Social Security Numbers Can Be Guessed 268
BotScout writes "The nation's Social Security numbering scheme has left millions of citizens vulnerable to privacy breaches, according to researchers at Carnegie Mellon University, who for the first time have used statistical techniques to predict Social Security numbers solely from an individual's date and location of birth. The researchers used the information they gleaned to predict, in one try, the first five digits of a person's Social Security number 44 percent of the time for 160,000 people born between 1989 and 2003. A Social Security Administration spokesman said the government has long cautioned the private sector against using a social security number as a personal identifier, even as it insists 'there is no fool-proof method for predicting a person's Social Security Number.'" Update: 07/07 00:01 GMT by T : Reader angrytuna links to Wired's coverage of the SSN deduction system, and links to the researchers' FAQ at Carnegie Mellon, which says that the research paper will be presented at BlackHat Las Vegas later this month.
Duh (Score:3, Insightful)
It was pretty obvious when my sister and I received sequential numbers.
Why guess? (Score:5, Insightful)
I could also see this technique being combined for some nasty phishing methods. Set up a fake credit check website, ask for their date of birth, the security question is their place of birth, and the last four digits of their social security number is their pin number. Using the technique of these researchers, you can guess a significant portion of people's SS numbers. 40% is probably a huge number for phishing, where most people avoid them, but by shear volume enough get caught to make money off it.
Re:good thing (Score:5, Insightful)
The problem is not that SSNs are easy to guess (Score:5, Insightful)
That is the problem when using SSN as ID (Score:3, Insightful)
If you use just a number for identification, it will be grossly misused. It is crazy to oppose a real ID card but use a much weaker (in terms of security) SSN as identification means and suddenly a baseless fear of certain forms of identification opens the way to very bad forms of identity theft.
Re:Damned if you do, damned if you don't (Score:5, Insightful)
Identification != authentication. Failure to understand that is the problem.
Take your e-mail account. Your username identifies you. Your password authenticates you. Your provider (and everyone else in the world) use your username or e-mail address to identify you or to identify who they're sending their mail to. But when you go to log on to read your mail your provider doesn't just assume that if you know who you are that you're authorized to read your e-mail. They ask for your password (which you don't give out to anybody else) to authenticate that you're really who you're claiming to be.
The basic problem is that a lot of businesses want to verify your identity, but they want to do it fast and not waste time or resources actually authenticating you. So they've taken shortcuts. And now it's biting them, and they want someone to make the problem go away. Note: they do not want to fix the problem. To quote someone, "When the users say "When I drop this bowling ball on my foot it hurts. Make it stop hurting.", they mean just that. They don't want to stop dropping the bowling ball on their foot. They want you to make it not hurt when they do.".
Re:Social Security Numbers As Identifiers (Score:3, Insightful)
Because Congress must pass laws to protect us from ourselves?
You can hardly call this protecting us from ourselves when everything from employment to apartment rental to cell phone plans to education require SSNs.
Re:Duh (Score:3, Insightful)
IIRC, around then the IRS started requiring you to submit the SSN's of minor dependents you were claiming as exemptions.
Re:Why guess? (Score:1, Insightful)
Credit is credit, and almost anyone can qualify for new accounts.
A good way to do this would be to advertise summer jobs right after college terms are over. College students are well known for being offered new credit constantly, and not keeping track of their credit rating at all.
Re:good thing (Score:2, Insightful)
Let me see, the FIRST 5 can be guessed by knowing place and date of birht and the LAST 4 can be overheard or read form paychecks etc.
Gee I think that gives out the whole err 5+4 = 9(!) digits doesn't it?
Re:Duh (Score:3, Insightful)
"What were the steps that led down the slippery slope of using them for identification?"
The problem is not that the SSN is used for identification, with very few corner cases is guaranteed to be unique, so it's a good candidate. The problem is when it's used for *qualified* identification, and not the number but just knowing it. That's the mad part. Proper nouns have been used for ages as an identificative token: "Hi, Joe, this is my friend Mike" and there's no problem with that (given a much limited scope, of course). But you really know that me calling myself "John Doe" doesn't give to that token too much authority.
The problem is not identifying somebody as being 1243839845B, which is not a bad idea provided there's only one 1243839845B and there's an interest on univocally identifying people (which is a different problem). The problem comes when all the comprobation you do is the like to "Hey, he must certainly be 1243839845B. How do you know? Because so he says".
This is in fact an acknowledged problem almost everywhere but USA: that's why you are identified as 1243839845B, not because you say so but because you say so *and* can produce an ID card with that number, your photograph and your fingerprints on it.
Disregarding the question of nationwide identification being good or bad (and in fact, USA has already disregarded this problem too or else the SSN wouldn't be used for identification purpouses) this news seems to be absourd out of USA: well, my ID number is 34980233, there you have... so what?
Re:That is the problem when using SSN as ID (Score:3, Insightful)
Not if the number of the real ID would be just its serial number and meaningless otherwise. Since the ID card itself is a proof of your identity, the number of it wouldn't be saved anywhere.
Re:Duh (Score:3, Insightful)
It was in writing; that's why "NOT FOR IDENTIFICATION" was on the cards. As with other well-known governmental entitites, they chose to change the agreement and inform complainers that they should be hopeful there would be no further changes. Whenever a law has potential for abuse, even if language is specifically written to preclude that abuse, instead
1) Assume they're lying.
and
2) Assume that even if they aren't, some future opportunist will break the promises made by the earlier legislation.
Re:Duh (Score:5, Insightful)
The problem isn't that you can't keep SSNs secret. (Score:4, Insightful)
The problem is that you're trying.
To extend, the problem the SSA mentions: using them as identifiers?
That's not what's causing all the trouble. You can do that all you like, and the only people you'll piss off are privacy advocates, worried about unwanted cross-correlation.
The *real* problem, as I note in a piece I wrote for RISKS DIgest last month [ncl.ac.uk], is people using knowledge of an SSN (or a mother's maiden name, or any other answer not *made up by the customer*) as an authenticator.
If it is discoverable, and you force a customer to use it, *you* ought to be responsible when someone does, and defrauds the customer, cause you were an accessory before, and now you're on notice; it's been posted here.
Have fun, retail authentication system designers. ;-)
Re:Why guess? (Score:3, Insightful)
Ahem...your employer definitely has a legitimate need for that information since they're taking money out of your paycheck to pay your Social Security. You won't get a job without an SSN, so write "N/A" all you like - makes the job market larger for the rest of us.
The SSN should not be on the employment application.... which was the point. Once you have been hired and are filling things out like I-9 documention and the W-4 forms that are explicitly for taxation purposes would the information have to actually be disclosed to an employer. Until then, the only legitimate purpose of asking for the SSN would be to use it for identification purposes... or to do things like performing a credit check on a future employee without their consent.
Still, it is something that would make you stick out as a potential troublemaker when applying for a job, and something that may be used as rationale for not hiring a potential candidate... even if demanding the information is illegal and could land the potential employer in legal trouble if a consistent pattern of turning down applications was based on this criteria.
Simple enough (Score:2, Insightful)
Re:good thing (Score:3, Insightful)
Are they actually used as a security device by people? Why do Americans think that SSNs should be somehow secret? What difference does it make if someone knows your SSN without knowing your other details?
The equivalent of SSN in other countries (e.g. the National Insurance number in the UK, DNI in Spain, etc) are not secret in any way, and it causes no problems whatsoever.
Really, if a company is stupid enough to just use your SSN to identify you, with no further checks, they deserve to be defrauded, and certainly couldn't use that as a reason to hold you liable for the fraud. They're not even unique.
Re:Social Security Numbers As Identifiers (Score:2, Insightful)
Using it for identity isn't that big a deal. Using it for authentication of identity is the problem.
Re:drivers license (Re:Duh) (Score:3, Insightful)
What's worse is, companies usually use the SSN for identification AND authentication. It would be like me using "Cro Magnon" as my ID and password everywhere!