Hacker News Reader

Comment by nxzero | Hacker News Reader

Given this is by the a US federal agency, it's interesting to me how the US federal consumer protection agencies never look at how much data the federal, state, local, etc. governments leak on the average person; for example, federal citizen identifiers reused as consumer identifiers, that is SSN numbers.

View on HN

"Reuse" of SSNs is not a 'leak' of privacy by government. They're not the ones giving SSNs to whomever asks.

By creating a system whereby everybody can be assumed to have a certain unique identifier, they put people in a situation where they can be made to divulge that number of various private purposes.

For instance, if a drivers' license didn't have a unique number, then stores couldn't be tempted to demand said number when processing a return.

It's akin to the difference between naive full disk encryption, and a true steganographic filesystem.

There's zero reason that SSN per entity shouldn't be unique, official use only, expire, etc.

Currently, SSN reveal detailed personal history when used by someone who knows how to read the encoding, which is public information.

Beyond that, use of SSN for non-official use is illegal, but the government doesn't do enforcement.

> how much data the federal, state, local, etc. governments leak on the average person; for example, federal citizen identifiers reused as consumer identifiers, that is SSN numbers.

Is it really the government doing this? It seems to me that it's businesses, not the government, that insist on using SSNs as consumer identifiers. While this drives me crazy, I'm not sure that it's reasonable to pin it on the government (which, essentially by definition, is the party that is intended to use them as identifiers).

EDIT: What delinka (https://news.ycombinator.com/item?id=12425976) said.

Except when businesses have to send information about a person to the government, in which case they have to use the government identifier to properly identify them. An example are employee records used for tax purposes.

I've read that many states sell their drivers license databases, as one example.

> it's interesting to me how the US federal consumer protection agencies never look at how much data the federal, state, local, etc. governments leak ...

And the private businesses security help, such as Google's, only talks about government and not business attackers.

Reply on news.ycombinator.com