Could the Obsolete System increase Identity Theft?
Social Security Numbers Cracked?
Two researchers at Carnegie Mellon University have formulated a method to predict a Social Security number with little more than the individuals date and place of birth.
The researchers said that the findings could pose serious threats to the use of Social Security numbers to protect personal data, and could increase the risk of identity theft.
“It’s good that we found it before the bad guys,” Alessandro Acquisti of Carnegie Mellon University said.
The Social Security office has been assigning a nine-digit number to each US citizen since the 1930s.
This 70 year-old system has become “obsolete” for use in authentication practices, such as passwords, according to the researchers.
The main component to the study was the Social Security office’s public ‘death file’ database, which is used to track the Social Security numbers of the deceased in order to prevent fraud and identity theft using those numbers from the deceased.
By analyzing the death database along with other statistical information, the researchers were able to construct a method by which an individuals birth date and state of birth could be used to guess the person’s number with “great accuracy”.
“The suggestion that Mr. Acquisti has cracked a code for predicting an SSN is a dramatic exaggeration,” Social Security spokesman, Mark Lassiter, stated via email.
Interestingly, he added: “For reasons unrelated to this report, the agency has been developing a system to randomly assign SSNs. This system will be in place next year.”
“In a world of wired consumers, it is possible to combine information from multiple sources to infer data that is more personal and sensitive than any single piece of original information alone,” said researcher Alessandro Acquisti.
“Given the inherent vulnerability of Social Security numbers, it is time to stop using them for verifying identities, and redirect our efforts towards implementing secure, privacy-preserving authentication methods.”
I have noticed this in the past, from looking at my families SSNs…
I have noticed this in the past, from looking at my families SSNs…