Your comment on credit card numbers is interesting because as I think you’ll agree “much harder to predict” != unpredictable.

FYI, I was most recently the Chief Scientist of a company developing fraud prevention technologies originally based on biometrics and related image based techniques. We developed a camera based surveillance platform that could detect known fraudsters in real time and system that could verify presented identity documents also in real time. The company recently decided to lay off most of the research team and focus its efforts on a project that was deemed to be an easier sale…SSN verification.

I personally always believed this was a dumb idea, and I knew that SSNs could not be used for this purpose. Your paper proves the point better than I ever could have.

Thanks,

Peter

It is true that many security professionals understood that SSNs were not secure personal identifiers and were potentially compromisable. And it is known that using the last four SSN digits as an identifier is a dangerous practice and yet that practice continues widely in spite of this knowledge.

I am curious about other applications like guessing state driver’s license numbers. Any additional comments along these lines?

AA: Thank you for your comments. Have you heard about SOUNDEX? it’s related to the patterns in driver licenses. CC# have patterns too, but more complex than SSNs - much much harder to predict from public data.

AA: Among other things, we have omitted sensitive details about the prediction strategy from the published article (making it much harder to replicate the predictions), and we have shared our results with government agencies prior to publication. In their current form, SSNs are compromised as passwords. However, ignorance is no protection. Instead, we need to alert not just policy-makers, but also businesses and consumers of the threats to individual identities deriving from the use (and abuse) of SSNs as means of authentication - and transition to more efficient, secure, and privacy-preserving means of verifying identities in our society.

I share this because I am wondering why now and why you simply did not rely on the data shown by other researchers.

AA: As noted in the manuscript, the SSN assignment scheme is public knowledge (p. 1). In fact, we do cite previous work in this area by other researchers: said previous work used those patterns to estimate when and where a SSN may have been issued (see p. 1 and [Wessmiller, 2002], [Sweeney, 2004], [EPIC, 2008], cited in the manuscript and in the appendix). Instead, our work focused on the inverse, harder, and much more consequential inference: exploiting the presumptive time and location of SSN issuance to estimate, quite reliably, SSNs. This became possible because:

In short, without the discovery of patterns linking SSN digits to demographic data, knowledge of the assignment scheme would not be sufficient to predict SSNs with a degree of accuracy necessary to expose them to practical risks of identification. For instance, the probability of correctly guessing the first 5 digits of the SSN of an individual born in NY in 1998, even using the knowledge that the SSN was issued within that state, would be 0.012%, and the probability of correctly guessing the entire 9 digits with fewer than 1,000 attempts would be 0.0012%. Under the algorithm highlighted in the manuscript, those probabilities are several orders of magnitude larger. See Table 6 on p. 27 of the Supporting Information.