Hackers may have leaked the Social Security Numbers of every American

https://www.engadget.com/cybersecurity/hackers-may-have-leaked-the-social-security-numbers-of-every-american-150834276.html

by dataflow • 2 years ago

127 182 2 years ago

engadget.com

ipython2• 2 years ago

What’s interesting to me is that the company, “National Public Data” is a wholly owned subsidiary of a company called Jerico Pictures (yes without the h)

What the heck business model explains a video production company owning personal data for practically every American? I feel like there is a lot more than meets the eye on this one.

nerdponx• 2 years ago

I agree that there's probably more to it than meets the eye. But a lot of companies are basically just holding companies that don't actually do anything economically useful on their own, eg IAC (the CEO of which is now lobbying for the removal of the FTC chairman).

beardyw• 2 years ago

It's said that the business assembles profiles for individuals by scraping information from public sources and then sells the data

... or a lot less than meets the eye

ipython2• 2 years ago

Yes but what’s a production company doing with that data? It seems an odd pairing.

And where are ssns posted “publicly”?

candiddevmike2• 2 years ago

Great, the sooner a 9 digit number stops being significant, the better. They were never meant to be a ubiquitous identifier/authentication token.

bluGill2• 2 years ago

They are a very useful identifier. However they only prove that someone with such a name exists. They are not enough to prove that the given person with that number is the unique person they say they are.

ddtaylor3• 2 years ago

It should be harder for you to impersonate someone else via their SSN than it is to take a stolen card and purchase a $5 coffee.

jimbob45• 2 years ago

They were never meant to be a ubiquitous identifier/authentication token.

But they de facto are and have been for longer than they haven’t. At some point, it becomes an abdication of responsibility by the SSA, no matter how much they kvetch about it being “not their problem”.

Levitz• 2 years ago

The case against using SSN in unintended ways is not the problem, I don't think there is any serious opposition to that idea.

The problem is the case for making a viable replacement for such usages.

underseacables• 2 years ago

What else is new? It seems every week there is some massive data dump of private information. Until people/CEOs start going to jail for lapses in security, that allow these hacks to happen, things will not improve.

briffle2• 2 years ago

or, we could stop using the SS number that you are required to give to people like employers as a de-facto national ID, and credit ID, and also a secret that just knowing seems to authenticate you.

next_xibalba• 2 years ago

Under what law would a CEO go to jail for being hacked?

ethbr13• 2 years ago

We could (and should) create a personal criminal liability for management over cybersecurity.

Specifically one that flows past the CISO and prevents that role from being a firebreak to insulate the CEO.

joelfried2• 2 years ago

We'd almost certainly have to write a new one, but there are several straightforward ways to do it if we had the political will. An off the cuff example that could certainly be improved:

Definitions: Government Identification Data includes Social Security Number. Bulk Extraction means any removal of data more than element by element. Unauthorized Third party means any person who the Company does not intend to grant access to. Intentionally Retaining means that a company chooses to ask clients to supply information which is then saved in a way accessible to the company for any reason in the future.

Law: Any company maintaining Government Identification Data must select someone as personally liable for the security of said data. If the company does not have a person who accepts personally liability, this liability transfers to the Chief Executive Officer of the company. In order for the liability to be considered transferred, the Company most keep on file a notarized copy of an affidavit accepting such liability Any company intentionally retaining any Government Identification Data must do so in a system that does not allow for Bulk Extraction by any Unauthorized Third Party. Failure to do so is considered Willful Negligence on the part of the company. Any company guilty of Willful Negligence herein described must forfeit the greater of 15% of their previous yearly revenue or 5 times the Gross Annual Compensation of the most compensated employee. In addition, whomever the company has selected as outlined above shall be incarcerated for no less than 12 months and no more than 60 months.

cen4• 2 years ago

Well the plebs are all in debt and have no cash to steal. They are already being exploited to the hilt by every mindless over optimizing corporate robot.

Its how the Elite are reacting to their data floating around is what should be focused on.

They aren't calling for changes in companies, cause companies are proactively running to them with "new services" to protect them and their families and well paid servant class (ie the exec class) who are all quite clueless and constantly get into all kinds of cyber trouble. Google "cyber concierge" services.

SirMaster• 2 years ago

Great, more training data for LLMs...

WarOnPrivacy2• 2 years ago

Hackers may have leaked the Social Security Numbers of every American

...thus making them available to the the only group left without easy access.

My larger point being that it's time to shift our concern from privacy - to disproportionate privacy.

It isn't randos who routinely harm/exploit us with our own data but those in power.

I suggest that equal privacy would serve us far better than privacy laws that target us and few else.

For equal privacy, the default starts out somewhere near: If you can see mine, I can see yours. If you're going to restrict just us, 1) you need to openly+clearly justify it and 2) the restrictions need to sunset.

batch124• 2 years ago

No, that's just giving up and is, respectfully, silly. How about some kind a right to privacy instead? Maybe I should have the ability to control who can sell my data instead of giving the same data I don't want shared to everyone?

WarOnPrivacy2• 2 years ago

Privacy equality applies permanent pressure to the powerful to protect everyone's data, instead of just their own.

We presently go law by law, and we have a bloody fight for each one with the final result typically varying between ineffective and counterproductive.

Eventually the system works as intended; we get exhausted and give up. This is the present state of affairs pretty much all over - and has been for a very long time. There's little reason to believe a different result is soon to manifest.

DataDive• 2 years ago

not sure what's with the downvotes

leaking all SSNs makes relying on SSNs as authentication unfeasible,

the only way to stop SSNs being authentication token is to give everyone access to them, but yes that can cause short term troubles

The concept of having SSN is de facto wrong, there are situations where one needs to identify oneself unambiguously

I went to another country, and what I found is that to get a monthly bus pass I had to fill out a form that asked for:

Full Name + Gender + Date of birth + Place of birth + Mother's Maiden name + Mother's DOB + Mother's place of birth

(and so on) I forgot the exact details, but it was ludicrously intrusive. Mother's maiden name? Really??? I did not even know some of that info and filled it out with educated guesses. It is not like they were able to check ...

all that information is just an unreliable SSN

fooqux• 2 years ago

There's been enough leaks from DMVs, credit bureaus, credit cards, and a myriad of businesses that require an SSN for verification checks by now that if every SSN wasn't already in the hands of attackers I would be surprised.

bee_rider4• 2 years ago

Has anybody ever gotten out of a debt by saying “I dunno why you think those credit cards are mine, everybody’s social security number is everywhere.”

I’d love to see a case like that. These data broker and credit bureau industries are obviously impossible to run safely and should be destroyed.

batch124• 2 years ago

Then it's called "Identity Theft", and deflected back to you as your problem to resolve. But, it's no big deal. I'm sure everyone everywhere qualifies for a year's worth of free credit monitoring.

thecapybara• 2 years ago

I'm not a lawyer, but I'd imagine that claiming that for cards that are legitimately yours would be considered fraud and would probably land you in more hot water than the initial debt would.

akdev1l2• 2 years ago

credit bureau industries are obviously impossible to run safely and should be destroyed

I am not sure I agree with that premise.

I would say there are literally no incentives to secure that data and no penalty for leaking it. Hence for profit businesses will never operate this securely.

I think it’s the same conclusion but a worthy distinction

op00to5• 2 years ago

Yes, this is actually a common way of getting out of debt. Often times the "proof" for a debt is lost in the tangled web of debt collection, and by the time someone comes around to collect, there's no tangible evidence the debt was valid.

It's a best practice to request proof of any outstanding debt before paying collections, and I've personally seen cases where friends have gotten out of a debt that went to collections simply by asking for proof, and when it wasn't provided, poof it went away.

I'm a sucker, and don't take advantage of this, but I don't blame anyone who does. Keep good records, and it won't be a problem!

Joel_Mckay• 2 years ago

Technically, there is legal precedent in Canada that concluded unsolicited credit services are not legally binding. i.e. unless you personally asked/signed a request for some service, it is illegal to issue a bill for that service. These laws were a consequence of early credit-cards mass-mailing campaigns that just issued debt products to random people. Today, many legal cons still issue bogus invoices to companies everyday for things no one asked for... and sometimes you have to be careful how you handle the response (ahem, Google appliances... cough cough...)

Accordingly, up North an individual is only responsible for a few hundred dollar fee under fraudulent use of a credit card situation. i.e. even if you don't catch the billing errors fast enough to lock your card, you are generally not responsible for a criminals use of credit services without your knowledge.

When we were starting out, I made the mistake of paying for our IP lawyers dubious Lexis Nexsus subscription for a year, and then was hit 4 years later with a collection agents bill (initially we thought it was a scam)... because the former employee just kept using the service. Note, because I had initially agreed to pay for the journal subscription, my lawyer said it was cheaper to just pay them the $14k to get the matter settled (we were displeased as you could imagine.)

The lesson here, is be very careful about saying "yes" to things when you don't fully understand the consequences. There are unethical people that make their income from legal shenanigans pulled on new businesses.

Have a great day, =3

jader201• 2 years ago

Yeah, at this point, I assume that anyone has anything they want on me.

From what I read, the best thing you can do is freeze all credit reports and add a PIN to your tax efiling.

fatnoah• 2 years ago

Don't forget the federal government itself. I've still got 1 year remaining from the 10 years of monitoring I got from the OPM breach wayyy back when.

Related, any company offering monitoring should be required to pay for a serialized version. The 10-20 or so settlements that require monitoring in my lifetime have been useless because I already have it for a longer period.

baseballdork• 2 years ago

Same. It works out every time there's some class action over a spill because I can show that I have the credit monitoring and ask for the $3 or whatever from the lawsuit. A few more years of leaks and I'll have enough to buy a lego set for all the trouble.

stephenitis• 2 years ago

Good maybe we'll finally pass a bill to give us better working public identification numbers.

loopdoend• 2 years ago

Be careful what you wish for.

vundercind3• 2 years ago

Unlikely. We have terrible, dangerous, expensive, painful de facto national ID, none of which bad elements hinder use of it (with associated government and private databases) for the purposes people worry about, but a huge segment of the right and a fair amount of the left won’t let us fix it because they fear a good version would be misused, and/or that it’s the “mark of the beast”. Never mind that the horse is already out of the barn I guess. So we’re stuck with a bunch of extra lost time and money for no reason.

mschuster912• 2 years ago

because they fear a good version would be misused, and/or that it’s the “mark of the beast”

I'm aware of and share the concerns about misuse (it has happened, see the tax ID debate in Germany), but what the fuck is that with "mark of the beast" relating to ID cards?!

candiddevmike2• 2 years ago

I think we can come up with a far more sophisticated solution than ID numbers using PKI. Whether that's a good thing or not is unclear.

dylan604• 2 years ago

Issued by who? The states vs federal ID is still a very polarizing conversation. I see no way that all 50 states will ever agree on the exact same system. Look at the RealID situation.

breadwinner• 2 years ago

Sadly, financial institutions will continue to use knowledge of your SSN and DOB as proof that you are who you claim you are. And if you're not, that's the problem of the sucker whose identity got stolen.

Financial institutions in America prioritize convenience over security.

ethbr13• 2 years ago

This is trivializing the amount of backend system migration that's required to change core identifiers.

If they could push a button and use new identifiers, they'd do that today.

However, in reality that means cracking open 50 years of code and systems.

kbolino2• 2 years ago

You don't need to change the core identifiers. You just need to stop treating (at an institutional and broader system level) mere knowledge of those identifiers alone as sufficient proof of a user's authenticity. For the most part, the 50-year-old hard-to-change code is already surrounded by other systems which can be adapted more easily anyway.

gedy• 2 years ago

Well, then these institutions can take more responsibility when their weak auth is exploited to defraud innocent people, vs "sucks to have your 'identity' stolen!"

giancarlostoro4• 2 years ago

What's better is congress wants to tackle piracy (which will never be stopped) by frivolous bills like SOPA, and make backdoors for encryption to "catch the terrorists / bad people" but nobody wants to fix identity theft. Heck, now we're all having to have stupid cookie dialogs on every website.

mschuster912• 2 years ago

The problem is that y'all unlike most/all of Europe don't have a requirement for people to possess a government issued ID card with a picture on it.

In Europe, we use these as "root of trust" - either in physical form or in electronic form.

Jensson6• 2 years ago

The problem is that y'all unlike most/all of Europe don't have a requirement for people to possess a government issued ID card with a picture on it.

You aren't required to posses one in Europe either, but you get assigned a unique number at birth to identify you.

Of course life is hard without identification, but there is no law mandating that you get one, at least not in all EU countries maybe some of them do.

trentnix• 2 years ago

Fortunately Social Security numbers aren't used for anything other than Social Security! Right?

Right???

PopAlongKid• 2 years ago

Medicare replace SSNs with a Medicare-specific ID, seems like a move in the right direction.

rjmunro• 2 years ago

It's fine to use them for disambiguation purposes. It's not fine to assume that just because I know someone's SSN (and maybe their DOB) I am that person.

hiatus• 2 years ago

The owner of Jerico Pictures, Salvatore Jr. Verini, also registered a new company this year called National Criminal Data LLC.

https://search.sunbiz.org/Inquiry/CorporationSearch/SearchRe...

donatj2• 2 years ago

The small private college I attended in the early aughts used your SSN as your student ID and it was printed on everything. Transcripts, official records, basically any piece of paper with your name on it. You'd even speak it aloud to the worker at the book store to pick up your books for the semester. It was everywhere.

As a kid twenty years ago, I was mildly bothered by it but imagined they must know what they are doing.

Looking back at near 40, with the hindsight of years, I'm flummoxed. Like, what the hell, who's absolutely terrible idea was this?

bshep• 2 years ago

Slightly related, my uni id was a prefix for the campus + year of admission + serial number

the serial number was sequential based on last name, you could essentially guess anyones student id if you had a couple of data points of last name : serial number

As far as I know no one used it for nefarious purposes, but it was a cool party trick to guess someone’s number.

soneil• 2 years ago

To be fair, that's pretty much the intended usage. The SSN is supposed to enable them to figure out exactly which John Smith they're looking at.

It's a serial number, not a shared secret. It sounds like your college treated it as such.

The real problem with SSN is the prevalence of unintended usage.

user3939382• 2 years ago

the intended usage

IMHO, as the name suggests, the intended usage is for social security. We're not supposed to have Citizen ID numbers which is why the number has been shoe-horned into this role.

Dalewyn• 2 years ago

The real problem with SSN is the prevalence of unintended usage.

There is nothing more permanent than a temporary solution, and nothing more temporary than a permanent solution.

bjtitus• 2 years ago

I would have sworn I've read the opposite but found this history [1] outlining usage of SSNs:

Private sector use of the SSN is neither specifically authorized nor restricted. People are asked for an SSN at banks, video rental outlets, hospitals, etc., and may refuse to give it. However, the provider may, in turn, decline to furnish the product or service, leaving some to conclude they have no real choice.
Throughout the history of the Social Security program, the SSN, originally intended to be used only to record Social Security earnings, has been adopted for other purposes, both governmental and private. The broad-based coverage of the Social Security program makes the SSN widely available and a convenient common data element for all record-keeping systems and data exchanges.

[1] https://www.ssa.gov/history/reports/ssnreportc2.html

stvltvs• 2 years ago

My dad etched his SSN on his tools back in the day. It was my student ID as well. Wasn't the SSN not considered secret until later when more transactions happened online instead of IRL where it was harder to impersonate someone?

The bad idea was to try to convert a semi-public number into a secret identifier.

HeyLaughingBoy• 2 years ago

I forgot all about that!

Back in the 80's, NYC had a program where the local police stations would lend you engravers so you could engrave your SSN on your TV, stereo, etc., so they could be returned if they were stolen and found. Probably also made pawn shops more reluctant to take them.

Guess it made sense at the time ;-)

stavros6• 2 years ago

The bad idea was to have a secret identifier in the first place. Who thought that "a ten digit number printed on a bunch of documents" was a good thing to use as sole proof of someone's identity?

alistairSH• 2 years ago

It was also my first DL number. Both colleges and VA DMV changed to calculated serial numbers around the same time (late 90s, IIRC).

But, to me, using SSN as a unique serial number feels correct. As somebody else mentioned, that's what it is - a serial number, not a shared secret. "Which John Smith are you?" is very similar to the VIN on a car answering "which Honda Civic?" SSN never proves that you are actually the John Smith you claim.

jhbadger• 2 years ago

In the 1980s, professors used to print out the list of exam scores and tape it on their office door so students could check their score (something younger generations would find quaint, I'd imagine). Because people might be embarrassed by their score, they were "anonymized" by student ID rather than by name. As in your case, our student IDs were our SSNs and nobody saw a problem with it yet (I'm a bit surprised that in your school's case they were still doing it in the early 21st century, but institutional inertia, I suppose).

giancarlostoro4• 2 years ago

I assume some schools today are still using SSNs as if its not a PII issue.

axus• 2 years ago

Had basically the same experience at a large public college. I had classes which would print out a list of SSN and test scores for everyone in the room to look at.

Before the Internet SSN was "presumed secret" but it became a tragedy of the commons. By 2000 it was the equivalent of your public key and should have been treated as such by institutions, never used as password like that bookstore did.

Student ID card would have been the right way to verify identity at a college; I'd forgotten the SID defaulted to SSN, which was also really lazy decision!

giancarlostoro4• 2 years ago

I bet they're still doing it ;)

donatj2• 2 years ago

Nope. They shut down in 2012 and their campus was taken over by a popular coding bootcamp.

jmclnx• 2 years ago

I hate to be this way.

Good! When Congress Critter's little blond granddaughter gets pwned (someone takes her identity), maybe Congress will get real serious about really punishing these Companies when a breach happens.

But we know what will really happen in this scenario, the Company will get funding (bailout) from the Feds, the CEO will resign with millions of USD, the CEO will become a lobbyist.

And in reality, the granddaughter will get special treatment from the Company due to who she is.

focusgroup0• 2 years ago

little blond granddaughter

what does an imaginary young woman's hair color have to do with cybersecurity?

practicemaths• 2 years ago

Simple. American society tends to value blond white girls more.

Notice you didn't question what the gender of the grandchild.

snek_case• 2 years ago

People are more sensitive to the pain of others when the victim is perceived as cute. See cute animals vs not so cute animals. We're instinctively wired to think that cute means innocent, helpless and deserving of help and protection. Obviously what is considered cute is subjective and culturally influenced to some extent.

vvpan• 2 years ago

https://en.wikipedia.org/wiki/Missing_white_woman_syndrome

Kon-Peki• 2 years ago

When Congress Critter's little blond granddaughter gets pwned (someone takes her identity), maybe Congress will get real serious

LOL. Congressman Danny Davis' grandson was murdered by someone who wanted his shoes and Congress didn't even care enough to yawn.

samier-trellis2• 2 years ago

Murder is already illegal.

know-how2• 2 years ago

How about we punish the bad actors and their state-sponsors?

laweijfmvo• 2 years ago

How? Sanctions? War? What do you suggest?

gosub1005• 2 years ago

Cause it worked so well in Iraq?

imwillofficial• 2 years ago

This kind of racism is ok here?

arolihas• 2 years ago

how is this racism

nar001• 2 years ago

This isn't racism

dgfitz2• 2 years ago

Someone mentioned a skin color, must be racist!

Man, the internet sucks these days.

prmoustache• 2 years ago

Since it was written with sarcastic tone I think it is less racism than a testimony of systemic racism.

slackfan• 2 years ago

They're against $specific_group, they can't be racist.

BoredPositron• 2 years ago

I have identity protection from three different leaks now...

bloomingeek• 2 years ago

Most of my life my SSN was also my drivers license number. Then my state a few years ago changed the numbers. Great! Now some hotels want to copy both sides of your license before renting you a room. My doctors office and local hospitals copy them too.

A few years ago, Capital One credit cards wouldn't let us pay our bill online, which we had done for several years, unless we sent them a copy of both sides of our DL's! I called them and said no thanks and they said I would have to began paying through the mail. We paid off both cards and canceled them.

Have said all this, it's prob just a matter of time before my DL number is hacked by someone through some weakly secured site.

op00to5• 2 years ago

My DL number is predictable if you know my name and birthdate and when I got my drivers license. :D

nesky• 2 years ago

What state has drivers license numbers the same as your social security number?

ezfe• 2 years ago

Many states have done all or part of the social security number on drivers licenses. Thankfully not ones I've lived in, but a Google search will yield lists.

5555624• 2 years ago

Now? None. I believe they've all done away with it. In the past, quite a number of states. Mine was originally; but, I was able to change it in 1995, when Virginia began offering people the choice of SSN or a DMV number. (It was the result of efforts by the ACLU and others.)

dhosek• 2 years ago

Back in the 80s, University of Illinois at Chicago used SSNs as student ID numbers. Until you memorized your five-digit userid (I was U10754) you could login with your social security number, so I would type [just kidding].

op00to5• 2 years ago

I do not care. My SSN has been leaked for a decade at least. I have freezes on all my credit history. I file my taxes with a PIN. I need photo ID to get medical treatment and get it billed to my insurance. SSN is not the secret thing it once seemed to be (but never really was).

neilv• 2 years ago

The data, which is unencrypted, is believed to have been obtained from a broker called National Public Data.

I'd be happy to join a trillion-dollar class action lawsuit against whomever assembled this data without securing it.

OJFord2• 2 years ago

I've never really understood why it's supposed to be considered secret but also has to be given out sometimes and also can't be changed unless in witness protection.

(Information all from Hollywood.)

Other countries don't seem to have this problem? You can have my bank account number, driving licence number, passport number, national insurance number if you want?

BobaFloutist2• 2 years ago

It's because Americans have a libertarian streak and instinctively mistrust the government, so we've historically resisted any sort of federal ID program. Because the federal government has to keep track of you somehow, and every American (more or less) already had a unique identifying number, the government started using those unique identifying numbers to identify us for tax purposes. This started being a convenient way for private corporations to ask the government "Wait, who's supposed to be identified by this number?" for employment and loans, and then people decided that it would be better to use this instead of any sort of, you know, online ID, to identify people for credit card applications.

bbarn2• 2 years ago

The lack of a federal ID is almost irrelevant at this point. Most states have moved to "Real ID" which requires almost as much if not the same to get as a passport (federal ID). Requirement to have that has been coming (and admittedly pushed back several times) for a long time.

OJFord2• 2 years ago

I'm British, we've also resisted it, which is why the closes thing to a national identity document I listed was a driving licence or passport. It's not uncommon to have a provisional driving licence (learners' permit to you I think) purely for the purpose of being IDd for alcohol or whatever.

For tax I would use my national insurance number and any form of photo ID to register for an online account, or you can do a paper form but I don't know how they verify identity if you're claiming a refund in that case.

A credit card application would similarly want a copy of photo ID and probably a proof of address (like a bank statement or utility bill).

There's nothing wrong with having the number, I have a national insurance number, I have Self-Assessment Tax Return numbers (I think it's unique each year), it's the secret bit I don't get.

red-iron-pine• 2 years ago

It was also heavily rejected as a "number of the beast" by far right Christians -- who are consistently able to get guys like GW Bush and Trump elected.

No one on the left really cares that much -- they have their own sacred cows and causes of the year -- so nothing really changes.

UniverseHacker• 2 years ago

Maybe we can finally stop using the SSN as if it were both a public and private key...

doctoboggan3• 2 years ago

A few weeks ago I started receiving notices that my SSN was detected online by the identity monitoring company I use. I guess this is the source of that.

Around a year ago my identity was stolen (new CCs opened in my name). At that time I froze my credit on all 3 of the agencies. It's easy to turn it off/on with a switch so I have left it frozen. Its a good feeling knowing that no one can open a new CC in my name.

nytesky• 2 years ago

I had mine frozen and after a few years they seemed to forget my keys to unfreeze it. I use a password manager so maybe I messed it up, but it is very fragile.

Another credit bureau says I don’t exist despite dozens of credit cards, 4 mortgages, and student debt. They need me to fax a copy of my license to prove I’m a real person.

xyst2• 2 years ago

and a state license is very easy spoof/fake especially over lossy formats like email/fax

barkerja• 2 years ago

What service are you using that provides a single "switch" for all 3 agencies?

doctoboggan3• 2 years ago

Unfortunately, you have to make accounts on each agency. You need to find the way to "freeze" on each site. They will try to sell you a "lock" option, but the "freeze" option is free (federally mandated).

gosub1005• 2 years ago

That may stop someone from opening a CC in your name, but not someone impersonating you to get a driver's license or sign up for government benefits or rent an apartment (not all of them run a credit check).

xyst2• 2 years ago

Have been reluctant to use the nuclear option of freezing my credit, but since it’s likely my name, social security, and address are available from at least 1 or cross referenced between leaked and OSINT sources. It would make it trivial to open new lines of credit.

So time to freeze:

- experian

- TransUnion

- equifax

- Chexsystems

Am I missing anything else?

doctoboggan3• 2 years ago

I only did the top 3, haven't heard of "Chexsystems" before.

agpl3141592• 2 years ago

And why is one magic number so critical?

No one checks who uses that number? How is that even a thing?

yoyohello13• 2 years ago

Oh No! \s

As if SSN wasn't already the most insecure form of identification on the planet. Maybe now we can stop pretending it's a valid form of identification.

ddtaylor3• 2 years ago

I'm from the USA so I don't have great perspective here. Don't other countries have basic secure chips in their cards? Don't they attenuate or whatever similar to how NFC works?

I mention it because I have little hope in going after the scammers legally or playing cleanup later.

itslennysfault• 2 years ago

Mine has been leaked so many times at this point that I'll openly share it with anyone that wants it. Anyone here want my SSN? Just DM me. <3

breaker-kind• 2 years ago

when i went to jail in boston (peaceful protest), BPD wouldn't release us until we gave them our social security numbers. when we showed up to court, they gave everyone a packet that contained the name, home address, mugshot, and social security number of everyone that was arrested. half of the time of the court proceedings was the NLG saying hey, what the fuck are you doing? can you please redact this?

geor9e• 2 years ago

mirror of the leaked data:

   awk 'BEGIN{for(i=0;i<=999999999;i++)printf"%03d-%02d-%04d\n",i/1000000,i/10000%100,i%10000}'

bananapub• 2 years ago

why has the US government never forbidden anyone else using it?

is it just the usual "the US government is catastrophically compromised by the private data monetisation industry"?

thenumchk• 2 years ago

The distribution of SSN numbers in the US is well known including the special use for railroad and US territories with sequential numbers. I dissected much of that through historical publication of the death master database and made a lookup for it at https://numchk.com/ as a fun side project.

patrick4512• 2 years ago

Social Security numbers should simply be banned.

bankcust08385• 2 years ago

The sooner Americans don't have an unauthenticated, reused, primary key and serial number, the better.

Hackers may have leaked the Social Security Numbers of every American

Related Stories