Hacker News Reader

Comment by cmeacham98 | Hacker News Reader

Unless you are very young (read: born after 2011) your SSN can be trivially brute forced if an attacker knows where and when you were born, because those details were (before 2011) mapped onto 5 of the 9 digits in an SSN.

View on HN

You should assume your SSN is public anyway. There have been so many leaks, and it's not like a credit card where you get a new number if it is compromised.

Because it was intended as an identifier, not as a secret. The financial industry couldn't tell the difference between the two so now everyone tries to hide their IDs.

>The financial industry couldn't tell the difference between the two so now everyone tries to hide their IDs.

What's sad and funny is that the login page for "The Work Number" quite literally uses the following for their username field.

It wasn't even intended as an identifier. It's just an account number. "NOT FOR IDENTIFICATION".

https://media.istockphoto.com/photos/social-security-card-pi...

More accurately where you were born and when your SSN was issued (my brothers who are four years older than me got their SSNs at the same time I did). Some of us older folks were born in an era in which you didn't automatically get an SSN along with the birth certificate. And then there are people who weren't born in the US so will have had their SSN not matching birth year.

I also think it's less than 5 of the 9 digits that are reflected in this manner. That would not leave room for a lot of distinction in SSNs.

The first three digits are allocated in blocks to each state.

https://www.ssa.gov/employer/stateweb.htm

I'm guessing this is not a good thing if I am under the [NOT ISSUED] category but am definitely in the issued category?

In Italy you don't even need to brute force them, you can generate them because the algorithm is public.

Except same rare case of same name, same birthday, same place of birth, the generated code is always valid.

https://en.wikipedia.org/wiki/Italian_fiscal_code

Hate to break it to you but that’s 21 year olds now :)

[edit: so I program for a living. you'd think I know how to subtract to integers??? I /assume/ I read 2001? at least I hope I did]

You mean 11? This freaked me out for a sec.

2022 - 2011 = 11, not 21.

Reply on news.ycombinator.com