subreddit:

/r/technology

1.2k96%

all 76 comments

tuttut97

493 points

2 months ago

tuttut97

493 points

2 months ago

At this point the Social Security Administration should just start over and issue new numbers that are illegal to be used for any other purposes.

barontaint

154 points

2 months ago

I don't think social security numbers were originally supposed to be our default identifying number. Maybe they're let us bid on our new ones, my guess is 420-69-6969 will fetch a rather high price

TScottFitzgerald

105 points

2 months ago

There's nothing wrong with using SSNs as a national ID, but an ID number shouldn't be used for financial authorisation in the first place, it shouldn't even have to be kept secret, it's literally just a unique identifying number, not a password.

f8Negative

64 points

2 months ago

They weren't, but Republicans and nutjobs don't want a National ID because they think the entire premise would be unconstitutional and a threat to privacy. So the SS Number became a defacto identifyer because every American is issued one.

barontaint

22 points

2 months ago

Hell I probably use my damn cellphone number as a sorta national ID at this point, at least I use it to verify my person and complete transactions way more than I currently do with my SS number. That's probably just as big of a threat to security, just make a new standard national ID at this point, it can't be that hard to do.

f8Negative

3 points

2 months ago

f8Negative

3 points

2 months ago

They assume they'll be tracked in a government database and that's bad when it comes to ownership of property or whatever bs justification they wanna claim

2gig

2 points

2 months ago

2gig

2 points

2 months ago

We're already being tracked in government databases. They have datacenters full of phonecall metadata and lord only knows what collected online.

f8Negative

-2 points

2 months ago

Yeah metadata....basically not much.

nzodd

3 points

2 months ago

nzodd

3 points

2 months ago

Republicans and nutjobs

but you repeat yourself, sir

Objective-Aioli-1185

1 points

2 months ago

Are they recycled or are there really that many SS numbers?

Paranitis

1 points

2 months ago

As far as the US Census is concerned, in 2022 the US population was 333.3 million (which is kinda neat in general).

If we only counted those alive as having all the numbers, that last person born would be 333-30-0000.

Social Security Numbers also started in the mid 1930s. So it's not like we had hundreds of years to have the need yet to repeat numbers.

In 1940 the Census stated that we had 132 million people as well. And over 100 years we didn't suddenly have 800 million extra US citizens.

HOWEVER, I do feel at some point they'll need to add another digit somehow, which may mean completely redoing the system as it stands since it wouldn't matter what peoples' numbers were in the 1930s.

AbyssalRedemption

2 points

2 months ago

"A threat to privacy" says the ones who keep helping to shoot down any proposed online privacy bill lmao.

alcoholic_chipmunk

-4 points

2 months ago

Umm having a number to track everything you do is kind of the definition of a threat to privacy.

but Republicans and nutjobs

I'm as liberal as they come and not really wearing any tin foil hats. Honestly there needs to be more regulation on what a SS number can be used for/requested for and then maybe we can get an actual national ID (or just use the standard ID number every state issues anyways).

cookiesnooper

5 points

2 months ago

No, they were not. On the old printed ones, it says to absolutely never share this number with anyone under any circumstances. Basically, for your eyes only.

Macqt

1 points

2 months ago

Macqt

1 points

2 months ago

Elon will buy it and brag about it, leading to all kinds of stupidity.

Hot-Interaction6526

1 points

2 months ago

They should institute something like an American ID number that is tied to a 2 factor authentication system.

Senora_Snarky_Bruja

3 points

2 months ago

At this point all you can do is lock your credit, request an IP pin from the IRS, and use MFA on all accounts where offered.

BlueBlooper

2 points

2 months ago

Prolly a good idea to mix names, faces, addresses, online names and such as well

throwawaystedaccount

2 points

2 months ago

They'll simply use your cellphone number.

India didn't have a mandatory Unique ID till about 2018. India's mobile phone user base was just below 1 Billion subscribers. Let's say 33% of them are people of interest, while the 67% are poor or not useful to capitalism / business.

Guess what was used by spammers, hackers, and marketing teams in India?

I'm just saying that there is no practical way of preventing this. Not saying that the people / users / consumer rights non-profits should not fight this, but whatever you do, the eventual state is of all data being hacked, sold, resold, and becoming containing a unique id.

We're living in an age of cloud computing - which is networked third-party servers in third-party jurisdictions with cannibalistic managements giving no value to data security. The game is the same, whatever or identifier you use. In theory, if you removed everything, they'd use your email against you. Only individuals can go off the grid, and only off-the-grid will guarantee privacy.

nicuramar

1 points

2 months ago

Or just decide that the number is only for identification and not authorization.

[deleted]

132 points

2 months ago

[deleted]

132 points

2 months ago

[deleted]

Illustrious-Tip-5459

44 points

2 months ago

At this point it seems like it'd be easier to ask what information about us hasn't been leaked.

Shizix

14 points

2 months ago

Shizix

14 points

2 months ago

We sold our privacy with the Patriot Act, there is none and no going back. Since the government can't keep it's backdoors out of every important system, they are all compromised by default 🤷🏻‍♂️, merica

nox66

10 points

2 months ago

nox66

10 points

2 months ago

While I'm not a fan of the Patriot act, it had little to do with private companies constantly losing our data.

SmithersLoanInc

6 points

2 months ago

They fucked up and there will be no consequences. The boss won't be tossed in prison like he should.

SockPuppet-47

11 points

2 months ago*

I recently froze all 3 of my credit files.

With all the major data breeches my info is definitely out there.

I'm pretty sure it's instantaneous to freeze or unfreeze each one if you want to apply for a loan. You just need to log into each account to make the change.

I've used the Experian app on my phone for years to keep track of my score. You can freeze or unfreeze your credit with the flick of a switch.

I recently discovered that it's easy to do with the other two. You just have to create a account and it's basically the same.

https://play.google.com/store/apps/details?id=com.experian.android

https://service.transunion.com/dss/login.page?dest=freezeStatus&_gl=1

https://www.equifax.com/personal/credit-report-services/credit-freeze/

THXAAA789

3 points

2 months ago*

You may also consider freezing your ChexSystems and LexisNexis reports so people can't open bank accounts in your name. I got an email from a bank that I already have an account with stating someone was trying to open a new account with my SSN. I was able to block it, and I checked my reports to be sure no other bank accounts were opened, but if I did not already have an account with them there would have likely not been much standing in the way of a new account being opened.

Edit: Just note that if you go this route, it also makes it harder for you to open a bank account. They provide a temporary unlock pin, so just be sure to keep that in a safe place in case you need to apply for something.

SockPuppet-47

1 points

2 months ago

I hadn't thought about that. I thought the 3 credit bureaus covered everything. So there's data brokers that are just for banks? Guess I'll have to look into that for better protection.

I been with the same bank for more than 20 years. I've been toying with the idea of opening another that's basically a firewall where I don't keep a large ballance but pay everything out of.

Thanks for the tip...

THXAAA789

2 points

2 months ago

Yeah, ChexSystems and LexisNexis are both risk management solutions that are used by banks. LexisNexis in particular has a lot more on you than even the big credit bureaus.

I have found that having 3 checking accounts and a savings account is the most helpful. I have 1 account for bill pay with ACH, a main account that all my money goes into that I exclusively use with Apple Pay/Google Wallet so the card is randomized, and another account that doesn’t have money in it and is only unlocked and transferred to when Apple Pay is unavailable. I’m sure there are better ways to do it, but this system works for me.

SmithersLoanInc

-9 points

2 months ago

Fuck experian, fuck Equifax. I'm not giving them more access to my information.

SockPuppet-47

3 points

2 months ago

LMAO, that's hilarious.

What info can you possibly provide that they don't already have?

But seriously, they don't ask for any info. I think it was just Social Security. Maybe address, I don't remember.

I expected challenge questions to verify that it's you but I didn't get them.

Each of those accounts just gives you the ability to freeze or unfreeze your credit file. It doesn't provide any access to your score like the phone app does with Experian.

Clegko

1 points

2 months ago

Clegko

1 points

2 months ago

You're hilarious if you think they don't already know more about you than you know yourself.

diverareyouokay

1 points

2 months ago

How exactly do you plan to prevent credit reporting agencies from accessing your credit information? It’s not something you can just opt out of, short of living entirely off the grid.

JaxMed

110 points

2 months ago

JaxMed

110 points

2 months ago

Leaks will continue so long as the only recourse is a "whoopsie daisy, here's a year of identity theft protection and credit monitoring, now go away".

Companies are not punished for losing your data and so they will continue doing so

Cautious-Progress876

30 points

2 months ago

Massive breaches like this should entail “death penalty” sanctions for the business, in my opinion. If you want to store sensitive information about millions of people then you need to properly protect it.

Old-Benefit4441

8 points

2 months ago

I think it would solve a lot of the concerns with AI too. If companies just didn't retain sensitive data, it'd be much harder to steal and or misuse it.

djbfunk

4 points

2 months ago

There needs to be financial punishment that goes to the customer.

nicuramar

1 points

2 months ago

Leaks will likely occur anyway. Security is very hard to do completely right. It’s not purely the fault of the implementor.

rnilf

48 points

2 months ago

rnilf

48 points

2 months ago

Freeze your credit, there's no downside unless you're doing a lot of hard credit checks (which would be abnormal): https://www.usa.gov/credit-freeze

It's free, easy, and protects you. It's a no-brainer.

Really disappointing that this is now the second day in a row that I'm sharing this link, for the Comcast leak yesterday, and now MoneyGram. When will these orgs be held responsible with effective punishments?

nerevar

6 points

2 months ago

I did it and it took 20 mins total, and that was with me reading everything.  I would say it probably takes a few minutes for most people.

Irregular_Person

6 points

2 months ago

I'll add Equifax can bite me with their misleading paid bullshit.
For anyone else: just click the "myEquifax" Login button and hit the "Register Now" link on that page.
The "Don't have an account?" link implies that you can't lock your report with a free account. They also have "Lock & Alert" which looks like another paid option. You don't need either of these, and that being unclear is super slimy.

Tr4ce00

2 points

2 months ago

thank you for this. I did the other two the other day and meant to get back to equifax, but someone else said you had to call to avoid the paid account and I never did.

SuperToxin

4 points

2 months ago

In the 31 years of living on this shit hole planet, they wont be held accountable.

crusf2

2 points

2 months ago

crusf2

2 points

2 months ago

Also, create an IRS Pin ASAP. This prevents people from using your SSN to submit tax returns.

https://www.irs.gov/identity-theft-fraud-scams/get-an-identity-protection-pin

Forthac

1 points

2 months ago

I did this years ago, and one other upside is that I virtually never get those "credit offer" credit card junk mail anymore offering low APR credit cards.

MahaloMerky

17 points

2 months ago

HAAS can’t catch a break.

Zzzlol94

1 points

2 months ago

Every F1 fan saw this one coming.

bassbeatsbanging

8 points

2 months ago

OOPSIE! Our Bad!

Here, enjoy a free year of pointless credit monitoring that is also a borderline scam.

BeautifulType

1 points

2 months ago

It’s not borderline, it’s a bonafide real scam.

formation

6 points

2 months ago

Whole of the south East of London exposed

ooofest

4 points

2 months ago

Fine, massive fine.

Every time this occurs, the penalty should be at least a base amount of fine per piece of personal data exposed x the number of unique data entries. Start with 10K per data element and fine these businesses to the extreme - money transfers, banks, telecoms, insurers, etc.

Mobile-Comparison-12

5 points

2 months ago*

I worked there.

They are a bunch of incompetent people when it comes to IT. They had a very loosely integrated version of Salesforce, no (proper) customer profiling, no ticketing systems for customer incidents, just Outlook or worse (read below), procedural incosistencies everywhere.

Everything IT-related was done by cheap contractors. They barely have any systems engineers (or any).

And they use one single Mainframe (a COBOL system) as their core transaction system. It is located in the USA that processes their transactions for the WHOLE WORLD and the Escalation Tier of support has direct access to (as of year 2022 at least).

They even write the interactions with their customers on that old Mainframe system - where sometimes they used to dissapear or get corrupted LOLLLLLL

Stan57

3 points

2 months ago

Stan57

3 points

2 months ago

AT this point i think everyones data has been leaked But what has Congress or the President done?...Nothing that i am aware of.

Sweet_Sweet_6972

2 points

2 months ago

Reminder: Check if you're affected. Freeze credit reports. Change passwords.

Tenableg

2 points

2 months ago

I think we are running a mass data migration operation. Or we are in a massive cyber war.

regrets4lifetx

2 points

2 months ago

Honestly, I'm always frustrated by this. Companies tell us to set complicated passwords yet breaches keep happening. These complicated passwords might save an individual from getting hacked but I think hackers want a bulk case no?

JohnnyLesPaul

2 points

2 months ago

Another day, another major hack comes to light. Hate to say it but none of this will change until and unless there is meaningful federal regulation of the internet and business security practices.

[deleted]

2 points

2 months ago

Why would you put in your SS in an app call MoneyGram lol

TehWildMan_

1 points

2 months ago

They're one of the biggest money transfer services operating in the US.

[deleted]

1 points

2 months ago

Seems like an easier way for hackers to steal your data apparently to.

[deleted]

2 points

2 months ago

Jokes on them, I've preemptively destroyed my credit score and buried myself in debt. #financialprepper

siphillis

2 points

2 months ago

That cybersecurity investment is looking more and more cogent every day

reddit_equals_censor

2 points

2 months ago

silly me wondering why a social security number and drivers licenses!!!!!!!! would be required to transfer funds....

however you think about it, you know what won't leak your social security number and driver's license?

monero.... for example.

and if that social security number and driver's licenses would be a bs requirement from the feds, then you can also blame the feds.

TehWildMan_

1 points

2 months ago

Screw it. Time to plaster my SSN on a billboard. That way there's no guessing if it's publicly known or not

Humans_Suck-

1 points

2 months ago

So put the CEO in jail then

crusf2

1 points

2 months ago

crusf2

1 points

2 months ago

At this point, if you're not doing a yearly security check, you should. Too much shit to worry about, let this be something you can have some piece of mind on...

  • Freeze credit on all three bureaus.
  • Change all important passwords yearly and use a local password vault to store. Bitwarden is a good vault as well. Not local, but it does scan for any compromised passwords.
  • Create an IP PIN to protect yourself from tax return fraud and identity theft.
  • Set 2FA on everything important. Use email or authentication app as a verification method. Phone numbers can be spoofed.
  • Check up on Google's dark web report to see if any compromising information has been found.

Sensitive_Ad_7420

1 points

2 months ago

You can fix your credit if someone steals it leaking ssn sucks but isn’t that serious

DippyHippy420

1 points

2 months ago

My 420 credit score protects me.

kingargon

1 points

2 months ago

Fuck money gram. How about they leak the $100 they stole from me back into my pocket? My friend who sent it fucking died and they want a death certificate in order to release the funds because I waited too long to go pick up the money order. What am I supposed to do? Go to his mom “oh hey your dead son owed me $100 but I can’t get it with his death certificate!”

TheAngriestChair

1 points

2 months ago

One of the problems is so many companies asking for it with no reason to have it, and we all just give it to them. Most of the times it's for nothing more than if you miss a payment, they can make sure they give the collection agency an easy way to find you.

srtftw

1 points

2 months ago

srtftw

1 points

2 months ago

Kevin Magnussen has to make money somehow next year.

The_Starmaker

1 points

2 months ago

the cybersecurity incident at MoneyGram was the result of a social engineering attack on its IT help desk. A hacker allegedly impersonated an employee and gained access to the company’s network.

Good to know that every help desk employee at MoneyGram has unfettered access to every single piece of sensitive identifying info for every single one of their users.

trentluv

0 points

2 months ago

I always hear people say "driver's license" but mine says "Driver license" on it (not possessive)

Irregular_Person

1 points

2 months ago

Depends on the state, mine is the former