14 HN users recommended this explainer9 months2017–2024score 9.5
Years with an HN recommendation, 2007–2026
HN reaches for it in every identity theft and data breach thread as the clearest, most enjoyable short explainer of why SSNs make bad identifiers.
CGP Grey explains the history of the US Social Security card and number, and why they became a de facto national ID despite never being meant for it. He also covers why America resists a proper identity card.
“this is the most enjoyable explanation for it I've seen, by CGP Grey” (HN, 2017)
For anyone who wants an explanation at just how bad the social security number really is, this is the most enjoyable explanation for it I've seen, by CGP Grey [this video]
For everybody who isn't acquainted with how Social Security Cards work in the US and how they came to be I highly recommend watching "Social Security Cards Explained" by CGP Grey [this video] He also explains why US citizens don't have an Identity Card as opposed to many European countries.
Explains how SSCards came to be and why US lacks ID cards
Don't blame the immigrants, blame those who are fully or partly paying under the table. Of course, would you support a national ID card as a means of combating this variable you accuse? In the US we pretty much have such a thing already, just without any proper security or identification aspects... [this video] (A short (< 8 min) video by the ever informative CGP Grey on the inanity of US SS cards.)
Short explainer on the flaws of US Social Security cards
The SSN was never intended as a national ID. It was originally created alongside the Social Security Administration, to track what individuals put in and what they take out. People only received one upon becoming employed. Over time, the IRS realized that it could be used as a national ID, and adopted it for that purpose. They encouraged people to obtain one from a young age (even for their newborn children), and it was used to replace the original 'honor system' of 'How many children do you have?' tax discounts; now they'd need to register their child with a SSN. Companies eventually began piggybacking on the number as a national identifier (due to our lack of one), and voila. We're left with an awfully insecure identification system that shouldn't be an identification system for much in the first place. For anyone interested in more: [this video] , and the sources below the video.
CGP Gray did a really good video[1] about this recently. The short version is that it's the least terrible mechanism presently available for uniquely identifying and disambiguating American citizens. [1] [this video]
Explains SSN as least terrible way to identify Americans
Here's a relevant pop science video by CGP Grey[0] that explains all the various problems with SSNs. My favorite part is the fact that until quite recently (2011) you could decrement or increment a given SSN by 1 and get another valid SSN, since they were sequential. [0]: [this video]
Pop science explanation of SSN problems, including sequential numbering
Actually, the SSN is an account number, solely intended for tracking money paid into and paid out of an account. It isn't meant for identification, and the method it's used for identification is terrible. (Largely: If you know the number, you are identified.) It's treated like a secret, but as a 9-digit number you give to dozens of organizations in your life which follows a predictable and partially guessable pattern, it is an absolutely terrible secret. Absolutely good explainer video about how this travesty took place historically: [this video]
Good explainer on how SSN became misused as identification
CGP Grey recently made a great video about this exact problem with social security numbers: [this video] They were started to keep of taxes and never meant to be used as IDs.
This video does a great job explaining it: [this video] The summary is that the USA does not have an official national person identity number. The SSN is the closest approximation, so it is being (ab)used as one. This is despite that it is explicitly not designed for it and has some qualities which make it less suitable (the numbers are small and very predictable). In general, nearly every national-identity-system suffers from a contradiction between assigning identities and identifying. Where the number you get assigned is simultaneously your identity and a secret you use to establish your identity. There are initiatives to solve this using cryptography, but this is complicated by political attitudes towards privacy and government tracking. I dare say in the USA this is more pronounced due to both the problem and the political attitude against solutions being more pronounced.
Explains why SSNs are poorly suited as national identity numbers
The story of how this happened is quite interesting. CGP Grey did a video about how it evolved [0]. I'm not American so I can't judge how likely it is to ever change because it seems to be politically radioactive to propose a government mandated ID. We had a similar issue in Australia, but our workaround is that your drivers license (or ID card from the equivalent of the DMV) typically acts as your ID. [0] [this video]
There's an interesting story about how the social security number evolved to being much more than just for social security. Quick 5 minute primer: [this video]
Quick five-minute primer on how SSNs grew beyond social security
For non-Americans (and Americans) that don't quite understand what SSN is and why it's a problem, CGP Grey [1] has a great (and short) video about the history and why it's not technically an identifier, but has become one. [1] [this video]
Short history of why SSN became an identifier despite not being one
You're right. My guess is most "anonymized" data is lazy--stripping out obvious identifying information. There are quite a few cases where you can pinpoint users from correlating to publicly available data. CGPGrey posted a video today showing a layman's example with Social Security Numbers[1]. One cool thing I heard Apple talk about[2] was injecting noise or subsampling to help mask individuals. Although, I don't see that mentioned in their public page on privacy[3] or their whitepaper[4]. [1] [this video] [2] [link] [3] [link] [4] [link]
Shows how Social Security Numbers enable identifying anonymized data
This happened to a photography editor who sits in the cube across from me. He found out he had a ticket in Pittsburgh, a city he had never been to, when he tried to transfer his license to a new state. No lawyer would take the case either. He eventually went to an identity theft company, who took $400 and fixed the issue in three months. I use to work in Identity Management at a major university. A number of people came through our systems without SSNs. We had a complicated set of rules to make sure we didn't provision two accounts. We'd check if the names were reversed and we'd check both the month/date = date/month on the date of birth (people from other countries might enter it backwards without thinking about it). We even had rules for SSNs that were off by <2 digits with similar names. Every morning we'd have a set of "manual provisions" we'd have to stop and check. Occasionally duplicate accounts get created and we'd have to go through a big manual process of combining them and telling them "You need to use this account; forget about the other one. It no longer exists," and get their stuff synced across all AD domains (Universities typically have several). What surprises me about this article is the NYC system doesn't use the SSN (which is good in a sense, it should never be used as a identification number, see the latest GCP Greg: [this video] ). The idea of an identity and criminal record us that follows us digitally is a very new concept, one that didn't exist 150+ years
Cited for why SSNs should not be used as identifiers
Yeah, I suppose that's right. And as you say, it's very practical. > Keep in mind that the social number in USA is apparently also supposed to be secret (like a password) which sounds absolutely crazy to me. That's very true, reminds me of this video [1] by CGP Grey, giving some background of the issue. [1] [this video]
I was talking about this with a friend the other day. I don't know about the technical feasibility (RE sybil attack[0]), but if it were possible, it would have a massive impact on the web. The current state of the art (in terms of new user signup) is using phone numbers as representing unique "trustable" people, which is kind of absurd. This reminds me of how social security numbers weren't originally intended to be used as unique identification, but the demand for some form of identification was so strong that organisations ended up hackily using it anyway.[1] [0] [link] [1] [this video]
Cited as example of a number repurposed as identification
They are in fact not great IDs and the Social Security Administration asked very nicely for the rest of the country to not use them as a form of identification: [this video] A few reasons why SSNs are bad as IDs: 1. There are a number of situations where people will not have a SSN. 2. SSNs are "secrets" that need to be broadly shared to participate in many parts of business and government in the US. 3. SSNs lack many security and authentication mechanisms most forms of ID have (e.g. photo ID) There are folks in the US who rally against the idea of a national ID, but I've always thought it was a silly argument considering how pervasive and problematic SSNs are as a form of identification.
Video list and Hacker News comment labels from HackerTube (prompted by @karpathy), released under ODC-By 1.0, built on the open-index/hacker-news archive. Hacker News data is provided by Y Combinator; comments remain the work of their authors. Video titles, channel names and thumbnails belong to their creators and are shown via YouTube. HackerTube Watch is an unofficial edition. Data export of 2026-10-31.
20 Hacker News comments
From the HN archive; up to 20 kept per video, favoring different commenters. Recommendations first.
Read more
Read more
Citations, criticism and jokes
Read more
Read more