13.6M views · Mar 29, 2017 · 7:49 · 14 HN recommenders · 20 mentions · discussed 2017–2024
CGP Grey explains the history of the US Social Security card and number, and why they became a de facto national ID despite never being meant for it. He also covers why America resists a proper identity card.
Why Hacker News points people here: HN reaches for it in every identity theft and data breach thread as the clearest, most enjoyable short explainer of why SSNs make bad identifiers.
“this is the most enjoyable explanation for it I've seen, by CGP Grey”HN comment, 2017
“this is the most enjoyable explanation for it I've seen, by CGP Grey”
Most enjoyable explanation of how bad the SSN is
For anyone who wants an explanation at just how bad the social security number really is, this is the most enjoyable explanation for it I've seen, by CGP Grey this video
“He also explains why US citizens don't have an Identity Card as opposed to many European countries.”
Explains how SSCards came to be and why US lacks ID cards
For everybody who isn't acquainted with how Social Security Cards work in the US and how they came to be I highly recommend watching "Social Security Cards Explained" by CGP Grey this video He also explains why US citizens don't have an Identity Card as opposed to many European countries.
“A short (< 8 min) video by the ever informative CGP Grey on the inanity of US SS cards.”
Short explainer on the flaws of US Social Security cards
Don't blame the immigrants, blame those who are fully or partly paying under the table. Of course, would you support a national ID card as a means of combating this variable you accuse? In the US we pretty much have such a thing already, just without any proper security or identification aspects... this video (A short (< 8 min) video by the ever informative CGP Grey on the inanity of US SS cards.)
“For anyone interested in more”
History of how SSNs became a de facto national ID
The SSN was never intended as a national ID. It was originally created alongside the Social Security Administration, to track what individuals put in and what they take out. People only received one upon becoming employed. Over time, the IRS realized that it could be used as a national ID, and adopted it for that purpose. They encouraged people to obtain one from a young age (even for their newborn children), and it was used to replace the original 'honor system' of 'How many children do you have?' tax discounts; now they'd need to register their child with a SSN. Companies eventually began piggybacking on the number as a national identifier (due to our lack of one), and voila. We're left with an awfully insecure identification system that shouldn't be an identification system for much in the first place. For anyone interested in more: this video , and the sources below the video.
“we need a national identification card, link to a video about it.”
Makes the case for a national identification card
You're right it was never meant to be a unique identifier, we need a national identification card, link to a video about it. this video
“CGP Gray did a really good video[1] about this recently.”
Explains SSN as least terrible way to identify Americans
CGP Gray did a really good video[1] about this recently. The short version is that it's the least terrible mechanism presently available for uniquely identifying and disambiguating American citizens. [1] this video
“Here's a relevant pop science video by CGP Grey[0] that explains all the various problems with SSNs.”
Pop science explanation of SSN problems, including sequential numbering
Here's a relevant pop science video by CGP Grey[0] that explains all the various problems with SSNs. My favorite part is the fact that until quite recently (2011) you could decrement or increment a given SSN by 1 and get another valid SSN, since they were sequential. [0]: this video
“Absolutely good explainer video about how this travesty took place historically”
Good explainer on how SSN became misused as identification
Actually, the SSN is an account number, solely intended for tracking money paid into and paid out of an account. It isn't meant for identification, and the method it's used for identification is terrible. (Largely: If you know the number, you are identified.) It's treated like a secret, but as a 9-digit number you give to dozens of organizations in your life which follows a predictable and partially guessable pattern, it is an absolutely terrible secret. Absolutely good explainer video about how this travesty took place historically: this video
“CGP Grey recently made a great video about this exact problem with social security numbers”
Great video on SSNs never meant as IDs
CGP Grey recently made a great video about this exact problem with social security numbers: this video They were started to keep of taxes and never meant to be used as IDs.
“This video does a great job explaining it”
Explains why SSNs are poorly suited as national identity numbers
This video does a great job explaining it: this video The summary is that the USA does not have an official national person identity number. The SSN is the closest approximation, so it is being (ab)used as one. This is despite that it is explicitly not designed for it and has some qualities which make it less suitable (the numbers are small and very predictable). In general, nearly every national-identity-system suffers from a contradiction between assigning identities and identifying. Where the number you get assigned is simultaneously your identity and a secret you use to establish your identity. There are initiatives to solve this using cryptography, but this is complicated by political attitudes towards privacy and government tracking. I dare say in the USA this is more pronounced due to both the problem and the political attitude against solutions being more pronounced.
“CGP Grey did a video about how it evolved [0].”
Tells how the SSN evolved into a de facto ID
The story of how this happened is quite interesting. CGP Grey did a video about how it evolved [0]. I'm not American so I can't judge how likely it is to ever change because it seems to be politically radioactive to propose a government mandated ID. We had a similar issue in Australia, but our workaround is that your drivers license (or ID card from the equivalent of the DMV) typically acts as your ID. [0] this video
“Quick 5 minute primer”
Quick five-minute primer on how SSNs grew beyond social security
There's an interesting story about how the social security number evolved to being much more than just for social security. Quick 5 minute primer: this video
“CGP Grey has an excellent video detailing the flaws of how SSNs are utilized.”
Details the flaws in how SSNs are used
I'm late to the party, but CGP Grey has an excellent video detailing the flaws of how SSNs are utilized. this video
“has a great (and short) video about the history and why it's not technically an identifier, but has become one.”
Short history of why SSN became an identifier despite not being one
For non-Americans (and Americans) that don't quite understand what SSN is and why it's a problem, CGP Grey [1] has a great (and short) video about the history and why it's not technically an identifier, but has become one. [1] this video
“CGPGrey posted a video today showing a layman's example with Social Security Numbers[1].”
Shows how Social Security Numbers enable identifying anonymized data
You're right. My guess is most "anonymized" data is lazy--stripping out obvious identifying information. There are quite a few cases where you can pinpoint users from correlating to publicly available data. CGPGrey posted a video today showing a layman's example with Social Security Numbers[1]. One cool thing I heard Apple talk about[2] was injecting noise or subsampling to help mask individuals. Although, I don't see that mentioned in their public page on privacy[3] or their whitepaper[4]. [1] this video [2] link [3] link [4] link
“it should never be used as a identification number, see the latest GCP Greg”
Cited for why SSNs should not be used as identifiers
This happened to a photography editor who sits in the cube across from me. He found out he had a ticket in Pittsburgh, a city he had never been to, when he tried to transfer his license to a new state. No lawyer would take the case either. He eventually went to an identity theft company, who took $400 and fixed the issue in three months. I use to work in Identity Management at a major university. A number of people came through our systems without SSNs. We had a complicated set of rules to make sure we didn't provision two accounts. We'd check if the names were reversed and we'd check both the month/date = date/month on the date of birth (people from other countries might enter it backwards without thinking about it). We even had rules for SSNs that were off by <2 digits with similar names. Every morning we'd have a set of "manual provisions" we'd have to stop and check. Occasionally duplicate accounts get created and we'd have to go through a big manual process of combining them and telling them "You need to use this account; forget about the other one. It no longer exists," and get their stuff synced across all AD domains (Universities typically have several). What surprises me about this article is the NYC system doesn't use the SSN (which is good in a sense, it should never be used as a identification number, see the latest GCP Greg: this video ). The idea of an identity and criminal record us that follows us digitally is a very new concept, one that didn't exist 150+ years
“reminds me of this video [1] by CGP Grey, giving some background of the issue.”
Gives background on SSNs being treated as secrets
Yeah, I suppose that's right. And as you say, it's very practical. > Keep in mind that the social number in USA is apparently also supposed to be secret (like a password) which sounds absolutely crazy to me. That's very true, reminds me of this video [1] by CGP Grey, giving some background of the issue. [1] this video
“social security numbers weren't originally intended to be used as unique identification”
Cited as example of a number repurposed as identification
I was talking about this with a friend the other day. I don't know about the technical feasibility (RE sybil attack[0]), but if it were possible, it would have a massive impact on the web. The current state of the art (in terms of new user signup) is using phone numbers as representing unique "trustable" people, which is kind of absurd. This reminds me of how social security numbers weren't originally intended to be used as unique identification, but the demand for some form of identification was so strong that organisations ended up hackily using it anyway.[1] [0] link [1] this video
“the Social Security Administration asked very nicely for the rest of the country to not use them as a form of identification”
Cited for SSA's request not to use SSNs as ID
They are in fact not great IDs and the Social Security Administration asked very nicely for the rest of the country to not use them as a form of identification: this video A few reasons why SSNs are bad as IDs: 1. There are a number of situations where people will not have a SSN. 2. SSNs are "secrets" that need to be broadly shared to participate in many parts of business and government in the US. 3. SSNs lack many security and authentication mechanisms most forms of ID have (e.g. photo ID) There are folks in the US who rally against the idea of a national ID, but I've always thought it was a silly argument considering how pervasive and problematic SSNs are as a form of identification.
“The closest thing is a Social Security number, which has no security or biometric features.”
Cited for the lack of an American national ID card
Americans have no national identity card. The closest thing is a Social Security number, which has no security or biometric features. this video
