Hacker News Reader

Comment by EvanAnderson | Hacker News Reader

It'll be treated just as stupidly as Social Security numbers, and soon we'll have biometric data breaches. >sigh<

Aside: Social Security numbers should be public now, too. That ship sailed a long time ago and it should be recognized.

What if people just publicized their own social security number, and then whenever they had to deal with "identity theft", they just pointed out that their SSN is public information and so it was negligent for the company to believe it was them just because of a SSN.

Most doctor's offices just use my name and birthday to assume authorization to transfer sensitive medical information. I kinda feel like privacy is massive "emperor has no clothes" aspect of society.

This behaviour is just because their IT system doesn’t allow regular users to search for names, just for birth dates. Then they pick you by name from a list of people with that birthday.

Names are not unique

So what? The person on the counter doesn't care at all about your privacy. They just cannot type your name into a search box, they have to ask for your birth date first before they can select you from a list based on the name that you state afterwards. At least that's the case at many doctor's offices I've been to.

What do you mean so what? How does asking for a name help if it comes back with a list of multiple people with the same name? Adding the birthday makes it (much closer to) unique

This is nowhere near the only use of the "birthday + name == all info" hack in the US medical industry. It's basically one big giant frat club with shakes and implicit trust all around. Except that it doesn't actually work; you can fake being a doctor to just about any US medical office and get nearly any American's private medical data.

Exactly. This is just snake oil. No idea why I'm getting downvoted for stating the truth: the employee doesn't care about privacy. They don't use the birthdate because they think it's more secure, the ask for it because they have to.

Just for the record, I think it’s a crazy idea to make things like DNA or fingerprints public. But a social security number is different. It’s wild how in the US, if someone gets hold of your number, they can do so many things with it. I’m from Sweden, and here we have a similar number called a personal identification number. The last digits are not secret but still sensitive. You can actually Google and find out almost anyone’s number if you want to, and it’s used for similar purposes. But it wouldn’t be enough to cause serious harm just by knowing someone’s number. Identity theft happens here too, but for a company it’s not much different from someone just having your name. It’s still a pain, but it’s nothing like in the US where your life can basically fall apart if someone gets your social security number.

Classic take on "identity theft":

https://www.youtube.com/watch?v=CS9ptA3Ya9E

poor netsec aside, at least I don't leave my social security number lying around every time I touch a door knob.

Hey now, at least I'm able to change my social security number and passwords.

Good luck changing eyes.

Changing your social security number is only slightly easier. Okay, maybe that's hyperbole. But having your SSN exposed isn't a good enough to be able to change it. You have to show it is actively being abused, and you can't address the problems another way.

Gotta rotate your access eyelenses every 3 months office policy incoming. /s

https://youtu.be/nAttA7gzhOI?t=41

Reply on news.ycombinator.com