Nationalpublicdata.com hack exposes a nation's data
krebsonsecurity.com
krebsonsecurity.com
In case anyone didn't know, during the pandemic, that 1/year limit per bureau was temporarily changed to 1/week.
That temporary change was then made permanent last October.
https://consumer.ftc.gov/consumer-alerts/2023/10/you-now-hav...
I completely agree with Krebs's conclusion.
We can replace the role that the SSN plays (authentication) with modern techniques like public-key cryptography. We have the technology. The hard part is in figuring out how to implement it and getting the will to implement it.
This isn't specifically a problem of private industry. I've worked for the federal government, and I distinctly recall several times that they used my SSN to identify and authenticate me.
The government doesn't even follow its own instructions. Why is it surprising when others don't?
Providing a tuple of those values that match a record in the social security database, or the Experian or Equifax databases, does absolutely nothing to tell you whether the person applying for a loan/job/credit card/twitter verification etc is the human being who that SSN record corresponds to.
Doctors at a hospital will administer potentially deadly drugs using half of that -- just last name and date of birth.
They are shared secrets. They might be weak shared secrets. But alas, that's the issue with shared secrets. A lot of them suck.
https://en.wikipedia.org/wiki/Knowledge-based_authentication
Authentication is literally: any process used to verify the identity of someone. The definition holds no requirement for any level of certainty, or anything else for that matter.
Asking someone for their name and DoB is just weak authentication. The fact that is it not an adversarial scenario is why weak authentication works just fine for the use case.
This is an illustration why there is no such thing as a universally "good authentication" or "bad authentication". A good authentication design depends entirely on the specific problem being solved.
Metaphorically, yes they do. They're mainly checking they're in the right room talking to the patient whose name is on the notes in front of them. It's a checksum, not an identity challenge.
What does it even mean to "prove" identity? That's the million dollar question when designing an authentication system, isn't it? First you need to determine what level of certainty you're looking for. If you want to be really certain, a supervised blood draw and DNA test might work well. This method has proven to be overkill for the customer-only bathrooms at my local Chipotle, though. They've opted to use the much less secure 4-digit shared pin. My bank uses something in between the two. I guess they've seen my account, and know they can't get blood from a stone :)
A 9 digit shared secret is probably not a good authentication factor for launching a nuclear missile. It's also not great for handing out loans. But it's also probably overkill for accessing a Chipotle bathroom.
And a slight nit: SSNs aren't public. They are, of course, frequently shared, and easily compromised. But they are literally private shared secrets.
Would that we could (I mean political will, not technical capability) but let me tell you what is actually happening. We're replacing the identity provided by a secret number (SSN) with your phone number, and therefore your whole credit profile, your SSN, every address you've ever had, where you are standing right now, if you're in your home range (tower/wifi) and if you're actually clicking the approve this link from a device that they know. No one asked us, but we're ceding our privacy to push back against this threat.
Read the docs about the breach above, everyone’s SSN is out there. It’s as secure as your birthday or your dad’s middle name.
I think that would be a disaster. Have you met human beings? The idea that they could keep a private key safe and secure is not realistic at all.
[EDIT: As people in replies have pointed out, this works great provided there's a central government process for issuing a new card should you lose access to your previous one - so yeah, public-key cryptography can absolutely help here provided there's a central authority to help people recover access]
Same reason cryptocurrency could _NEVER_ become a mainstream way of handling finances - only the nerdiest of the super-nerds have the slightest chance of keeping a private key safe and consistently available.
Even the super-nerds aren't safe. The number of technically proficient people who've lost all of their cryptocurrency/NFTs/etc has illustrated that many times over at this point.
It's a private key that is only on the card. So it's totally possible. But there needs to be a will from the government AND a will from the people to allow the government to store data on their citizens (address etc).
Of course, all solutions comes with their own set of issues but preferring SSN over public/private keys for authentication is wild.
What solution do you think would work here?
In other cases, there's always either some secondary document check, or you need to pass some online quiz about your credit history. These quizzes are not bulletproof, but require the attacker to have a more comprehensive dossier on you.
That's Equifax, though. Other places do not verify you with all that much information. I opened a bank account at a local bank last year in person, and as far as I can tell, their verification consisted of photocopying my driver's license and pulling my Chex Systems report using my SSN. That really isn't much verification.
Unfortunately, documents can be easily faked [1]. Document check services are mostly a form of security theater. The "knowledge-based authentication" (KBA) questions are quite easy to get around if you have at least some basic information on your target. For example, the answer is often "None of the above". The last time I had to do them, 3 out of the 5 questions were "none of the above". The attacker doesn't necessarily need a complete dossier on you since they only care about making it work once. If it doesn't work on you, they'll just move on to the next target, who might have 4 out of 5 questions being "none of the above" and the other one being easy to guess.
My point about public-key cryptography is that we need a system that isn't easily spoofed and that provides much stronger guarantees. And the best part about public-key cryptography is that you can give out your public key widely without any issue. Giving out your SSN is inviting disaster. We can and should do better.
[1] https://www.404media.co/inside-the-underground-site-where-ai...
https://commission.europa.eu/strategy-and-policy/priorities-...
The problem is that harmonized, mandatory IDs are "problematic" to the left side of the political spectrum too. Undocumented immigration, voting-related wedge issues, etc.
California would probably be the greatest likelihood for success in this, but a big reason banks use other factors for identify verification is that those other identifiers work for all of their customers across state lines.
The media is kind of dumb, eh?
The data is pretty uninteresting and has a lot of duplicate records with slight variations in the street address. SSNs are essentially public data at this point, just freeze your credit.
(should be frozen by default but that's another conversation)
$ wc all-ssns-sorted-uniq.txt
272535129 272535131 2997533927 all-ssns-sorted-uniq.txt
Also, super important, but address history is in the leak, so all those sites that ask you about your address history to authenticate you need to knock it TF off right now.
... SSN has 9 decimal digits, so there are only 1 billion (or even somewhat less) of valid SSNs in the whole universe...
I bet they will also not face any significant repercussions, and they might even start selling their own online data security product.
I think Transunion is the only one that allows you to do this simply with your Transunion login; Equifax and Experian make it much harder.