Become a fan of Slashdot on Facebook

 



Forgot your password?
typodupeerror
Privacy United States Security Social Networks Politics

US Studying Ways To End Use of Social Security Numbers For ID (securityweek.com) 311

wiredmikey quotes a report from Security Week: U.S. officials are studying ways to end the use of social security numbers for identification following a series of data breaches compromising the data for millions of Americans, Rob Joyce, the White House cybersecurity coordinator, said Tuesday. Joyce told a forum at the Washington Post that officials were studying ways to use "modern cryptographic identifiers" to replace social security numbers. "I feel very strongly that the social security number has outlived its usefulness," Joyce said. "It's a flawed system." For years, social security numbers have been used by Americans to open bank accounts or establish their identity when applying for credit. But stolen social security numbers can be used by criminals to open bogus accounts or for other types of identity theft. Joyce said the administration has asked officials from several agencies to come up with ideas for "a better system" which may involve cryptography. This may involve "a public and private key" including "something that could be revoked if it has been compromised," Joyce added.

US Studying Ways To End Use of Social Security Numbers For ID

Comments Filter:
  • Step one and two. (Score:4, Interesting)

    by msauve ( 701917 ) on Tuesday October 03, 2017 @09:30PM (#55305329)
    Unlink SSN from TID (Taxpayer ID). Banks need TID, they have no business with SSN. Unlink SSN from healthcare (it wasn't legallay required until Obamacaare, although healthcare providers used it).
    • by aaarrrgggh ( 9205 ) on Tuesday October 03, 2017 @09:50PM (#55305471)

      Doesn't solve the problem though. You still have high-value information linked to the TID, which ultimately is the root of the problem.

      Ultimately you need the TID to be unique to each taxpayer, and a subset/hash of the TID plus additional information to be linked for other (financial) purposes. The IRS should be the only ones able to re-associate you to a unique qualifier.

      But, until you eliminate the profit motive for credit bureaus everything will end up being re-assembled. Back to square one.

      • by msauve ( 701917 )
        "Ultimately you need the TID to be unique to each taxpayer"

        Uh, it is.
      • But, until you eliminate the profit motive for credit bureaus everything will end up being re-assembled. Back to square one.

        Then you need to come up with a better solution for how borrowers can extend credit and assess risk. Credit bureaus don't collect and maintain this information for no reason, they do so because lenders can make better decisions with that information and they only care about that because people want credit for all manner of things. The information isn't profitable in and of itself, merely as a byproduct of helping lenders make better decisions. It can be used for all kinds of bad things, but that's true of m

        • Then you need to come up with a better solution for how borrowers can extend credit and assess risk.

          With a compass, watch, and sextant - like they used to do before. Oops, sorry, wrong story.

          I mean by doing it themselves, like they used to before.

      • by Kjella ( 173770 )

        Doesn't solve the problem though. You still have high-value information linked to the TID, which ultimately is the root of the problem.

        Truth is that most places would also need other information like name, address, phone number etc. that's pretty good for linking up information. The issue is thinking that a SSN or any other ID number is a good secret when you constantly need to share it with people. It's the 21st century, you're issued an electronic ID and make digital signatures. That's what Estonia does through e-identity [e-estonia.com], it's what we do here in Norway through BankID [bankid.no]. I can show you my driver's license, but having my national ID number

    • by perpenso ( 1613749 ) on Tuesday October 03, 2017 @10:07PM (#55305567)
      I was thinking about a White House petition for Virtual Social Security Numbers:

      Virtual Social Security Numbers
      Single use numbers that are aliases for your real number.

      To protect consumers from fraud and theft many banks now offer Virtual Credit Card Numbers. They are aliases, pseudonyms, for a real credit card number. They “lock” to the first merchant to use them. If a merchant’s database is compromised and a virtual credit card number is exposed, it is unusable. All charges not originating from the first merchant are declined.

      The Social Security Administration could use a similar scheme to protect employees and consumers. A Virtual Social Security Number could be given to an employer or financial institution and the number “locked” to that organization when they verify the number with the government, submit information to the government, etc. If a different organization then tries to verify or use the number the government will fail to verify, reject the submission, etc. This would help impede identity theft and financial fraud as employers and financial institutions inadvertently expose employee and consumer information.

      Virtual Credit Card Numbers are generated as needed using a credit card issuer’s online services. Virtual Social Security Numbers could similarly be generated as needed by the Administration through its online services.

      The Internal Revenue Service could employ a similar scheme for their various taxpayer identification numbers.
      • and to effectively voluntarily change your SSN, rendering the original number completely unusable:

        To avoid disruption of existing users of the real social security number the real number would remain valid for all users prior to the use of the first virtual number. After the use of the first virtual number existing users of the real number are “grandfathered” but any new organization using it will be disallowed. A consumer may have the option to disallow all use of the real number, requiring
    • Re:Step one and two. (Score:4, Informative)

      by arglebargle_xiv ( 2212710 ) on Tuesday October 03, 2017 @10:14PM (#55305651)

      US Studying Ways To End Use of Social Security Numbers For ID

      Am I the only one who's immediate reaction to that is "Well, no shit, Sherlock".

    • Unlink SSN from healthcare

      If a SSN is not linked to healthcare, what is its use really??

    • Step three (Score:5, Insightful)

      by Solandri ( 704621 ) on Wednesday October 04, 2017 @12:17AM (#55306093)
      Make the companies who lost people's identity data in hacks pay for it. All of it. They're the ones who broke SSNs. They should be the ones who pay to fix it.
    • by Z00L00K ( 682162 )

      The problem isn't the SSN, the problem is that it's not used in a proper way to assert identity.

      Use the SSN to look up additional infornation to validate the identity of the person like biometric data and full name and match that to the person that's trying to get some service.

      Then also use capital punishment for ID theft, that would make offenders to think twice before they mess up things.

    • Why? Simply eliminate the TID. The government doesn't need more than one key to use in a database. The issue here isn't the fact that these numbers are used, it's the fact that any single identifier is used for identification and authentication.

      Any system built on this basis is too easy to abuse.

  • National ID? (Score:5, Insightful)

    by borcharc ( 56372 ) * on Tuesday October 03, 2017 @09:31PM (#55305337)

    Sounds like another attempt at a national ID. I am sure it will go as well as all the past efforts.

    • Re:National ID? (Score:5, Insightful)

      by 93 Escort Wagon ( 326346 ) on Tuesday October 03, 2017 @09:36PM (#55305373)

      We already have a national ID - it's called Social Security - so what's the objection to another one?

    • Re:National ID? (Score:5, Insightful)

      by Nethemas the Great ( 909900 ) on Tuesday October 03, 2017 @10:39PM (#55305759)
      At some point the "States Rights," "Big Brother," "Don't Tread on Me" folks are going to have to concede the fact that they're US citizens and need to have a unique identifier as such. With rare exception, US citizens have already been assigned a unique identifier by default with their SSN. By their perpetual protests against a nation ID they've forced governments and NGOs to this lowest common denominator to everyone's detriment.
      • It's painfully obvious why a national id is a bad thing. There are people on both left and right who think it is a bad idea.

        Another document you have to carry - "papers, please"
        Instantly used for voting and other government services to filter those who can get them. That's racist!
        YA form of ID to renew
        Simple way to make noncompulsory things compulsory - census responses, selective service, jury duty

        Just another step toward totalitarianism and the utter devaluation of human liberty. Fuck that. No one wan

        • Re:No, we don't. (Score:5, Insightful)

          by OneAhead ( 1495535 ) on Wednesday October 04, 2017 @08:20AM (#55307249)

          All theories that sound reasonable on paper but are utterly divorced from reality. Only useful for keeping people dumb, just like in the totalitarian dystopias you so decry.

          If you ever step out of your mom's basement (real or allegorical) into the scary, scary world, you'll notice that the US de facto already has this. In most of the country, you can't get anywhere without a car and you can't drive without a driver's license. And folks without one readily get a state ID because in most of the US, you literally can't even do as much as buy a beer without either. Also note that a lot of western European nations have national IDd, and are politically further away from totalitarianism than Ameristan, with (among other things) protection of personal privacy that still has some semblance of meaning. Do you really honestly believe the fact that there's formally no national ID is much of a hindrance to US government services intent on tracking their citizes?

          On a more anecdotal note, I subjectively felt/feel far freer in Western European countries with state ID than in the USA; among many other things, I got ID-ed almost an order of magnitude more often in the latter country. Sure, I could in theory have refused and suffer the consequences, but that "in theory" is exactly why the US is so backward - you conservatives/libertarians/whatever should really get your feet on the ground and start talking in real life terms instead of lofty theoretical concepts that are hollow and being circumvented right under your firmly airborne noses.

          And don't even get me started on SSNs; when I read this story, I rolled my eyes so hard that it was almost audible. Assuming you don't dedicate your life to paranoidly protecting your SSN, its security is an illusion. You know as well as I that your SSN is pretty much everywhere, and identity theft rates are only as "low" as they are because most criminals find it easier to rob people at gunpoint than to jump through a few loops in order to steal the ID of someone who more often than not will turn out to have more liabilities than assets.

          I guess you grew up with it and you'll never understand how utterly bizarre it is to foreigners that there exists a simple 9-digit number that has such huge power over a lot of aspects of your life that it may be your biggest secret, YET YOU HAVE TO FILL IT INTO SOME FORM OR SPEAK IT OUT ON THE PHONE ON A MONTHLY BASIS. Hello? Is this thing on?

          • by HBI ( 604924 ) on Wednesday October 04, 2017 @10:06AM (#55307793) Journal

            Somehow, I made it out of my parents' basement over the past 48 1/2 years. In the process, I got a clearance and roll with more background checking and additional ID than most people will ever have. None of that makes me feel even slightly safe, because I know it's all bullshit, really. It doesn't protect against espionage, identity theft or anything else, really. Moreover, the aggregation of key information into a single database is what enabled the OPM breach that gave it all away to (presumably) the Chinese. So some guy in China now knows everything about me, including my personal contacts and whatever data the USG gleaned during my background investigation.

            I subjected myself to this, and I really only have myself to blame for being captured in the OPM hack. People shouldn't be forcibly subjected to this for zero gain in any critical way. And the data won't remain secure. That much is obvious, now. Governments cannot secure electronic data.

            There's lots wrong with the system, but an ID card with crypto isn't going to fix anything, just make things worse.

      • Re:National ID? (Score:5, Interesting)

        by chill ( 34294 ) on Wednesday October 04, 2017 @08:04AM (#55307183) Journal

        So, use the driver's license as the identifier. You have to physically go into the DMV and prove your identity to get one -- just like now. Nothing's perfect for this step, but this is one of the more workable and accurate systems so far.

        Change the cards to be PIV/CAC/HSPD-12-style smart cards, so they can store a private key unique to the individual. These can be used for legally binding digital signatures.

        You end up with 56 or so "certificate authorities" -- the 50 States, the various U.S. possessions and territories, and the Federal Gov't themselves. States already can validate each other's DL numbers and records in real time.

        This deals with the concerns of having the big, bad central government in charge of everything yet still provides for a workable, federated system.

    • by clovis ( 4684 )

      Sounds like another attempt at a national ID. I am sure it will go as well as all the past efforts.

      One problem isn't that the details of your identity are not a secret and actually can't be a secret or it would be pointless to maintain. The problem is that the institutions that ask for your identification, SSN, phone number etc, are getting that information from whoever is making the application and the institution really has no way to verify that the you are the person you claim to be holding the documents for.

      What I want to do is indeed have something like a national ID, and in an accessible database t

      • From TFA:

        This may involved "a public and private key" including "something that could be revoked if it has been compromised," Joyce added.

        This problem has already been solved many times already. A randomly generated private key, and an associated public key for validation. That's all that's needed. The private key stays secret from *everyone*. The number never leaves the enclave in your card, and can't be extracted. A simple USB-based reader can perform authentication via a computer or smartphone. There's no need for anyone to EVER have access to that number, since all they need is the public key for validation. Thus, the risk

        • If your card is stolen and you need a replacement, how do the authorities know that you are the legitimate card holder and not the guy who stole a card and then, pretending to be you, requested a replacement?

          It seems to me the only way to absolutely identify a specific individual is to use some hopefully unalterable biomarker, if there is such a thing, such as a DNA sequence. Imagine the protests that would ensue when everyone is ordered to hand over DNA samples to the authorities so they can issue new gov

    • Well technically a SSN has been used because, for many developers, it's the only well documented, truly unique identification that each US citizen has that is universally used throughout the US.

      SSNs weren't really a problem until the banks tied the numbers to individual's credit or debt that is causing the problem.

      • by DarkOx ( 621550 )

        No the problem is really simple, the problem is using the SSN both as identification and authentication. You should think of your SSN the same way you think of your name. The only difference is SSN is more uniq.

        If anything the government should issue cards with private keys associated with your existing SSN. The proof of your identity would be your ability to cipher (nonce + SSN + timestamp) or something similar and the bank, SSA, IRS, etc would determine its really you by deciphering with the public key

  • by Maxo-Texas ( 864189 ) on Tuesday October 03, 2017 @09:35PM (#55305363)

    You'll be able to conveniently use your social security number to get your new id number.

    • Which is fine actually if it's a one time thing. Everything is always bootstrapped from something else, you can't generate trust or identity any other way.

  • by Anonymous Coward

    Clearly says "not to be used for identification purposes" on it. I guess its an oldie.

    • by iTrawl ( 4142459 )

      It's probably seen as a historic artefact, similar to the phrase "I promise to pay the bearer on demand the sum of [...]" as seen on paper money, since nobody in authority is actually enforcing it.

  • So, like, you'd go to the SSA website, and they'd give you a string of digits. And you take this string and give it to banks or whatever, and they type it into the SSA website and that brings up who that is associated with. And the owner can revoke their string at any time and replace it with a new one. Better yet, make them all one-time-use, it's not like I REALLY need to use my SSN very often.

  • by aaarrrgggh ( 9205 ) on Tuesday October 03, 2017 @09:43PM (#55305421)

    Blockchain. All the cool kids are doing it! Say it with me... Blockchain!

  • About friggin' time! (Score:5, Informative)

    by Ungrounded Lightning ( 62228 ) on Tuesday October 03, 2017 @09:45PM (#55305431) Journal

    About friggin' time! I've been doing my best to avoid giving out my SSN where it's not required by law since the '80s.

    One big hole that has been going on for decades is Medicare:

      * Once you're old enough to be on it, you can't get regular health insurance to pay for the portion of your medical work (often all or the bulk of the cost) that Medicare pays for. Regular health plans turn into cover-the-difference supplements. You must sign up for Medicare or pay the charges yourself. (And if you don't have the government imposing price levels or the insurance companies negotiating deep discounts you get to pay the drastically inflated "regular price" that makes up for their discounts.)

      * But if you DO sign up for Medicare, what do you get for an ID? Your SOCIAL SECURITY NUMBER with a single letter appended after it. They won't provide any alternative (though they have "been thinking about it" for years). You have to give this to ALL your medical providers. Get a prescription or an immunization at a pharmacy, hand in your Medicare ID. Go to a doctor, hand in your Medicare ID. Get a lab test, hand in your Medicare ID. Go to a specialist, hand in your Medicare ID.

    Dozens, or even hundreds, of medical billing paperwork operations, with unknown numbers of clerks doing data entry (often offshore) and unknown competency of IT people configuring their databases, get your name and SS#. Some have even been CAUGHT selling them. Oops!

    * So then we get stories about how people over 65 have a much higher rate of identity theft - typically trying to imply that these oldsters are lax in guarding their SS numbers. Well, DUH!

    • by msauve ( 701917 )
      People need to fight back. Equifax leaks? That should be a problem for lenders, not individuals. PROVE it was me, and not someone giving you my info to take out a loan or ???. Reporting credit issues to any of the 3? That's libel (deliberate, you should know better) without that proof. It's their own damn fault for building a house of cards because it's cheap and easy.
      • Reporting credit issues to any of the 3? That's libel (deliberate, you should know better) without that proof.

        Nice idea.

        But truth is an absolute defence against claims of defamation (libel or slander). Seems to me you have a case if, and only if, the information reported is wrong (and the burden of proof for that would be on you).

        I like it: A raft of libel suits could make the cost of doing business as a credit reporting agency high enough that it might finish off the business model. (And the time to hit

        • Seems to me you have a case if, and only if, the information reported is wrong (and the burden of proof for that would be on you).

          No it wouldn't. That would require proving a negative.

          If a newspaper printed a story about you fucking goats could you prove you don't?

  • Time to implement? (Score:4, Interesting)

    by vlueboy ( 1799360 ) on Tuesday October 03, 2017 @09:45PM (#55305433)

    Practically half of us are already hacked NOW.
    When would something be implemented even if a standard were already agreed upon and mandated? I get the feeling this will be treated like Android security where if you don't invest in X flagship, which is optional and expensive, you're just not covered. 140 million is nearly half of all US citizens. I'm pretty sure we can't just reprint all our forms, reprogram all our websites, rework all our databases and change the mentality towards accepting the new name and (hardest of all) technical requirements of the new setup.

    All in all, we need a solution (whatever it is) Yesterday, but even in 1, 3, 5, 10 or 15 years I can't see it really in place (there is failure inertia of British / Metric conversion proportions here). Reminds me a bit of the stupid job we've done when it comes to the spirit of the law for chip&pin Credit cards, being optional and all and totally backward compatible to the old insecure method when the card gets stolen to pay for something online without you there (which is the point).

  • by Anonymous Coward on Tuesday October 03, 2017 @09:55PM (#55305507)

    There's nothing wrong with using SSNs for ID. A unique number for each person in the country? Perfect.

    The problem is when it gets treated as a secret, and abused for "authentication". It's not a secret, any more than your date of birth is a secret. It should be treated as publicly available information. Merely "knowing an SSN" should not be sufficient information to do much of anything, except possibly "give someone money".

    • You sound like those idiots that say "MAC addresses are unique, let's use them as an identifier."

      Neither your MAC address nor your SSN is a unique identifier.

      In fact, identity confirmation is quite difficult, and as an AC I can say that you are totally clueless when it comes to the various issues of identity.

      Maybe you should let the adults talk and keep your head down.

    • This.

      A Social Security number is a username, not a password.

      Having a mere SSN should not be enough to authenticate a person is who they say they are, it's just a way to tell me from you. Any person or system using a SSN as proof of identity is just plain lazy - especially since SSN is now practically public domain information. (Thanks Equifax!)

  • Banks and businesses require customers to hand over their SSN, despite it being tagged "Not for use as identification", and then subsequently lose them in breaches. Government says let's replace SSN with something else - let's call it SSN2. What do you think will happen next?

  • Since the SSN only has 10 digits and there are 300 million citizens it means (ignoring any restrictions on numbers) that
    one-third of the possible values [and possibly effectively many more] are used up. All you need do if you need an SSN and expect it
    will not be checked by the Social Security Admin is... guess. And someone will get tagged with that data. With a high probability. That's not good.

    • Well, except that with the checksums eliminate half the valid numbers off the bat. So, you're looking at 60% off the bat. Except there are 337M citizens, so 67.2% gone . Then, you get into dead people who had SSNs (with imperfect recycling). And there may be other restrictions, but even without those the odds that any well-formatted SSN was ever issued has to be at least 70%.

  • Start with a US birth certificate.
    The start to request banks, building societies show the same person exists. Driver licence? Education institution?
    Got a mortgage? Credit card? Utility bill? Who is renting a home?
    The best way to work out who is illegal, using fake ID or just treaded a social security number is to request layers of other photo ID.
    City, state, federal and private sector documents have to start to match going back years.
    Does the life story go back to a lot of other valid US id? Doe
  • A simple solution for now would be just to add 4 or 5 digits to the new SSNs that are issued. That would break so many systems that others would have to address the real problem.

    Decades ago AT&T had a payroll system that couldn't cope with two employees having the same SSN. It turns out that the SSA has stated that the numbers aren't unique, only unique combined with a last name. If Mary marries Mr Smith and there is a Mary Smith with her SSN, they will reissue her a new SSN. There are millions of

  • User name equivelant (Score:5, Interesting)

    by burtosis ( 1124179 ) on Tuesday October 03, 2017 @10:12PM (#55305631)
    Your social security number should really be viewed as a unique user name and not for purposes of authentication. You could then have one or more passwords for authentication purposes. Say one for taxes, one for mecdical, one for credit - you could change your password easily in the case of a data breach and it's less important if your user name only is leaked.
    • Your social security number should really be viewed as a unique user name

      > social security number
      > unique

      Pick one. Even if you ignore the millions of illegals aliens sharing a few thousand stolen SSNs, they still aren't unique.

      • Well when they don't have the password they will get kicked off. Social security numbers shouldn't be used like an hbo go account.
  • Works for the Medical field.

  • The card I received from them decades ago says it's not to be used for identification. Right there plain as day. But... some time between when I got my card and my daughters got theirs, the SS cards stopped saying that. How long before this new ID will get commandeered for use by businesses and we start the whole game over again?

    • The point of this new ID is such that it CAN be used by businesses, securely. A common idea tossed out by the tech community would be to use something similar to public key cryptography wherein you have revocable certificates. Your certificate (ID) becomes compromised, revoke and reissue.
  • It seems to me there may not be any absolutely secure way of attaching a number, code, text string, retina photo, or whatever used for an identity authentication system. As soon as the system is established, someone will figure a way of compromising it. Even some kind of quickly changing, encrypted algorithmic solution one might come up with might last awhile, but it won't last. Tell me I'm wrong.
    • by AHuxley ( 892839 )
      It just has to be more expensive than its worth to create an entire city, state and federal ID collection.
      That a life story has to match from birth, to school, to education, to renting, to home ownership, driving a car and full time work. In the same name and with dates that seem real with real sounding decades.
      Lots of retroactive digital database alterations get messy and expensive decades later. Depending on the decade some locations still have actual paperwork for the past generation too. Once one o
  • If you use the SSN as a primary key, you're incompetent and you should resign.

    -jcr

  • by QuietLagoon ( 813062 ) on Tuesday October 03, 2017 @11:04PM (#55305837)
    What is the problem that needs to be solved? Is SSN the problem, or is the over use of SSN the problem? Will any replacement for SSN have the same overuse problem?
    • Re: (Score:2, Insightful)

      by Anonymous Coward

      Good start.
      Just stop at asking the question: what do other countries do. Presumably, Sweden, Great Britain, Japan, France, Germany, Kenya, Brazil, Canada, and may others have been in the same situation. Let's not find out how they did it. Presumably, the solution is separate numbers for a Financial/Tax ID, Social Security Number, Medicare Number, and the like.

      I know what we can do! We can give a $10 million contract to Equifax for them to find the solution for us! No-bid contract, of course.

  • What ever they decide, someone will make lots of money

    oh, and it won't work

    Which means someone else will also need to make a lot of money, and they will get to blame the last President of the USA.
  • for years to avoid using my SS# for identification purpose - tuff luck.

    Argument against my wish is that the "company" has the right to choose what kind of identification they can demand.

    It is sooo MF convenient, to have a whole population of a country tracked by ONE key!

    Guess who benefits most from it?

  • Give everyone a private key on their birth certificate, and publish a public key as the new SSN.

  • by markdavis ( 642305 ) on Wednesday October 04, 2017 @12:17AM (#55306095)

    Please note that this doesn't solve a equally big problem- you shouldn't HAVE to identify yourself for doing most things. A good example would be if you have to prove your age to do something. Age verification doesn't mean that establishment should be allowed to know WHO you are, and even worse, record that fact somewhere. Such acts erode privacy, freedom, and could be used later to frame, manipulate, or harass people.

  • Why not adopt a burden of proof system like many other countries have. If you want to identify yourself you need to accumulate a certain number of points. Certain points are required for certain things (e.g. 100 points to open a bank account, 200 to apply for citizen ship etc).

    Different items provide different points e.g. drivers license or government ID document with photo 50 points, bank issued document or card 25 points, internationally identifying document like passport 75 points, letter posted to your

  • The SSN was never intended to be an ID number. Any organization that ever said "if you know this number, we accept that as proof of identity" was stupid, and frankly should be legally liable for any fraud that they enabled.

    The simplest form of identity check is to require a physical government-issued ID with a picture. This could be a driver's license, or a passport, or something similar. These are (a) reasonably difficult to fake, and (b) faking them is a crime. Those may be low barriers, but just knowing

  • Have it like Germany, give out national ID cards that require registering residency. Makes a lot of things much easier from generating voter lists to sending out information to finding people in emergencies. That will also end the patchwork of abusing driver's licenses as de facto national ID. Then again, knowing the US governments track records they will immediately find a way to abuse that information.
  • This may involve "a public and private key" including "something that could be revoked if it has been compromised," Joyce added.

    Or if you piss off the wrong person. Or if the system fails, or malfunctions. Or...

  • Even if the country mandates it, employers will still use it.
    Because, at this point, EVERYONE does.

There's no sense in being precise when you don't even know what you're talking about. -- John von Neumann

Working...