Saturday, November 05, 2005

The Social Security Number is TOO Short

The American social security number as a security device is much too short. Because there are only 9 numeric digits, there are only 1 billion combinations. This seems short, but remember that the U.S. population stands at 297 million (and counting), which means that the numbers will have to start being re-used after less than 4 generations. Plus, using this number as a security device means that more than 25% of the search space is valid. If you pick 9 numbers at random, you have a 25% chance of it being a valid number. I hope there isn't a national clearinghouse that allows viewing of personal data with only a social security number. Now matching that number to a name is still rather difficult, but still totally within computational limits given a validity checker. Modern computes are running in the Gigahertz range, which means they can do something every nanosecond. What they can do isn't much though. They can do something useful probably once a millisecond (that is actually probably on the slow side...people should optimize more). Lets say there is a service somewhere that checks the validity of a social security number if you also give it a person's name and birthdate. Name and birthdate isn't that hard to find. Once you have that, you only need to hammer that service for 12 days (max) before you know someone's social security number. Now, hopefully, someone somewhere would notice your continuous hammering and cut you off before you got to the number, but what if you tried it spread out more randomly over a longer period of time? I tested it with once a second and thankfully, it would take up to 30 years... so as long as someone is watching the service for thousands of failures from one IP address, we should be safe... We are in more danger from people using our info flippantly. For example, my school used to use the social security number as an identifier for everyone. They have since stopped... but we have to watch our services for security gaffes like that. Keep thinking people!

1 Comments:

Anonymous Anonymous said...

Thank you for interesting information about SSN, can I place your article on my site?

8:42 AM, November 30, 2008  

Post a Comment

<< Home