{"id":134736,"date":"2017-09-18T11:41:02","date_gmt":"2017-09-18T17:41:02","guid":{"rendered":"http:\/\/hill-kleerup.org\/blog\/?p=134736"},"modified":"2017-09-18T12:04:29","modified_gmt":"2017-09-18T18:04:29","slug":"social-security-numbers-broken-alternative","status":"publish","type":"post","link":"https:\/\/hill-kleerup.org\/blog\/2017\/09\/18\/social-security-numbers-broken-alternative.html","title":{"rendered":"Social Security Numbers are broken. What is the alternative?"},"content":{"rendered":"

We are increasingly a data-driven world. There are electronic records about us everywhere, and we rely on them in a thousand different ways to identify us.<\/p>\n

But anyone who’s ever worked with a system that tries to reliably and consistently identify people knows that it’s a problem. What identifier is ever continuous or persistent? Names have a dozen variations and spellings, and can be changed (for legal, marital, or other personal reasons). Addresses are inconsistent, as are phone numbers (though mobile numbers are getting more portable and perpetual, anyone can still change them). State IDs like drivers licenses are … well, bounded by the state, so a person could have more than one over time.<\/p>\n

The closest thing we have in the US to a national identification number is the Social Security Number — a unique identifier that used to be issued upon going to work, and now is obtained at birth, and stays with the person perpetually.<\/p>\n

The SSN has some significant problems, though. It’s a unique identifier, but is also meant to be a secret<\/i> (or at least confidential) one. Employers have to know it for tax reporting purposes, but are not allowed to use it as an employee number. People doing credit checks of you ask for it, but aren’t supposed to reveal it to anyone else. Knowledge of it is considered to be an essential part of personal security, such that someone knowing your SSN (even the last four digits!) can pretend to be you for a number of sensitive purposes.<\/p>\n

That’s not only problematic in trying to actually identify you, but it’s increasingly untenable. The Equifax break-in put 134 million<\/i> SSNs into the wild — but then we are told that we<\/i> have to be careful monitoring our<\/i> credit because companies (and the IRS!) will still<\/i> treat knowledge of our SSN as proof that someone is us, even though they know that strangers now have that information.<\/p>\n

Or, as the article says, an SSN is not just your userid, but still serves as your password. And that’s crazy from a security standpoint.<\/p>\n

The article’s basic suggestion that the SSN needs to be retire from at least one of those functions it carries — userid or<\/i> password — is spot-on. The question becomes which one, and what to replace it with, and how to make that work in terms of valid initial assignment (if we can’t get everyone registered to vote, how do we get them a new national ID?), in the face of fraud (though SSN-related fraud is largely due to it being a quasi-secret number), error (how do you correct erroneous data associated with your identity, and prove that you have the right to assert that it’s erroneous), and potential abuse (if all the facts about you are associated with a single number, someone in authority can find out anything about you) and paranoia (OMG IT’S THE NUMBER OF THE BEAST AIEEEEE!).<\/p>\n

But those are implementation details to work out (if non-trivial ones). The current situation — SSNs are so “secret” that knowing them is “proof” that you are you, but so unsecret<\/i> that tens of millions of them are known to hackers — is unworkable, and will only grow more so over time.<\/p>\n

[h\/t +<\/span>John E. Bredehoft<\/a><\/span>]<\/p>\n


\n
\n<\/a>
\nTime to Retire Social Security Numbers | RealClearPolicy<\/a><\/span>
\nThere\u2019s no way to sugarcoat it: The hackers who breached the credit bureau Equifax scored big. They made off with the personal identities of 143 million Americans \u2014 names, Social Security…<\/p><\/blockquote>\n

View on Google+<\/a><\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

We are increasingly a data-driven world. There are electronic records about us everywhere, and we rely on them in a thousand different ways to identify us. But anyone who’s ever worked with a system that tries to reliably and consistently identify people knows that it’s a problem. What identifier is ever continuous or persistent? Names … Continue reading “Social Security Numbers are broken. What is the alternative?”<\/span><\/a><\/p>\n","protected":false},"author":2,"featured_media":134745,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_seopress_titles_title":"","_seopress_titles_desc":"","_seopress_robots_index":"","_seopress_robots_follow":"","_seopress_robots_imageindex":"","_seopress_robots_snippet":"","_seopress_robots_primary_cat":"","_seopress_robots_breadcrumbs":"","_seopress_robots_freeze_modified_date":"","_seopress_robots_custom_modified_date":"","_seopress_robots_canonical":"","_seopress_social_fb_title":"","_seopress_social_fb_desc":"","_seopress_social_fb_img":"","_seopress_social_fb_img_attachment_id":0,"_seopress_social_fb_img_width":0,"_seopress_social_fb_img_height":0,"_seopress_social_twitter_title":"","_seopress_social_twitter_desc":"","_seopress_social_twitter_img":"","_seopress_social_twitter_img_attachment_id":0,"_seopress_social_twitter_img_width":0,"_seopress_social_twitter_img_height":0,"_seopress_redirections_value":"","_seopress_redirections_enabled":"","_seopress_redirections_enabled_regex":"","_seopress_redirections_logged_status":"","_seopress_redirections_param":"","_seopress_redirections_type":0,"_seopress_analysis_target_kw":"","_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[106,35,375,77,132],"tags":[1207,1206,119],"class_list":["post-134736","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-plusposts","category-big-business","category-computer-security","category-economy","category-privacy","tag-equifax","tag-privacy","tag-security"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"https:\/\/hill-kleerup.org\/blog\/wp\/wp-content\/uploads\/2017\/09\/Equifax-HQ.jpg","jetpack_sharing_enabled":true,"jetpack-related-posts":[{"id":46821,"url":"https:\/\/hill-kleerup.org\/blog\/2014\/11\/06\/the-fabulous-excuse-of-terror.html","url_meta":{"origin":134736,"position":0},"title":"The fabulous excuse of TERROR!","author":"***Dave","date":"Thu 6-Nov-14 7:42am","format":false,"excerpt":"Is anyone particularly surprised by this?'Section 213 was included in the Patriot Act over the protests of privacy advocates and granted law enforcement the power to conduct a search while delaying notice to the suspect of the search. Known as a \u201csneak and peek\u201d warrant, law enforcement was adamant Section\u2026","rel":"","context":"In "~PlusPosts"","block_context":{"text":"~PlusPosts","link":"https:\/\/hill-kleerup.org\/blog\/category\/blogging\/plusposts"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/hill-kleerup.org\/blog\/wp\/wp-content\/uploads\/2014\/11\/TMW2013-06-12colorLARGE%5B1%5D.jpgimgmax%3D660.jpg?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/hill-kleerup.org\/blog\/wp\/wp-content\/uploads\/2014\/11\/TMW2013-06-12colorLARGE%5B1%5D.jpgimgmax%3D660.jpg?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/hill-kleerup.org\/blog\/wp\/wp-content\/uploads\/2014\/11\/TMW2013-06-12colorLARGE%5B1%5D.jpgimgmax%3D660.jpg?resize=525%2C300&ssl=1 1.5x"},"classes":[]},{"id":37814,"url":"https:\/\/hill-kleerup.org\/blog\/2013\/06\/15\/creating-transparency-through-obscurity.html","url_meta":{"origin":134736,"position":1},"title":"Creating transparency through obscurity","author":"***Dave","date":"Sat 15-Jun-13 2:04pm","format":false,"excerpt":"Or, perhaps, more the other way around.The Feds tell Google, et al., that they can report on FISA court request numbers ... but only if they moosh them up with a bunch of other numbers.'The government gave the companies permission to publish the numbers only if they were grouped with\u2026","rel":"","context":"In "~PlusPosts"","block_context":{"text":"~PlusPosts","link":"https:\/\/hill-kleerup.org\/blog\/category\/blogging\/plusposts"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":49495,"url":"https:\/\/hill-kleerup.org\/blog\/2015\/02\/05\/if-its-online-sooner-or-later-it-will-be-hacked.html","url_meta":{"origin":134736,"position":2},"title":"If it's online, sooner or later it will be hacked","author":"***Dave","date":"Thu 5-Feb-15 6:37am","format":false,"excerpt":"That does seem to be the lesson we're all learning. Either companies and governmental agencies will need to seriously up their security game (assuming they haven't), or will need to forego the incredible power of Internet access (unlikely), or we'll all just have to assume a degree of lack of\u2026","rel":"","context":"In "~PlusPosts"","block_context":{"text":"~PlusPosts","link":"https:\/\/hill-kleerup.org\/blog\/category\/blogging\/plusposts"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":32247,"url":"https:\/\/hill-kleerup.org\/blog\/2013\/01\/19\/us-government-lobbies-europe-against-privacy-legislation.html","url_meta":{"origin":134736,"position":3},"title":"*US government lobbies Europe against privacy legislation"","author":"***Dave","date":"Sat 19-Jan-13 1:05pm","format":false,"excerpt":"As it suggest that the proposals before the EU parliament be\u00a0\u201crevised to ensure that security and commerce are not adversely affected\u201d. Because, after all, TERRORISM and CHILD PORN and HUMAN TRAFFICKING and BIG BUSINESS INNOVATION AND PROSPERITY are at stake!Of course, taken to its extreme, any privacy restrictions will possibly\u2026","rel":"","context":"In "~PlusPosts"","block_context":{"text":"~PlusPosts","link":"https:\/\/hill-kleerup.org\/blog\/category\/blogging\/plusposts"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":11769,"url":"https:\/\/hill-kleerup.org\/blog\/2008\/02\/05\/an_army_of_none.html","url_meta":{"origin":134736,"position":4},"title":"An Army of None","author":"***Dave","date":"Tue 5-Feb-08 4:38pm","format":false,"excerpt":"President during a period of great conflict between security and liberty? Irked by those short-sighted Congress-critters who've hobbled you with some sort of independent oversight board to make sure that...","rel":"","context":"In "Homeland Security"","block_context":{"text":"Homeland Security","link":"https:\/\/hill-kleerup.org\/blog\/category\/politics-law\/homeland-security"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":32839,"url":"https:\/\/hill-kleerup.org\/blog\/2013\/03\/20\/freedom-vs-security.html","url_meta":{"origin":134736,"position":5},"title":"Freedom vs. Security","author":"***Dave","date":"Wed 20-Mar-13 7:25am","format":false,"excerpt":"Okay, let's be fair. The cops will always want easy access to more information. Any information out there? \u00a0They want to be able to get it, or get logs of it, or get transcripts of it. \u00a0If the technology existed to record every phone conversation that anyone ever had and\u2026","rel":"","context":"In "~PlusPosts"","block_context":{"text":"~PlusPosts","link":"https:\/\/hill-kleerup.org\/blog\/category\/blogging\/plusposts"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]}],"_links":{"self":[{"href":"https:\/\/hill-kleerup.org\/blog\/wp-json\/wp\/v2\/posts\/134736","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/hill-kleerup.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/hill-kleerup.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/hill-kleerup.org\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/hill-kleerup.org\/blog\/wp-json\/wp\/v2\/comments?post=134736"}],"version-history":[{"count":1,"href":"https:\/\/hill-kleerup.org\/blog\/wp-json\/wp\/v2\/posts\/134736\/revisions"}],"predecessor-version":[{"id":134746,"href":"https:\/\/hill-kleerup.org\/blog\/wp-json\/wp\/v2\/posts\/134736\/revisions\/134746"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/hill-kleerup.org\/blog\/wp-json\/wp\/v2\/media\/134745"}],"wp:attachment":[{"href":"https:\/\/hill-kleerup.org\/blog\/wp-json\/wp\/v2\/media?parent=134736"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/hill-kleerup.org\/blog\/wp-json\/wp\/v2\/categories?post=134736"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/hill-kleerup.org\/blog\/wp-json\/wp\/v2\/tags?post=134736"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}