Our entire credit bureau system is broken

https://www.theverge.com/2017/9/8/16276584/equifax-breach-social-security-number-broken-system

by LopRabbit • 9 years ago

255 134 9 years ago

The fact that your SSN is still used as a national ID in today’s age of tecgnology is what astounds me the most. Why is it my fault and my credit ruined when my identity gets stolen? All it takes sometimes to steal an identity is to convince a teller or whoever that you’re someone you’re not! If that happens, that’s the business’ fault, not mine.

Here’s a scary fact: take your SSN and add 1 to it. That’s a valid SSN! There’s no checksums or any security features at all. If you were assigned a(n) SSN at birth, that new SSN has a high likelihood of even being someone born in the same hospital as you.

letlambda• 9 years ago

They said they were you! https://www.youtube.com/watch?v=CS9ptA3Ya9E

stephengillie• 9 years ago

What LOE (Level of Effort) would it take to replace our current SSN with a public/private key system? More than just a massive bureaucratic shift and public reeducation movement?

Could we have a memorizable public key and still have any meaningful level of security?

convolvatron2• 9 years ago

while we're throwing ideas around, how about just keeping a log of loans and payments rather than trusting some agency to come with with a composite 'score' based on...what exactly?

that way, I can decide how much I care about your 2 missed car loan payments 5 years ago and your disputed dry cleaning bill myself when offering you terms.

lathiat• 9 years ago

If you want to consider this sort of thing I would suggest looking at something like Apple iMessage for inspiration (and iCloud in general)

Apple is trying very had to do proper public-private key crypto, in a way where not even they have access to the keys, but that is also convenient for the user.

There's a reason, for example (this is the best example) you have to approve new iCloud Keychain devices from an existing device. Because that device re-encrypts the database with the private key of the new device.

Even that can cause problems as once someone forgets their password they may not be able to recover that keychain and by proxy other services. There are some trade-offs including an iCloud recovery key that is protected by HSMs that Apple Have with the complete inability to update their firmware - but that has other trade-offs such as they can't fix any bugs on those devices, etc.

I won't fully detail further I would suggest doing your own reading.

You may also wish to look at FIDO, in a sort of related unrelated way.

EvanAnderson• 9 years ago

A friend of mine suggested that the US Postal Service is in a great place to "pivot" into offering digital "trust" services by leveraging their ability to offer a somewhat credible authentication of an individual based on ones ability to receive physical mail.

u801e• 9 years ago

The signed public key could be included on the social security card and passport. The corresponding private key would need to be secured by a memorable passphrase and backups stored in a secure location under your control.

mjevans• 9 years ago

I'd like to extend the 'DMV' / existing government licencing system with a standard digital signature (PKI); which would be applied to the OpenPGP / X.509 / etc public key you provide asserting "I own this" in a standard key-party manor (send the signature encrypted so that only the private key can decode it).

It would also be useful if you could provide multiple keys and associate them with one or more databases: 'full identity' (public listing with name) or key ages (probably 18, 21, and whatever social security/etc ages are).

The latter thing would allow for sites that require 'adult' access without forcing them to request credit cards (not always of age) or personal ID. It might not even be part of the standard flow, but merely as part of establishing an adult is involved if there's a dispute.

PS: 'adult' also implies 'able to sign contract' (such as accept Terms of Service). Financial sites would obviously require the full legal name key.

bdonlan2• 9 years ago

An elliptic curve key is probably memorizable (a 256-bit number essentially) but is not quantum-resistant. For quantum-resistant schemes you might be able to memorize a 256-bit seed for a key generation algorithm. You can look at bitcoin "brain wallets" as precedent - they basically translate these random seeds into a memorizable phrase.

That being said, people are unlikely to bother memorizing a 256-bit key, and even if they do they'll just type it into a shady form in a phishing email anyway. Better to just put it on a smartcard chip - it's proven technology that's been rolled out in other nations already.

AnthonyMouse8• 9 years ago

What LOE (Level of Effort) would it take to replace our current SSN with a public/private key system? More than just a massive bureaucratic shift and public reeducation movement?

You are thinking about this from the wrong direction. The problem isn't that the government hasn't provided a PKI, the problem is that social security numbers are being used for identification.

This was a serious fear when social security was originally created. For many years social security cards had the words "not for identification" printed on them. They contain no biometric data, not even a picture. Their purpose is not identification.

So the solution is obvious. Actually prohibit social security numbers from being used for identification. Don't allow creditors to even ask for them.

Then people will figure something else out on their own. Instead of a credit reporting agency existing at all, new credit applications could ask for your account numbers at existing creditors and then the new creditor can get your credit history directly from them. It would be straight forward to automate this -- and even require you to prove that you're the account holder by presenting your card from the other bank (or signing into its website if online).

There is no need for a national identification system. Having a bad one was the original problem. Replacing it with some differently bad one is no better.

tmaly• 9 years ago

How would this system work with people with say dementia who could not recall their key?

PeterisP2• 9 years ago

Having a public/private key system doesn't solve the key problems of identity, namely, a link between your public key and you, and ensuring that it's not easy to create new alternate identities.

Having a digital signature by a private key is a decent way to ensure that you are linked to the public key, if the recipient knows the identity of the public key, and the private key is hard to copy (i.e. not memorizable, not something you type in to a bunch of potentially compromised computers). One way to do this is like Estonia's e-ID, which includes such a private key in the gov't issued photo ID; but having such an ID in the first place seems anathema in US.

andruby• 9 years ago

We have something like this in Belgium with our eID cards. AFAIK the chip has a public/private key. I use a PIN code to unlock the private key and I can create signatures with it to prove my identity.

Websites can actually use this for proper citizen authentication (and non-repudiation). The integration has UX bugs, but at the end of the day, I am very happy that we have something much more secure than a US SSN.

mindslight• 9 years ago

Erm, what do you mean "our"? This system cannot even be justified via the usual democratic collectivism - the commercial surveillance complex is a purely independent adversary that has formed on its own!

It certainly has had help and encouragement from government mandates (SSN, drivers license/plate, monetary surveillance, etc), but even if those were eliminated it would continue just fine using its own primary keys.

As such, it can't really be top-down reformed much [0] except for correctly assigning liability for the fallout from its negligence. For instance, having to repudiate an incorrect debt from a libelous bank or surveillance company should entitle one to easily claim reimbursement for the expenses occurred (including time) to do so.

In the coming weeks we'll undoubtedly see calls to "reform" this system through the technical strengthening of the identifiers it assigns onto us. This is a recipe for rekindling belief in the authority of private surveillance as well as an invitation for it to invade even more aspects of our lives. This is not the direction we want to go!

[0] Of course we can all work on solving the problem from the bottom up by cloaking ourselves. Spend cash when possible, rotate your grocery psuedonyms often, etc.

duncan_bayne• 9 years ago

This is not the direction we want to go!

Erm, what do you mean "we"? ;)

While I agree with you on all other points you mentioned, it's pretty clear to me that the voting public are _perfectly_ okay with the authority of both private and public surveillance, so long as it satisfies one or more of the following criteria:

* Reduces, or is thought to reduce, the cost of credit to the individual concerned. ("I'm okay with it, if it means I can trivially get access to credit because my credit score is good.")

* Prevents, or is thought to prevent, the risk of terrorist action or harm to children.

* Is limited to "others" (poor people, immigrants, other races, etc.).

yosito• 9 years ago

When the system begins causing big losses for creditors, they'll start to take notice and develop a better system. Until then, the best thing you can do is freeze your credit and only unfreeze it when you need it.

anigbrowl2• 9 years ago

Thanks, 'free market.'

Faaak• 9 years ago

Free market does not mean "no regulations".

chaostheory• 9 years ago

This is a terrible way to manage identity. From afar, a Social Security number looks kind of like a password. But you can change a password, and you shouldn’t use the same one with every service.

Going on a tangent, Apple has made the same mistake with TouchID.

grzm• 9 years ago

Apple has made the same mistake with TouchID.

I think that's one of the motivations (if not the primary one) to add the feature to disable TouchID from the lock screen via Emergency SOS:

https://www.macrumors.com/2017/08/17/ios-11-emergency-sos-di...

theshrike79• 9 years ago

TouchID is better than no passcode, that's the purpose for it.

Joe/Jill Public won't use a passcode on their phone, because it's too much hassle. But they WILL enable TouchID, thus rising the bar for random phone thieves/hackers.

swiley3• 9 years ago

People didn't start picking my phone up and trying to get into it until I set a pin. Back when I had an android there wasn't even a lock screen and no one ever touched it.

epmaybe• 9 years ago

I know very little about cybersecurity and cryptography, but wouldn't it make sense for each device have a different passcode associated with a touch id? For example, my iPhone has a passcode XXXXXX, with touch ID associated with it. At the same time, my Macbook has a passcode 0123456789 with a touch ID associated with it.

c3534l• 9 years ago

I was intrigued by the idea of using a blockchain to anonymize and secure lending, so I looked it up and a trial of such a thing was run a few months ago. I found this gem:

TransUnion and Equifax said they are always assessing new ways to secure consumer credit data, an area that is tightly regulated by governments around the world.

https://www.reuters.com/article/us-canada-blockchain-credit/...

The irony aside, it seems like the exact sort of thing a blockchain is good for: verifying transactions with a high degree of anonymity among parties that fundamentally do not trust each other. If I say I've had transactions that I say I have, I should be able to send you a code for you to verify it. There's no reason why I shouldn't have to consent for my private financial information to be disclosed to strangers in the first place.

jacobsimon• 9 years ago

Check out Cred - https://crednetwork.org

harryh• 9 years ago

I don't see how using an anonymous blockchain is useful for storing credit data because it makes it trivial to walk away from a bad credit score and start over from zero.

Also, FWIW you do have to consent for someone to run a credit check on you.

drawkbox• 9 years ago

Freezing credit needs to be free and one button until we have this fixed. Freezing and unfreezing needs to happen quickly.

We also need to know every time our credit is accessed and updated, not monthly like current reports, realtime.

This right should be in the digital Bill of Rights that need to happen as well that you should be able to protect yourself in the case of a breach at no cost to you.

Blockchain seems like the direction, but with how slow we move in everything legislatively, we need something now that allows freezing to be free, fast and easy.

The three credit bureaus, because they are in a fixed market and not truly in a competitive fair market with a privileged position, they got lazy just like the ratings agencies during housing crash. Lack of focus on their core missions due to no competitive threats.

Groxx• 9 years ago

Freezing I can see being fast and easy. At best you can troll someone by freezing their credit at an inopportune time - which might cause them to lose money, but less likely in general, surely.

Unfreezing? The whole point is to delay access, it can't be fast or it defeats the purpose. "They" have everything they need to unfreeze (otherwise why would freezing be necessary), so the only real protection you have is to forcibly delay access until you can prevent it.

anarazel• 9 years ago

It's not hard to come up with a scheme where it's fast to unfreeze when you have a key generated while freezing.

somberi• 9 years ago

https://washpost.bloomberg.com/Story?docId=1376-OV5NGV6JIJUQ...

perlgeek• 9 years ago

Some government agency should publish a list of all SSNs, thereby ultimately destroying the illusions that SSNs are secret.

If anybody still uses SSNs for authentication afterwards, they are grossly negligent.

swiley3• 9 years ago

They would need to publish it with names, I think everyone already knows their SSN isn't secret.

dfox2• 9 years ago

This is the case in many european countries. European VAT IDs are usually recorded in some kind of publicly accessible registry and usually build by prefixing ID of tax payer with country code.

For example in czech republic:

- everyboby has "birth number", which is more or less equivalent of SSN except it in clearly encodes gender and for most people also DOB.

- corporations and any entity that is licensed for trade (including sole proprietorships) have "ICO" (which somewhat funilly translates into "personal identification number"), in essence it is equivalent to US's EIN.

- any entity which directly deals with tax office has DIC (tax identification number), which for natural persons is "CZ" + birth number and for other entities is "CZ" + ICO, same string is also an EU-wide VAT ID.

Once you start a bussiness or even own part of non-tradeable public company (which includes things like homeowners association) all three of these numbers are readily available in various open access government registries, together with first and last name and usually with registered address and thus nobody uses knowledge of one of these numbers as serious authenticator (but from time to time it is used as kind of filter for who given bussiness is willing to deal with).

jonathankoren• 9 years ago

Not only this, but the entire banking system is fucked up. I have an account number and routing number, then I can do whatever I want to your account. That's bizarre.

gandutraveler• 9 years ago

I have friends who are twins and they both were issued same SSN number. Apparantly their primary key is first_name(first 6 chars)+last_name(first 6 chars)+DOB

swiley3• 9 years ago

I don't think that's quite right, the city you're born in is included as well.

PeterisP2• 9 years ago

Twins most likely have been born in the same city, unless the birth happened e.g. on a high speed train and they decided to file different birth places depending on the closest station.

clintonb• 9 years ago

How old are your friends? Now that there is a central issuer, rather than regional, the probability of generating duplicate numbers is quite low.

fogetti• 9 years ago

Here we go again. A new great example how the neoliberal thinking and narrative just simply fails on humans. You want to give your data to corporate America and assume that they will be careful about protecting it? Than I am laughing hard at you. SMH The stupidity of free markets and the myth of self regulation. Ridiculous.

That's why it's more important than ever that we support and implement new important initiatives like that of Tim Berner Lee's. He wants a platform that gives users control of their data. Very good idea IMO.

noir_lord2• 9 years ago

Free market should mean regulated to create a level playing field not no regulations at all.

Of course then you have regulatory capture to deal with but nothing is perfect

ThomPete• 9 years ago

I am pretty familiar with the idea and conceptually I am a proponent for it but the question becomes who pays for the hosting of your data, what's the incentives to get me to store it and for others to use only the data that I have?

I am also sceptic with regards to corporations having the data but government owning it doesn't make it much better.

In Denmark you mostly need to get access to one place in the system and you potentially have access to the data across the different verticals, Danish system is also SSN based.

The biggest problem though is what is the alternative to a credit bureau system?

noir_lord2• 9 years ago

We have an SSN equivalent in the UK called NIN (national insurance number).

I've never been asked for it as an authenticator though.

xioxox• 9 years ago

Banks do need it when applying for some accounts in the UK, in particular ISAs because of the tax implications. I've also had it requested by a share broker. A list of places that use it is here: https://www.gov.uk/national-insurance/your-national-insuranc... Note the pages says: "To prevent identity fraud, keep your National Insurance number safe. Don’t share it with anyone who doesn’t need it." !

benaadams3• 9 years ago

You need it so they can report it to HMRC who use it as an identifiter for tax contributions

chatmasta• 9 years ago

The NIN itself may not be an identifier, but a) you need it to open a bank account, b) it's definitely a security question for some banks, and c) you can use the NIN assignment letter from HMRC to your postal address as proof of residence.

dfox2• 9 years ago

The point is that in most of the world various government assigned IDs are just that: IDs and are usually used as such and when they are used as authenticators it is only for low-risk purposes and as an additional authentication check. On the other hand in US knowledge of SSN and few other bits of information is often all that you need to impersonate someone for pretty high-risk transactions.

LeifCarrotson• 9 years ago

I've never been asked for it as an authenticator though.

What are you asked for as an authenticator? Do you have a drivers' license number, or a tax identification number, or a birth certificate number, or a passport number, or some other national identification item?

A consistently formatted identifier that's unique to every person in the country just seems like it would be too tempting for businesses not to use.

DanBC• 9 years ago

We're asked for a complex hodgepodge of government issued ID ("who I am") and utility bills, benefit letters, etc ("where I live").

Here's the Gov advice for online services: https://www.gov.uk/government/publications/identity-proofing...

Here's how they examine ID: https://www.gov.uk/government/publications/recognising-fraud...

benaadams3• 9 years ago

Its illegal to use NIN by companies in the UK as an identifier or database key

benaadams3• 9 years ago

That's because its illegal to use NIN by companies in the UK as an identifier or database key

rado• 9 years ago

Damn you Russia

beager• 9 years ago

I’m sure Facebook, Google, and PayPal would all love to take over from the credit bureaus, and there are real reasons to be wary of that. Some people will tell you we should put it all on a blockchain, decentralizing the system and querying discrete pieces of information as needed. New solutions bring new problems, and there’s no perfect answer to any of it.

This is what concerns me most as we move from this to implementing solutions. We now have a glut of technology companies, some large and trusted, and many that will be created specifically to address this, that will permute the risk factors an pitfalls of such a business infinitely. One hundred companies doing credit bureau things means 100 places you'll have to put your sensitive info, 100 places that will have some different vulnerability, and 100 more targets on your attack surface.

Granted, one of these solutions may be sound, viable, secure, and advantageous to consumers. But the extant bureaus and any company that comes in to compete is a business, needs to make money, and will resist competition, will resist security over profit, and will never capitulate to a better competing solution until their last dollar is raised and spent.

Our entire credit bureau system is broken

Related Stories