[TZubiri]

I'm not american, but the idea that your SSN, which is effectively a (federal) unique identifier for a person, would be secret, is very foreign.

In most countries, like most databases, our primary keys do not hold an expectation of secrecy.

I would even argue that the expectation of secrecy is what creates it's secret semantics, that is, it's secret because you make it secret. I get that it's a collective action thing, if you just publish your own SSN, a bank in another state might not be aware it's a public thing for YOU, and might open an account for a stranger.

Interestingly enough, for corporations, their identifiers, EIN, are not assumed to be private, in many states these are available through the DoS public records. So it turns out the system works just fine if you make the ID of a person (juristic or legal) public.

[smcin]

So what prevents people applying for loans or doing identity theft, in other countries?

[rightbyte]

To sign on for a house, marry, claim a child as yours etc you need witnesses where I live. Web of trust I guess?

If someone takes a loan in my name and I don't receive the money it is not an identity theft it is fraud and the victim is the bank not me.

[petilon]

Sure, but what if someone steals your money by impersonating you? Here too, ideally the victim is the bank, but now the onus is on you to convince the bank that they are the victim. They are going to say you're the victim, your identity got stolen, sorry you lost all your savings!

We need to update our laws. This is not "Identity Theft", this is "Negligent Verification Fraud", and it is the bank's fault because they were lax in their verification process.

[smcin]

I meant online. Lower-value types of fraud, like e-commerce, prepaid mobile phone bills.

[sleepybrett]

do you think scammers don't travel in packs?

[TZubiri]

Key difference might be that most countries have centralized Federal ID document. The Americans never allowed the government such a power, which is a tremendous idea. But they did concede to an ID number through a federal tax entity which de facto served as an id number. Turns out one disadvantage there is that a document is easier to prove ownership of than a number.

[bluebarbet]

Sure but all countries have numbers (tax, SS, ID card) that serve de-facto as IDs. The question is why the number alone (i.e. a username without a password) would ever be considered sufficient to authenticate something.

[smcin]

That seems irrelevant. The most commonly used ID document for many things in the US is a driver's license; it's issued by the states, not federal govt, so what.

Similarly you could argue that addresses and zip codes are assigned by the USPS not directly by the federal govt, so what.

Combine this with date-of-birth and phone no. and you have a very small set of sufficiently near-unique identifiers (even if that wasn't the intent of the SSN).

One big mistake was not to legislate (at any point between the 1930s and 1980s) to criminalize third parties from using the SSN as unique identifier, as is done by other countries.

Imagine if the East German Stasi had merely outsourced surveillance to data brokers and credit bureaux - different regime, same effect.

[TZubiri]

>The most commonly used ID document for many things in the US is a driver's license; it's issued by the states, not federal govt, so what.

That doesn't uniquely identify a person though does it? You could get a license from Florida, open an account, then get a license from New York and open another account, and if you defaulted on the credit of one, the other bank would be the wiser and issue you a new loan.

>Similarly you could argue that addresses and zip codes are assigned by the USPS not directly by the federal govt, so what.

Similarly, you could trivially open two accounts under different addresses.

>One big mistake was not to legislate (at any point between the 1930s and 1980s) to criminalize third parties from using the SSN as unique identifier, as is done by other countries.

Certainly it has its disadvantages, but it has its advantages, not really by virtue of not having a central document, but by the other benefits that a legal system that doesn't bestow so much power on the federal government has.

While I agree that the relation of between the lack of central document and the secrecy of SSN numbers isn't proven or self-proving, it's certainly worth considering up to the point that it's a reasonable default and the burden on proof is on disproving it. I can't think of any other country where there's no central document or where a citizen ID is considered secret, so that's pretty good evidence in itself.

[Tangurena2]

My original SSN card has "not valid for identification" printed on it. Originally, it was supposed to only be used for filing taxes. The first 3 digits identified the state you applied in, the second 2 digits identified the office (in that state) and 2 of the last 4 digits identified the filing cabinet.

Over the years, it ended up becoming the de facto federal identity number. It has no check digits, so you can make up any you want (I used to use a phone number of a major customer - only dropping 1 digit). I was a rebel/jerk/butthead back then. Now I just yell at clouds.

Long ago, I worked at a place that handled electronic prescriptions, lab results and insurance claims. There were huge numbers of incorrect SSNs which meant there were huge numbers of duplicates. Someone transposed 2 digits? Yep. Someone remembered their number incorrectly? Sure. Someone made one up? Like from a phone number? Oh noes! Before 911, trying to match someone with faulty ID numbers and messed up names was called "patient matching" and after 911 all the academics doing research into this stuff disappeared into large defense contractors or 3-letter-agencies trying to find more terrorists/bad guys.

For a good start in this area of research, I recommend this dissertation:

> Adaptive detection of approximately duplicate database records and the database integration approach to information discovery

> AE Monge - 1997

https://scholar.google.com/citations?view_op=view_citation&h...

> The most misused SSN of all time was [see link]. In 1938, wallet manufacturer the E. H. Ferree company in Lockport, New York decided to promote its product by showing how a Social Security card would fit into its wallets. A sample card, used for display purposes, was inserted in each wallet. Company Vice President and Treasurer Douglas Patterson thought it would be a clever idea to use the actual SSN of his secretary, Mrs. Hilda Schrader Whitcher.

> The wallet was sold by Woolworth stores and other department stores all over the country. Even though the card was only half the size of a real card, was printed all in red, and had the word "specimen" written across the face, many purchasers of the wallet adopted the SSN as their own. In the peak year of 1943, 5,755 people were using Hilda's number.

https://www.ssa.gov/history/ssn/misused.html

Most state agencies redact the SSN from public records. I want to say that they all do, but I work for a state and I see too many in all the wrong places.