LIFE CRISES


Nine Easy Numbers Away From ID Theft

Carnegie Mellon professor Alessandro Acquisti and graduate student Ralph Gross discovered that Social Security numbers are easily predicted using public data. Below, Acquisti tells how.

Please describe your findings.

We found that Social Security numbers, which are supposed to be confidential, are predictable from publicly available data. We can start with someone's birthday, add the state where they were born and, based on these two pieces of information, infer their Social Security number.

How?

The assignment scheme for Social Security numbers has been publicly available for many years. Take that scheme, combine data from other sources, apply statistics and data-mining tools, and you can end up with information that is significantly more sensitive than what you started with.

Who is most at risk?

Advertisement

It's easiest to predict the Social Security numbers of people from less-populous states and those born after 1988, when a number of policy initiatives made it more likely that parents would apply for a newborn's Social Security number right away. On average, we can identify the entire nine-digit number in fewer than 1,000 attempts for 9% of people born after 1988. That makes those numbers no more secure than a three-digit PIN.

How do you go from there to identity theft?

To make the algorithm work, you need only information that's public or semi-public for most of us. An attacker has to find a way to exploit the information, and unfortunately, there are many ways. For example, attackers can use botnets -- networks of compromised computers controlled by someone, somewhere. Botnets can be used to run automated queries on an online system, such as an online credit-card application, to verify a Social Security number.

How can we prevent such exploitation?

We need to stop using Social Security numbers as both identifiers and authenticators. The numbers were created to identify earnings in the Social Security program. Your phone number is another example of an identifier. But the password for your voicemail is an authenticator, a secret fact that proves you are who you claim to be. No sane person would use the same digits as identifier and authenticator, but that's exactly the way we use Social Security numbers.

Editor's Picks From Kiplinger


You can get valuable updates from Kiplinger sent directly to your email. Simply enter your e-mail address and click "sign up".

More Sponsored Links


DISCUSS

Permission to post your comment is assumed when you submit it. The name you provide will be used to identify your post, and NOT your e-mail address. We reserve the right to excerpt or edit any posted comments for clarity, appropriateness, civility, and relevance to the topic.
View our full privacy policy


Advertisement
Get valuable updates from Kiplinger directly to your e-mail

Market Update

Advertisement

Featured Videos From Kiplinger