Hacker News Reader

Comment by michpoch | Hacker News Reader

It still sounds like a good way to uniquely identify a person? How else would an institution confirm that it's talking about the same person?

View on HN

The same way they do for people who aren’t from the US?

Some combination of name, address, birthdate, etc.

But the problem isn’t using the SSN as a semi-unique ID. It’s using it for that and also assuming it’s secret. SSN shouldn’t be any more secret than name or address (and shouldn’t be used to unlock or access accounts).

> The same way they do for people who aren’t from the US? Some combination of name, address, birthdate, etc.

Plenty of countries have SSN-like numbers: https://en.wikipedia.org/wiki/National_identification_number

It's really not that special.

> But the problem isn’t using the SSN as a semi-unique ID. It’s using it for that and also assuming it’s secret. SSN shouldn’t be any more secret than name or address (and shouldn’t be used to unlock or access accounts).

Of course. Shouldn't it be trivial to sue any institution that uses SSN as a way to confirm your identity?

Shouldn't it be trivial to sue any institution that uses SSN as a way to confirm your identity?

You’d think, yet here we are, with one of the big three credit agencies letting people steal/resteal accounts with nothing more than some public info.

Isn't that like a classic American moment when you sue them and become a millionaire?

If only real life was like the movies. ;)

It is treated like a secret, so if you come to know someone else’s Social Security number (thanks to a thriving black market you can buy up plenty of them) that’s enough for lenders to start giving you money and then chasing down that other person to pay them back. Are you starting to see an issue yet?

Well that's another thing, I don't see why would you need to get rid of SSNs. You just need to add another layer that will confirm that you're the "owner" of your SSN. Seems pretty easy to do?

Agreed, except that nobody has done it. So SSN is your username and password anyways, despite everyone* knowing they’re all public knowledge at this point

*: except judges and juries, apparently

I didn’t propose getting rid of the SSN without replacing it with an actual, secure national ID. If that involves legacy SSNs still somehow whatever.

Some people (especially older women) don't know their own SSN, just their husbands'. If they never had a job, there wasn't much use for an SSN. And if their spouse passed away, they always had to use the deceased's SSN to collect survivor's benefits (or whatever it's called).

I've seen it more than once when working with health records: two people have the exact same SSN, but different sex. If I need to match records, I'll use SSN and birthdate, knowing even that's not immune to errors.

It's a terrible way to uniquely identify a person; it was never designed as such. For instance, there aren't nearly enough of them – they get re-issued all the time.

They don't get reused. See Q20:

https://www.ssa.gov/history/hfaq.html

It is used that way in Finland and a fair few other countries and works perfectly well.

Reply on news.ycombinator.com