same as stealing a private key or stealing a classified electronic document - it's the unauthorised access and copying of information. Society has broadly come to accept that this is considered stealing.

"Stealing" a number does not exist. Learning what the number relates to by way of breaking the law should be.

You're arguing about the definition of the word steal, and your definition is not the widely accepted one. You're facing a long and uphill struggle.

> This is yet another alarming signal that the whole idea that your SSN/SIN or credit card number is somehow secret and can be used for authentication is flawed.

Secret information is required for practical authentication. Some examples:

Private keys (ssh, gpg, SSL/TLS certs, bitcoin wallets)

passwords

session ids

api secrets

auth tokens

I believe you don't often write down your private keys, passwords, api secrets or auth tokens on paper forms that you then submit to various institutions you have no control over, right?

As a comparison, your SSN is used all over the place, you will need to disclose it regularly (rent an apartment and your landlord is likely to request a credit check, you'll give him your SSN). A number of people and institutions will have access to it. It is not a secret. It should not be used for authentication and no one should assume it somehow secret, because it is not.

Semantics doesn't really help when everyone understands the meaning anyway. No one is going to read this and think 'Oh no, those poor people don't have their SINs anymore!'

That said, the SIN in Canada is actually meant to be kept secret between you, your employer(s), the CRA, and a few other situations[1]. You should never give it to anyone else, write it down anywhere, etc. I memorized mine long ago and keep the actual card locked in a box somewhere, and I never give it out except to the government or new employers.

[1] http://www.servicecanada.gc.ca/eng/sin/protect/provide.shtml

In Canada you can refuse to give someone your SIN for non-government purposes ... in theory. I was once refused an apartment sublet once when I did this. I had to come back with evidence that the landlord had no legal right to collect the SIN. That and the strong implication I was capable and willing to file a complaint.

People use all sorts of zany things to try to prove identity. I think public education is the first line of defence against the misuse of things like SSN/SIN.

More specifically - you can't refuse to give your SIN to a financial institution or to your employer (as for 99% of Canadians those are their main sources of income, and because those entities need to submit information to the government regarding your income for tax purposes).

For most other things though you can refuse to disclose it (i.e. telecom providers, debt-only financial institutions like credit card providers)

I didn't think it was so much a 'you have the right to refuse' as much as it was 'it's illegal to ask' for situations not related to taxes and payroll and stuff like that.

In terms of being used for authentication, CRA and other online services usually require SIN + DOB + Postal Code, and then they mail you a 4-digit PIN to the address they have on file.

Hilariously enough, if you call them, you can change the address on file if you have SIN + DOB, making the "PIN" pointless (and irritating, since you have to wait several weeks)

They have updated now to work with some of the banks.

Still a pain to get it setup, but once you are setup it is much better now.

Relevant:

- http://en.wikipedia.org/wiki/Illegal_number

- http://en.wikipedia.org/wiki/Illegal_prime

As a matter of principle, it's true that a number cannot be stolen. On the other hand, in some contexts obtaining a copy of a secret number can allow a thief to steal a resource such as money, which definitely can be stolen. I'm not quite sure what to use instead of the shorthand 'stole Social Security numbers'; while strictly inaccurate, better alternative phrasings don't immediately jump to mind.