Slashdot Mirror
Same Birthday, Same Social Security Number, Same Mess For Two Florida Women (cio.com)
itwbennett writes: After 25 years, the Social Security Administration (SSA) has fessed up to giving two Florida women who shared a name and a birthday the same social security number. The women only recently discovered that they shared an SSN, but not before having trouble getting loans and having tax returns rejected. You might think that the SSA would catch something like this, but as it turns out, they are prohibited from trying to verify the legitimate owner of an SSN, except in rare cases, says Ken Meiser, VP of identity solutions at ID Analytics, provider of credit and fraud risk solutions. And the problem isn't as rare as you might think (except for the part about two women with the same name born on the same day in the same state). According to a 2010 study by ID Analytics, some 40 million SSNs are associated with multiple people.
8675
I would assume that it is not a coincidence that two women with the same name and same birthdate got the same social security number; I expect that when the second application came in, they checked the name and birdhday and assumed that it was a duplication of the first application, and just send out "here is your number".
Most of the duplicates are due to fraud by illegals.
309
The SSA is prohibited from checking out errors with the SS numbers ?
Who better equiped to straighten out identity theft verifications ?
There is no National ID system and I don't think we want one.
Does this mean I don't have to verify my income with the IRS because the government doesn't know who I am ?
I recieved this SSN in error !
prove me wrong !
This is my opinion based on what little I know and understand of the rumors and lies Thanks, Randal
So, slashdot tells me americans HATE the idea of a centralized, unique ID number. Yet, they have a de-facto standard "unique" ID number, the SSN.
Can somebody explain?
More than 1 in 10 are associated with multiple people. That is unbelievably poor quality control. You could GUESS at an SSN and 1 out of 3 would not be associated with somebody.
If you are not allowed to question your government then the government has answered your question.
ALTER TABLE ssn_info ADD CONSTRAINT ssn_unique UNIQUE (ssn);
9...?
After they were originally issued in the 30s and 40s, there was a fad where people would have their SSN tattooed on their body as the government emphasized the importance of remembering them. The semi-public nature of the SSN is kind of interesting. Originally, they were basically intended to track your contribution to Social Security - what would you do, fraudulently contribute to someone else's retirement? Thus far, I don't believe they've been reissued, but we're likely pretty close, since they're NOT just random number combinations. Now, it only took them a few years before things went... strangely, but not badly, but their continued flow into general life means that a system designed to be semi-public has now gotten tendrils everywhere, and protection on them is not as good as it should be.
we had three people with the same SSN. In 1935 in a three month period, 25 million numbers were issued from over a thousand post offices and from several companies, especially rail roads. Of course, there were mistakes made. What I still can't believe after encountering that almost a dozen more times, is that people still insist that SSNs are unique. I currently work for a payroll company, and we have a unique index on our database. People still mistakenly believe that they must be unique despite seeing proof that they are not.
...my company's accountant told me that someone in Los Angeles had used my SSN and the IRS was trying to garnish my wages. She told them that I was certainly not Mr. Aguilar and that I was not responsible for Mr. Aguilar's debt to the IRS. Seems like a simple thing but she was not supposed to tell me about the incident. Because if the proles ever found out how often this happens, they'd lose faith in the integrity of The System. I, as the taxpayer and rightful SSN holder was never contacted by the IRS to either collect money or warn me that there was someone out there using my SSN, possibly ruining my credit.
> The US social security number as an id is seriously broken. After consideration, I'd epect my ssn to be in at least 100 poorly-secured databases: bank accounts, insurance accounts, doctor/dentist/hospital facilities, employers, etc. The number is hardly secret
More specifically, it's fine as an IDENTIFIER, and ID must necessarily be different from AUTHENTICATION. My name identifies me (approximately), my password authenticates me.
To be useful, a personal ID must be more or less public - the name "Barak Obama" is useful only because everyone knows who that is, it's public. Also, in order to be useful, authentication information must be private. So as you said, two pieces of information - one that is the ID, the other is the authentication.
This seems obvious, but people who should know better routinely treat user names as "a little bit secret". This is wrong. It's either secret, in which case it's hashed so nobody can read it, and it can be trusted to be secret, or it's it's not. Since a user name is not protected as a secret, don't start thinking that maybe it's a little bit secret, kinda maybe, and start putting any trust in people not knowing it. User names aren't hashed, they are sometimes displayed, so they aren't secret. Not even a little bit (especially not a little bit).
All those in favor of random UUIDs, raise your hands.
I hadn't the slightest objection to his spending his time planning massacres for the bourgeoisie... (P.G. Wodehouse)
That's about 1 on 7 Americans! I hope they mean that 1 in 7 had at least one cross-association error in past rather than 1 in 7 are actively referring to the same person.
Table-ized A.I.
In India we now have a system called Aadhaar, the number is generated in a random fashion and just knowing the number does not mean anything and is of no use to anyone... But any company can use your number, name, address etc to verify if the details match each other.. they get a pure yes or no response back from the Aadhaar server... Credit cannot be obtained by just providing this number, you have to authenticate yourself with additional means to get credit...
So were both of them paying taxes?
That doesn't solve anything, because they were never meant to be secret in the first place. The "proper" use of an SSN is more like a username, not a password.
The real problem is that we have a bunch of people stupidly misusing a non-secret piece of information as if it was.
Similarly, I don't care if my license-plate number is sequential or random, any company that will lend money to someone who knows my name and license-plate is a company that is fucking up, and our laws need to recognize that it is *their* fuckup, not mine.
Vice president of a company that sells a solution to an alleged problem states that the alleged problem really is a really bad problem, citing an amusing anecdote as a hook and a study in which the company that sells the solution claims that the alleged problem really is a problem. A cynic might have some questions...
Stephan
Bingo!!!
What'd I win?
Experian is a multi-billion dollar entity. They will never change the data in their machines, because they long ago laid off all those people to raise their stock price.
People have been suing Experian for years to change their credit histories which are borked by these agencies. Experian has found it cheaper to pay the lawsuit settlements than spend the money to update credit histories.
You will never be able to get a credit card. But you might be able to get a 10's of thousands settlement with Experan, which might buy you a little happiness.
Seriously, you're better off leaving the country and restarting elsewhere under another system.
If telephones are outlawed, then only outlaws will have telephones.
> if the forum makes a distinction between the screen name (the visible name) and the actual login name, then the login name (often an email address) can be seen as at least somewhat secret.
That's precisely what causes the problem. In some well-known forum scripts, the user name (for logging in) isn't different from the visible "screen name". So it appears to be kinda secret. HOWEVER, a less-used feature of the forum uses the username as the identifier in links, something like profile.php?user=dgatwood. So it's not actually secret. Since it's not what is -normally- displayed, developers of the forum itself and of plugins sometimes treat it as secret, as if an attacker wouldn't know your user name. But there it is, right in your profile and elsewhere. So it's not secret, but it's being trusted as though it were secret.
It's not okay (security-wise) to have something publicly available, but then trust that it's not. It's either secret or not. "Somewhat secret" is really dangerous.
> the username could theoretically be an account
number... In that case, the username actually would be secret
I thought you were old enough to have written a check before. Your account number is on your check, which you handed to all of the clerk at the various stores you shop at. You might also notice account numbers are SEQUENTIAL. If I want to know someone's account number, I take mine and add one. If I add two, I get another valid account number. My bank account number is on my web site, so people can wire payments to me. Not secret, not even a little bit.
The PIN number to my debit card and my password for the bank's web site are the secrets. Anybody who knows how to add one to a number (any third grader) can enter my account number into the bank's web site. Entering my password to go with it is the tough part.
When we got married, my wife changed her last name. For the next 5 years nobody could figure out why the IRS kept rejecting our joint return. After multiple calls and in-person visits, we finally got the Social Security office to admit that when they changed her name, someone also updated her date of birth. We never knew that was possible, and she certainly didn't check whatever box indicates that that was her intention. What's more, the person behind the counter said she didn't know it was possible either.
If my user ID is not my screen name, even if it is used elsewhere on the site it may stop the really casual crackers. It's not somethiing I'd want to rely on at all, but it could help a bit. In an MMORPG, some griefer might do password guesses on my screen name, and many players probably use bad passwords.
"When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
I would PAY to have a number that started with 666.
How many people would pay to have a number starting with 007?
"Transparent" is a shit show that trades on every stereotype going. A man in drag is NOT a transsexual.
Back in the dark ages (1976-1999) I worked on a large mainframe system that used the Social Security Number of virtually everyone as the primary key in the master database that included all employees and anyone applying for employment. We had about 80,000 employees and got over 100,000 new applicants each year. Duplicate social security numbers were fairly common and were not limited to any one group or class. Some were entry errors or mistakes on applications but at least a dozen or more each year were true duplicates with original social security cards.
We finally moved to a relational database with our own primary key and it stopped being a problem for me. Probably not for those with the duplicate numbers though.
For a checking account, that is true, but it isn't true for (for example) a credit card account number or a savings account number.
When the banking system as a whole was set up initially, the assumption was that most of your money would be in a savings account, and that your checking account would contain only enough money to handle typical transactions. If it suddenly went empty because of fraud, the bank could cover the loss. That breaks down somewhat if you're doing everything with one account, obviously, but that's another issue entirely.
Either way, the general advise that the banks give is to treat the account number as a secret, and to not give it out unless necessary (which means writing checks only to people you trust at least to some degree). After all, once I have your account number, I can very easily get a deck of checks printed with that number, and it is unlikely that I would get caught, so long as I shopped in random places that are all far from home. But it is secret only because the system is fundamentally broken, once again treating a mere identifier as an identity.
Check out my sci-fi/humor trilogy at PatriotsBooks.