Comments on: SSN http://nat.org/blog/2010/06/ssn/ Mon, 07 May 2012 20:05:57 +0000 hourly 1 http://wordpress.org/?v=3.3.1 By: Jackson http://nat.org/blog/2010/06/ssn/comment-page-1/#comment-6847 Jackson Fri, 11 Feb 2011 17:38:11 +0000 http://nat.org/blog/2010/06/ssn/#comment-6847 Try it on Bing now. Try it on Bing now.

]]> By: cepler http://nat.org/blog/2010/06/ssn/comment-page-1/#comment-6792 cepler Thu, 29 Jul 2010 15:53:58 +0000 http://nat.org/blog/2010/06/ssn/#comment-6792 Safely stored in Google's query requests now though :) Safely stored in Google’s query requests now though :)

]]> By: Miguel de Icaza http://nat.org/blog/2010/06/ssn/comment-page-1/#comment-6714 Miguel de Icaza Fri, 04 Jun 2010 18:24:08 +0000 http://nat.org/blog/2010/06/ssn/#comment-6714 I belong to the school of "trust, but verify" and would like to double check. Could you post your SSN here so I can validate your results? I belong to the school of “trust, but verify” and would like to double check.

Could you post your SSN here so I can validate your results?

]]> By: Alan http://nat.org/blog/2010/06/ssn/comment-page-1/#comment-6712 Alan Fri, 04 Jun 2010 15:09:26 +0000 http://nat.org/blog/2010/06/ssn/#comment-6712 Well it is easy enough to find your DOB and I imagine with a little more work your place of birth. As SSNs are allocated non-randomly I wouldn't count on your SSN being secure. At least you were born well before the 1980s when SSNs became much more predictable. SSNs are insecure and that fact won't change no matter how many laws they pass requiring bussinesses to protect them. http://www.heinz.cmu.edu/~acquisti/ssnstudy/ ""Ranges of values" means that the predictions are based on statistical inferences: in general, the first 5 digits can be predicted with a very high degree of accuracy with a single attempt - especially for individuals born after 1988 and in less populous states. In some cases, we were able predict the whole 9 digits of individual SSNs at the very first attempt. More often, the predictions produce windows of values that are likely to include the actual 9 digits. These windows can be very large (and, therefore, inaccurate) for certain years and states (for instance, for individuals born in California in 1973), but can get very narrow (and therefore more concerning, in terms of identity theft risks) for smaller states and recent years (for instance, 1 out of 20 SSNs of individuals born in DE in 1996 in our dataset could be identified with just 10 or fewer attempts per SSN)." Well it is easy enough to find your DOB and I imagine with a little more work your place of birth. As SSNs are allocated non-randomly I wouldn’t count on your SSN being secure. At least you were born well before the 1980s when SSNs became much more predictable.

SSNs are insecure and that fact won’t change no matter how many laws they pass requiring bussinesses to protect them.

http://www.heinz.cmu.edu/~acquisti/ssnstudy/

“”Ranges of values” means that the predictions are based on statistical inferences: in general, the first 5 digits can be predicted with a very high degree of accuracy with a single attempt – especially for individuals born after 1988 and in less populous states. In some cases, we were able predict the whole 9 digits of individual SSNs at the very first attempt. More often, the predictions produce windows of values that are likely to include the actual 9 digits. These windows can be very large (and, therefore, inaccurate) for certain years and states (for instance, for individuals born in California in 1973), but can get very narrow (and therefore more concerning, in terms of identity theft risks) for smaller states and recent years (for instance, 1 out of 20 SSNs of individuals born in DE in 1996 in our dataset could be identified with just 10 or fewer attempts per SSN).”

]]> By: Nat Friedman http://nat.org/blog/2010/06/ssn/comment-page-1/#comment-6711 Nat Friedman Fri, 04 Jun 2010 13:33:02 +0000 http://nat.org/blog/2010/06/ssn/#comment-6711 Good point! I did. :-) Good point! I did. :-)

]]> By: zeta http://nat.org/blog/2010/06/ssn/comment-page-1/#comment-6710 zeta Fri, 04 Jun 2010 13:30:53 +0000 http://nat.org/blog/2010/06/ssn/#comment-6710 I hope you used the HTTPS version, https://www.google.com/ I hope you used the HTTPS version, https://www.google.com/

]]> By: Alberto http://nat.org/blog/2010/06/ssn/comment-page-1/#comment-6708 Alberto Fri, 04 Jun 2010 12:20:54 +0000 http://nat.org/blog/2010/06/ssn/#comment-6708 SSN is something I understand only in part, as well as identity theft (not common at all where I used to live), even if I have been living for a while in US. I mean, why do they use it so much with identification purposes, if it is so delicate? And what is done to prevent identity theft, in addition to suggesting you not to use SSN, to find out that you are required to use it, even if legally not necessary (see opening a bank account, which formally should not require a SSN, but in practise, most accounts are "SSN-driven"). We have something similar to SSN in Italy (we call it "fiscal code", and it groups now our fiscal and health care information, being valid, for the second purpose Europe-wide), but there is no need to keep it secret (it can actually be obtained easily from people name, birth of date, and some other info, and there are softwares to check the authenticity), since it is *not* a valid way to identify you. If you want to open a bank account or do some other activity, the code is only one of the (two) things you need, since a valid ID has to be presented and associated to the code itself, and there are easy ways to check if the two match. I'm still wondering why something similar wasn't implemented in US, but maybe I just don't know this is done. :-? SSN is something I understand only in part, as well as identity theft (not common at all where I used to live), even if I have been living for a while in US.

I mean, why do they use it so much with identification purposes, if it is so delicate? And what is done to prevent identity theft, in addition to suggesting you not to use SSN, to find out that you are required to use it, even if legally not necessary (see opening a bank account, which formally should not require a SSN, but in practise, most accounts are “SSN-driven”).

We have something similar to SSN in Italy (we call it “fiscal code”, and it groups now our fiscal and health care information, being valid, for the second purpose Europe-wide), but there is no need to keep it secret (it can actually be obtained easily from people name, birth of date, and some other info, and there are softwares to check the authenticity), since it is *not* a valid way to identify you. If you want to open a bank account or do some other activity, the code is only one of the (two) things you need, since a valid ID has to be presented and associated to the code itself, and there are easy ways to check if the two match.

I’m still wondering why something similar wasn’t implemented in US, but maybe I just don’t know this is done. :-?

]]> By: ben http://nat.org/blog/2010/06/ssn/comment-page-1/#comment-6707 ben Fri, 04 Jun 2010 12:14:38 +0000 http://nat.org/blog/2010/06/ssn/#comment-6707 In North America, knowing someone's SSN is a big step toward being able to steal his identity. You'd be surprised how many things you can do over here in someone else's name just by giving his SSN. In North America, knowing someone’s SSN is a big step toward being able to steal his identity. You’d be surprised how many things you can do over here in someone else’s name just by giving his SSN.

]]> By: Nat Friedman http://nat.org/blog/2010/06/ssn/comment-page-1/#comment-6706 Nat Friedman Fri, 04 Jun 2010 11:33:30 +0000 http://nat.org/blog/2010/06/ssn/#comment-6706 Ha! Ha!

]]> By: ethana2 http://nat.org/blog/2010/06/ssn/comment-page-1/#comment-6699 ethana2 Fri, 04 Jun 2010 05:15:56 +0000 http://nat.org/blog/2010/06/ssn/#comment-6699 I started typing mine, but it suggested yours, and I clicked it. No results, just like you said. *whew* I started typing mine, but it suggested yours, and I clicked it.

No results, just like you said. *whew*

]]> By: Igor http://nat.org/blog/2010/06/ssn/comment-page-1/#comment-6697 Igor Fri, 04 Jun 2010 01:46:38 +0000 http://nat.org/blog/2010/06/ssn/#comment-6697 :( :(

]]> By: antimonio http://nat.org/blog/2010/06/ssn/comment-page-1/#comment-6696 antimonio Fri, 04 Jun 2010 01:34:33 +0000 http://nat.org/blog/2010/06/ssn/#comment-6696 What's the point? I may be living under a rock, but I don't know why that would be bad? (Mine is googlable, why should I be sad?) What’s the point? I may be living under a rock, but I don’t know why that would be bad? (Mine is googlable, why should I be sad?)

]]> By: dustym http://nat.org/blog/2010/06/ssn/comment-page-1/#comment-6694 dustym Fri, 04 Jun 2010 01:15:19 +0000 http://nat.org/blog/2010/06/ssn/#comment-6694 Ugh. I'm not so lucky. Ugh. I’m not so lucky.

]]> By: Oli http://nat.org/blog/2010/06/ssn/comment-page-1/#comment-6693 Oli Fri, 04 Jun 2010 00:42:48 +0000 http://nat.org/blog/2010/06/ssn/#comment-6693 Nice, now Google knows your SSN! Nice, now Google knows your SSN!

]]> By: FriendlyNigerian http://nat.org/blog/2010/06/ssn/comment-page-1/#comment-6692 FriendlyNigerian Fri, 04 Jun 2010 00:23:20 +0000 http://nat.org/blog/2010/06/ssn/#comment-6692 Wow,, this is amazing work! May I knwo the your SSN so that I can may confirm this? I would like want see this for my self. Thankyou. /s Wow,, this is amazing work! May I knwo the your SSN so that I can may confirm this? I would like want see this for my self. Thankyou.

/s

]]>