Hackers claimed to have stolen more than 2 billion records containing sensitive information including Social Security numbers, with some data reportedly leaked online.
I’m pretty sure mine has been stolen a dozen times at this point. You should never assume your SSN is private information, but you should treat it as such to limit how many people have it.
The main issues here are:
applications for credit - freeze your credit at the major credit bureaus - Experian, Equifax, Transunion (bonus points for ARS and SageStream); make sure to unfreeze if you apply for a credit card or bank account though
impersonating - like applying for jobs and whatnot; this shouldn’t directly impact you, and it’s on the employer to make sure they know who they’re employing
password resets - the best you can do is use MFA, though many services will allow resets with just personal information; I hope this changes, and some orgs are doing things to prevent abuse (e.g. Fidelity has voice recognition to cut down on support scams)
Honestly, we really need to stop using the SSN as identification.
Because the US doesn’t have a federal identification card. At the state level you can use the id number of someone’s drivers license or state id for identifying them, which is marginally better since it changes with new id cards.
SSNs weren’t intended to be used for identification, but since there’s no other national option they effectively are.
Eh, there are good parts to it as well. The only Federal ID I have is my passport, so there’s no reason for them to track me across state lines. If I get pulled over in Oregon, they don’t necessarily know my driving history in California or Nevada, so I’m more likely to get a warning than a ticket. If I had a Federal ID, they’d probably communicate across state lines more.
I mean, I do. I’ve had three tickets over my entire driving career, each in a different state, and nothing in the last 10 years. I’ve also never been in an accident.
But I’ve been pulled over something like 10 times total for various reasons (registration expired, headlight out, speeding), and because I’m a responsible driver (no infractions or warnings in the prior year or two), I generally get warnings. If warnings were national, one or two of those might have turned into a ticket, and those would probably be fightable in court (but I’m not going to travel hundreds of miles to fight a $100 fine).
Formally request that large transactions through your bank be done with you present, in person. Ask if you can set a limit and only if done in person also temporarily lift that limit.
Obtain a credit card. Either you fight to get your money back when fraud hits, or they fight to get their money back. You can guess which team is better staffed. I was procrastinating for ages getting one myself. Then another fraudulent transaction hit. Despite having a fair amount of knowledge in this realm and doing a solid amount of research independently AND reporting it immediately, it still took days to get money actually placed back into my account. AND THEN IT HAPPENED AGAIN with a brand new card within 30 days. Likely the shitty auto update service large organizations can subscribe to, or I got unlucky on a brute force attempt. Either way, a CC will save you this hassle.
Bitwarden.
Passwords only on your phone. No biometrics without a backup plan.
Yeah, I only use credit cards or cash these days, and leave my debit cards frozen/locked. The only time I would need my debit card is to use an ATM, and it’s easy enough to login on my phone and unlock it. I’ve had several fraudulent charges on various cards, and so far it has been resolved with a short phone call and a reissue, and my replacements seem to come faster than new credit cards. The rewards are nice, but the purchase protections are the real reason I use them.
biometrics
Biometrics are really nice, and on newer phones, way more secure than a PIN. They’re also local-only, so they’re quite privacy-friendly.
But absolutely have a backup. I use a long PIN as my backup, and my bank lets me use a long PIN on my debit card as well, so I keep them the same (easier to remember that way). I use my fingerprint for pretty much everything, but I also have my phone reboot itself after a period of inactivity, which forces a PIN login (again, helps me remember it). Oh, and it’s a random PIN, so not something anyone could guess (I’m a developer, so I used a small Python script: import random; ''.join(str(random.randint(9)) for _ inrange(N)) where N is your desired length). I ran three of those and picked one.
And yeah, Bitwarden is fantastic. I apparently have >300 logins, and there’s no way I’d be able to remember that many unique passwords.
I got a NEW credit card faster than my bank was able to reissue and send me a replacement debit/credit. By like half the time.
I wasn’t aware biometrics were more secure. My info is clearly out of date! Though I was also thinking of the forced unlocking of phones by, er…other people.
Police. I’m talking about the popo.
Good old Tasker should be able to handle the bulk of automating things like an auto-shutdown. Might still need to insert custom code BUT they have a community. A couple searches and verification that you’re not being a dumbass and downloading something malicious and wham bam easy - or manually type it out. I dunno. Don’t be big dumb.
Tasker ain’t obsolete yet, dammit!
Remember, folks! NONE OF THIS MATTERS IF YOU GIVE UP YOUR CREDENTIALS JUST CAUSE SOMEONE CALLED AND SAID GRANDMA WAS INJURED IN A MOTORCYCLE ACCIDENT.
Here’s a Naomi Brockwell video about it. I also used to avoid it, but that video changed my mind. I can easily turn off the biometrics if I’m going somewhere where LE might force me to unlock it (e.g. travel), but I can just mis-scan it a few times and it’ll force me to enter the PIN anyway.
Tasker
Yeah, that can work, but GrapheneOS at least has an automatic reboot option after so much time has passed w/o being used. I set mine to 4 hours so it’ll reboot at night, but I make it a lot less when I’m traveling. Everything is encrypted on a fresh boot and calls still work (emergency outgoing, and any incoming), so it’s a really nice bit of extra security for lazy people like me.
I’m pretty sure mine has been stolen a dozen times at this point. You should never assume your SSN is private information, but you should treat it as such to limit how many people have it.
The main issues here are:
Honestly, we really need to stop using the SSN as identification.
Wait, is the SSN used to verify a person’s identity?
Why would a static key ever be used like that?
Because the US doesn’t have a federal identification card. At the state level you can use the id number of someone’s drivers license or state id for identifying them, which is marginally better since it changes with new id cards.
SSNs weren’t intended to be used for identification, but since there’s no other national option they effectively are.
Laughing in EU
Eh, there are good parts to it as well. The only Federal ID I have is my passport, so there’s no reason for them to track me across state lines. If I get pulled over in Oregon, they don’t necessarily know my driving history in California or Nevada, so I’m more likely to get a warning than a ticket. If I had a Federal ID, they’d probably communicate across state lines more.
It’s mostly bad, but with a silver lining.
How about driving reaponsibly instead?
I mean, I do. I’ve had three tickets over my entire driving career, each in a different state, and nothing in the last 10 years. I’ve also never been in an accident.
But I’ve been pulled over something like 10 times total for various reasons (registration expired, headlight out, speeding), and because I’m a responsible driver (no infractions or warnings in the prior year or two), I generally get warnings. If warnings were national, one or two of those might have turned into a ticket, and those would probably be fightable in court (but I’m not going to travel hundreds of miles to fight a $100 fine).
How about understanding what an example is?
To further protect yourself, you can also:
Formally request that large transactions through your bank be done with you present, in person. Ask if you can set a limit and only if done in person also temporarily lift that limit.
Obtain a credit card. Either you fight to get your money back when fraud hits, or they fight to get their money back. You can guess which team is better staffed. I was procrastinating for ages getting one myself. Then another fraudulent transaction hit. Despite having a fair amount of knowledge in this realm and doing a solid amount of research independently AND reporting it immediately, it still took days to get money actually placed back into my account. AND THEN IT HAPPENED AGAIN with a brand new card within 30 days. Likely the shitty auto update service large organizations can subscribe to, or I got unlucky on a brute force attempt. Either way, a CC will save you this hassle.
Bitwarden.
Passwords only on your phone. No biometrics without a backup plan.
Yeah, I only use credit cards or cash these days, and leave my debit cards frozen/locked. The only time I would need my debit card is to use an ATM, and it’s easy enough to login on my phone and unlock it. I’ve had several fraudulent charges on various cards, and so far it has been resolved with a short phone call and a reissue, and my replacements seem to come faster than new credit cards. The rewards are nice, but the purchase protections are the real reason I use them.
Biometrics are really nice, and on newer phones, way more secure than a PIN. They’re also local-only, so they’re quite privacy-friendly.
But absolutely have a backup. I use a long PIN as my backup, and my bank lets me use a long PIN on my debit card as well, so I keep them the same (easier to remember that way). I use my fingerprint for pretty much everything, but I also have my phone reboot itself after a period of inactivity, which forces a PIN login (again, helps me remember it). Oh, and it’s a random PIN, so not something anyone could guess (I’m a developer, so I used a small Python script:
import random; ''.join(str(random.randint(9)) for _ in range(N))where N is your desired length). I ran three of those and picked one.And yeah, Bitwarden is fantastic. I apparently have >300 logins, and there’s no way I’d be able to remember that many unique passwords.
I got a NEW credit card faster than my bank was able to reissue and send me a replacement debit/credit. By like half the time.
I wasn’t aware biometrics were more secure. My info is clearly out of date! Though I was also thinking of the forced unlocking of phones by, er…other people.
Police. I’m talking about the popo.
Good old Tasker should be able to handle the bulk of automating things like an auto-shutdown. Might still need to insert custom code BUT they have a community. A couple searches and verification that you’re not being a dumbass and downloading something malicious and wham bam easy - or manually type it out. I dunno. Don’t be big dumb.
Tasker ain’t obsolete yet, dammit!
Remember, folks! NONE OF THIS MATTERS IF YOU GIVE UP YOUR CREDENTIALS JUST CAUSE SOMEONE CALLED AND SAID GRANDMA WAS INJURED IN A MOTORCYCLE ACCIDENT.
Here’s a Naomi Brockwell video about it. I also used to avoid it, but that video changed my mind. I can easily turn off the biometrics if I’m going somewhere where LE might force me to unlock it (e.g. travel), but I can just mis-scan it a few times and it’ll force me to enter the PIN anyway.
Yeah, that can work, but GrapheneOS at least has an automatic reboot option after so much time has passed w/o being used. I set mine to 4 hours so it’ll reboot at night, but I make it a lot less when I’m traveling. Everything is encrypted on a fresh boot and calls still work (emergency outgoing, and any incoming), so it’s a really nice bit of extra security for lazy people like me.