SINs, Renamed to: Let's argue about SINs Options

[Shemhazai]

I generally like the SIN rules, but I would change a few things.

Sengir has just made a good point. That's how the rules logically read.

[Smash]

Yes, but playing a game should not suck.

Shdowrunners fall into the adventurer mentality: they're not Average Joes, they're something else. So, they get a small degree of plot immunity: no runner has to worry about a common cold, or random bank errors, or parking tickets. They get to ignore the everyday stuff.

Rating 0 SINs work on that principle. Shadowrunners are supposed to be survivors, professional deniable assets who protect their identity. It's reasonable to assume they have stored, or have access to, a few backup identities that aren't well fleshed out. It's not much, not enough to withstand any dedicated check, but it is good enough to get across town to your safehouse without being flagged for driving without a license.

The whole point of becoming a runner is to find a way out of the sucktitude of being SINless. It's not meant to just be a vocation of choice. It's not like runners say "You know what Chartered Accountant would be boring as shit, I'm going to become a Street Samurai!" I think that's something that 4th and 5th edition have let slide, hence my statement on Dystopia being lost. Now that's not to say that you can't have a runner that's just a disenfrachised youth if that's what you want, but that's not the primary driver, especially in the earlier settings.

With an E in resources you can start with a R1 SIN and a months low lifestyle. Sure you might not have much else, but that's why you're becoming a runner right? If you choose not to have a SIN then you're eeking out a living in the Barrens with a street or squatter lifestyle. Neither of which I think require (or should require) as legal SIN.

[Draco18s]

Again, that's where the fundamental disconnect between the setting and rules is. Per the rules if you do not have a SIN, any SIN, driving a car and getting food become impossible.

Not because doing so is illegal without a SIN, but because per the rules, you should be outright arrested for trying. Not accosted but thrown in lockup. Which breaks down if 30% of the world's population is SINless: there'd be no room to hold them.

Ergo, either:
a) its not impossible to get food without a SIN
b) its not impossible to get a (fake) SIN

[binarywraith]

No room to hold them, and who's going to bother arresting them when you just have to feed and shelter them after? I mean, 15% criminal SIN tax on the absolutely zero money they make is poor return on investment, not to mention the costs of paying KE or the Star to pick 'em up and process 'em.

[Smash]

Again, that's where the fundamental disconnect between the setting and rules is. Per the rules if you do not have a SIN, any SIN, driving a car and getting food become impossible.

Driving a car would be hard, but I think your assumption that you can only get food from registered businesses is not a particularly plausible one.

Not because doing so is illegal without a SIN, but because per the rules, you should be outright arrested for trying. Not accosted but thrown in lockup. Which breaks down if 30% of the world's population is SINless: there'd be no room to hold them.

Ergo, either:
a) its not impossible to get food without a SIN
b) its not impossible to get a (fake) SIN

This is why (In Seattle at least, there are the barrens. It's a place the illegals can live and the government doesn't have to do anything about it. Wasn't the government herding them all into one of the archologies at one stage?

There's be plenty of businesses that don't care and just fudge transactions (credsticks are as good as cash afterall). Alternatively I imagine there are black markets for everything in this Dystopian setting. The barrens would be full of little markets driven by trade of good that fall off the back of trucks or that are grown locally. Thinking of this, I assume that this is how most Shadowrunners source their gear anyway. I never imagined that they're getting their military grade weapons from Wallmart or their used cyberware.

[Cain]

@Cain

On an R1 scanner it might, since that kind of check only tests if you can provide any number that looks like a SIN. An R2 scanner does a "basic redundancy check", which I assume means something like a Cyclic Redundancy Check, or the Mod 10 checksum used for card numbers

A problem with that is that the description implies that a SIN which has a correct checksum (presumably already at R1, because otherwise it would not encode random height and sex but nothing at all) would always get past an R2 scanner...

The problem is that a SIN is more complicated than that, nor do we know what information goes into a SIN check. So, let's say that when you slot your ID, you also have to add some personal information-- maybe use your birthday as a PIN. If that doesn't line up with the numbers in the SIN, you're auto-flagged. And not all runners would know that, there's plenty of people in Washington state who don't know what goes into their driver's license number.

The whole point of becoming a runner is to find a way out of the sucktitude of being SINless. It's not meant to just be a vocation of choice. It's not like runners say "You know what Chartered Accountant would be boring as shit, I'm going to become a Street Samurai!" I think that's something that 4th and 5th edition have let slide, hence my statement on Dystopia being lost. Now that's not to say that you can't have a runner that's just a disenfrachised youth if that's what you want, but that's not the primary driver, especially in the earlier settings.

Actually, that's absolutely not true.

There are many reasons why someone might become a shadowrunner. In fact, there used to be one called the "Chromed Accountant"; he showed up in lots of shadowtalk, and he was indeed an ex-suit. Dirk Montgomery was one of the first characters in Shadowrun, and he was an ex-corp employee who left because of corruption in his company. Sam Verner *was* the first character to become a shadowrunner in Shadowrun fiction, and he was a Renraku wageslave, complete with SIN. There's lots of others going back that far. They became voluntarily SINless, getting high powered deckers and fixers to delete them from the SIN database.

[Shemhazai]

The problem is that a SIN is more complicated than that, nor do we know what information goes into a SIN check. So, let's say that when you slot your ID, you also have to add some personal information-- maybe use your birthday as a PIN. If that doesn't line up with the numbers in the SIN, you're auto-flagged. And not all runners would know that, there's plenty of people in Washington state who don't know what goes into their driver's license number.

Software, even if it's cut off from the Matrix, can determine name, age, date of birth, city of birth, and issuing nation. This means that a fake SIN can be spotted if this data is obviously wrong. The rules talk about age, nationality and sex not matching, so gender must be in there somewhere, because it exists even when there is no supporting (online) data. The nationality not matching doesn't make sense to me. Who's to say I'm not whatever nationality the SIN says? It would make more sense if it were ethnicity or metatype. I would also change the wording so that the issuer can be a megacorp, not just a nation.

I think a hacker should be able to write a script to extract the embedded info from a given SIN, and determine if a SIN is mathematically valid. Would that negatively impact the game? Should the algorithm be a well-kept secret?

The system has biometrics on file. The rules discuss external supporting data and history as well. These are basically database lookups as you described. Higher rating devices can instruct the system to check for conflicts and to externally verify at random.

The "no food and no walking down the street" part I would also change. I can see a few reasons why people might want it: end times Biblical prophecy (Rev. 16-17), commentary on eroding privacy, grittier dystopia, or my favorite, opportunities for drama like the films Minority Report (where the main character got his eyes replaced by a street doc so he could roam freely) or The Net. (Oh noes, I've been DELETED!)

When I first heard of the SINless, it evoked a powerful image of people who somehow fell through the cracks but were freer despite the hardship. The definition now includes a significant part of the population. I think the game world as a whole is better with SINless people being relatively rare.

[Cain]

Software, even if it's cut off from the Matrix, can determine name, age, date of birth, city of birth, and issuing nation. This means that a fake SIN can be spotted if this data is obviously wrong. The rules talk about age, nationality and sex not matching, so gender must be in there somewhere, because it exists even when there is no supporting (online) data. The nationality not matching doesn't make sense to me. Who's to say I'm not whatever nationality the SIN says? It would make more sense if it were ethnicity or metatype. I would also change the wording so that the issuer can be a megacorp, not just a nation.

I think a hacker should be able to write a script to extract the embedded info from a given SIN, and determine if a SIN is mathematically valid. Would that negatively impact the game? Should the algorithm be a well-kept secret?

The question isn't the decker who makes the fake SIN, the question is the SINless schlub using it.

If the fake SIN is any good (at least rating 1) all the data has to make sense. It can't list one birthdate in the data, and another in the number itself, for example. That means whatever formula is used to derive the SIN must be known to the person who made it.

But, that doesn't mean Ted the Troll, who buys that SIN off someone, knows that information. So, if he uses the SIN, and it asks for routine information like his birthdate as a PIN, he'll get flagged right away. Ted might not know the birthdate encoded into the SIN, or might forget it.

The "no food and no walking down the street" part I would also change. I can see a few reasons why people might want it: end times Biblical prophecy (Rev. 16-17), commentary on eroding privacy, grittier dystopia, or my favorite, opportunities for drama like the films Minority Report (where the main character got his eyes replaced by a street doc so he could roam freely) or The Net. (Oh noes, I've been DELETED!)

When I first heard of the SINless, it evoked a powerful image of people who somehow fell through the cracks but were freer despite the hardship. The definition now includes a significant part of the population. I think the game world as a whole is better with SINless people being relatively rare.

There are people today who are kind of "off the grids"; they don't have bank accounts, credit cards, or smartphones, any of that. They exist in a weird limbo: some of them have legal ID, so they can work, but they operate in a cash economy. Some people live here by choice, others because they're forced to-- I did for a while, I got into trouble and was not able to have a bank account for a few years.

Anyway, that's how I picture the SINless living. It's a life that's hard to imagine if you don't live it-- you're a slave to the check cashing places, you can't shop online without buying a prepaid card, that sort of thing. In order to purchase things online, you need a way to convert what you have into something they'll accept, which is harder than it sounds. I picture a lot of bartering going down, plus a lot of simulated ID's being used-- prepaid credit cards, for example, can double as an ID in a pinch.

[Sendaz]

I see the SINless doing a lot of trading/bartering with each other as well as the one or two souls who have connections with a SIN type or their own SIN who can run in to the better areas and get stock.

Not too unlike how back in Everquest you would have guys from opposite faction (like say a troll) who would stand just out of the aggro range of the NPC guards of a human controlled city (instant death if the troll went in) and bought food from other players who could go in and get supplies for them (at a small profit).

So a Fake SIN should be obtainable, but not too easily otherwise why doesn't everyone just have a Fake one to do whatever, but again not astronomical for the low rating stuff that is little more than the equivalent of a badly made fake to go get booze with.

[Bertramn]

I do not like the disconnect after fourth edition,
between on one hand establishing the Crash 2.0,
which leaves millions SINless,
and on the other hand requiring everybody to have a SIN for any mundane action.

If the system required the SIN, why does the system not force SINs upon the SINless?
It is an authoritarian action, that falls well in line with the fluff.
In this scenario I might not be hindered in buying anything, if I am SINless,
but I might be arrested if the autorities catch me, and forcefully assigned a SIN.
The only data they could include in the SIN would be Metatype, Gender, 'Race',
looks, and DNA, but that is enough to start in my opinion.
To get privileges, like better chances of getting a job in the Sinner world,
one would have to provide data, like a birth certificate, and diplomas and such.
SINless could still exist in the Barrens, where the authorities do not reach,
without being registered at all.

As I said, I would love to take the concept further.
In my example of 2100, while a SIN could be required for certain actions,
that might work just as well the other way around.
If I have a skillfully faked SIN with attached investigative privileges bestowed by Ares Macrotechnology,
I could probably beat up people on the street for 'interrogation purposes',
and not be further hassled by Knight Errant officers, after they check my SIN.

It would be friggin' awesome,
and it fits in great with the theme of: SINner; SIN; SINless, being a play on the screwed-up ethical situation the SIN imposes.

[Shemhazai]

The question isn't the decker who makes the fake SIN, the question is the SINless schlub using it.

If the fake SIN is any good (at least rating 1) all the data has to make sense. It can't list one birthdate in the data, and another in the number itself, for example. That means whatever formula is used to derive the SIN must be known to the person who made it.

But, that doesn't mean Ted the Troll, who buys that SIN off someone, knows that information. So, if he uses the SIN, and it asks for routine information like his birthdate as a PIN, he'll get flagged right away. Ted might not know the birthdate encoded into the SIN, or might forget it.

I think you've answered my question.

First, I wasn't talking about deckers generating SINs, but instead going by the SIN theft model discussed earlier in the thread. I now think that neither should be allowed. I would hope that when you buy a SIN you at least know its basic info.

By the rules, level 1 SINs don't have any supporting data (online data). They only have data embedded in the number itself, and it's just some random person. I'm not really feeling the birthdate PIN idea. Higher rating devices can already externally verify random information (other databases with corroborating information about the SINner), or check biometrics on the spot.

As for whether or not the SIN generation or data extraction algorithms are public knowledge, it seems to me that those would enable hackers to not only do what the authorities can do, which is get the embedded info out of a SIN, but also trivially create at least rating 2 SINs with matching age, gender, and race. These shouldn't be allowed. Maybe if it consumed vast computational power to generate a working SIN on the fly, or (strong) cryptography were somehow involved to make it much harder to crack SINs...

If simple SIN theft were an option, it seems like it would be too easy to phish or pharm real ones out of the air, even to sell them on underground markets.

[Sengir]

The problem is that a SIN is more complicated than that, nor do we know what information goes into a SIN check.

We know, because it's spelled out on page 368 of the core book, bottom left.


@Shemhazai: What's the problem if people can make up a crappy SIN which allows them to buy food, but nothing else?

[Cain]

We know, because it's spelled out on page 368 of the core book, bottom left.

Unless there's something wrong with my pdf, that's the Reputation rules. (IMG:style_emoticons/default/nyahnyah.gif)

I found the table you're looking for, though. The odd part is that it doesn't actually seem to do anything, it's just a fluff description-- it looks like a bunch of technobabble to me. They use "redundancy check" at least twice, but what does that actually mean? They check the same information more than once? More than one database?

Even Rating 1 checks are too vague. All it says is: "Do you have a SIN?"-- what does that mean, exactly? Do you just say "Yes, Mr. Bartender, I do!" and you're good? Wouldn't you need to run it, at least minimally, just like the above section suggests?

[Tymeaus Jalynsfe...]

Even Rating 1 checks are too vague. All it says is: "Do you have a SIN?"-- what does that mean, exactly? Do you just say "Yes, Mr. Bartender, I do!" and you're good? Wouldn't you need to run it, at least minimally, just like the above section suggests?

I would have thought that was pretty obvious... (IMG:style_emoticons/default/smile.gif)
It means that the Rating 1 Verification Device only looks to see if the SIN number makes sense (and will check absolutely nothing else). Even with a R6 SIN, it will never be checked beyond that particular data point.

[Cain]

I would have thought that was pretty obvious... (IMG:style_emoticons/default/smile.gif)
It means that the Rating 1 Verification Device only looks to see if the SIN number makes sense (and will check absolutely nothing else). Even with a R6 SIN, it will never be checked beyond that particular data point.

That makes no sense, for a variety of reasons.

First of all, if all it checks is that a SIN makes sense, you can still get a lot of wild (but possible) responses, like how the troll was actually born in Nigeria in 1986.

Second, it means no one is checking backup security points, like a PIN or CCV number.

Third, it assumes no credit checks, which either means you can't use to it buy anything, or identity theft is a huge booming field. An old homeless trick with stolen credit cards was to run around to McDonalds and buy 24.99 worth of stuff. That's because their system doesn't require a PIN for purchases under $25. I won't go into how that can become cash, but basically there's ways to bleed someone dry even when there's a good system of checks in place.

[Smash]

I would have thought that was pretty obvious... (IMG:style_emoticons/default/smile.gif)
It means that the Rating 1 Verification Device only looks to see if the SIN number makes sense (and will check absolutely nothing else). Even with a R6 SIN, it will never be checked beyond that particular data point.

Agreed. Most businesses will be checking SINs only to the point that they exist. I wouldn't even think that they check any of the info (at least for the sale of non-restricted goods). It would be purely for taxation and transaction record keeping. Some, where it would be easy to fudge would ignore the SIN check anyway where possible ("Yep, 2000 burgers were wasted this month", cash goes straight into manager's pocket).

[Redjack]

That makes no sense, for a variety of reasons.

To the contrary, it makes perfect sense to some of us.

First of all, if all it checks is that a SIN makes sense, you can still get a lot of wild (but possible) responses, like how the troll was actually born in Nigeria in 1986.

Its not looking at any of those extranious details. Its only looking to see that the fake SIN has the data element of SIN, not birth date, sex, race, etc.

Second, it means no one is checking backup security points, like a PIN or CCV number.

Agreed.

Third, it assumes no credit checks, which either means you can't use to it buy anything, or identity theft is a huge booming field

A bank account is not the same as a identification (SIN).

[Sengir]

Unless there's something wrong with my pdf, that's the Reputation rules. (IMG:style_emoticons/default/nyahnyah.gif)

Might be that I still have the old release on this device.

I found the table you're looking for, though. The odd part is that it doesn't actually seem to do anything, it's just a fluff description-- it looks like a bunch of technobabble to me. They use "redundancy check" at least twice, but what does that actually mean? They check the same information more than once? More than one database?

Even Rating 1 checks are too vague. All it says is: "Do you have a SIN?"-- what does that mean, exactly? Do you just say "Yes, Mr. Bartender, I do!" and you're good? Wouldn't you need to run it, at least minimally, just like the above section suggests?

You know that feeling when a discussion seems to repeat itself? http://forums.dumpshock.com/index.php?show...t&p=1306397

[Shemhazai]

@Shemhazai: What's the problem if people can make up a crappy SIN which allows them to buy food, but nothing else?

A good question with a complex answer. There are trade-offs with various approaches, but I don't like the option of creating hundreds of low level SINs in a poor attempt to live under the radar. In short, my view of how the world should work includes buying fake SINs in the underground economy, even crappy ones.

[Cain]

A bank account is not the same as a identification (SIN).

No, but in Shadowrun, apparently they're closely linked. Nobody carries cash anymore, and options like certified credsticks are apparently rare.

On top of that, right now credit cards are being used as a sort of backup ID. There are places that require both a credit card and conventional ID, even if they accept cash. I was on vacation for Christmas, and both of the hotels were like that. I know some rent a car places have a similar policy.

Since a SIN is required to purchase anything legally, it's not a stretch to say it's linked to most of your credit cards and bank accounts. It means you don't need to carry a separate debit card, credit card, cash, driver's license, and account numbers-- it's all handled with the same ID, which fits the Shadowrun SIN fiction. However, it also means that identity theft is serious business, since if I can forge someone else's SIN, I'll have access to their entire financial life.

[Smash]

Since a SIN is required to purchase anything legally, it's not a stretch to say it's linked to most of your credit cards and bank accounts. It means you don't need to carry a separate debit card, credit card, cash, driver's license, and account numbers-- it's all handled with the same ID, which fits the Shadowrun SIN fiction. However, it also means that identity theft is serious business, since if I can forge someone else's SIN, I'll have access to their entire financial life.

Which is probably why it shouldn't be in the game. Your SIN gets burned your resources get burned or alternatively I now need yet another level of complexity on SIN management in game that desperately needs less.

[Redjack]

Since a SIN is required to purchase anything legally, it's not a stretch to say it's linked to most of your credit cards and bank accounts.

Not saying that it isn't. Only making the point that stealing someone's SIN does not automatically mean you've also stolen their bank accounts.

[Sengir]

No, but in Shadowrun, apparently they're closely linked.

The combination of my name and address is also linked to a lot of other information. But that does not mean every place which asks you to provide a name and address performs of thorough check of this identity. Just think of the countless online registration forms which require an name and address, unless it's needed for shipping or billing you can (and should) register as Damien Knight of 1600 Pennsylvania Avenue and nobody cares.

On top of that, right now credit cards are being used as a sort of backup ID. There are places that require both a credit card and conventional ID, even if they accept cash.

I'd say that is rather a feature of the sorry state of US identification means (IMG:style_emoticons/default/wink.gif)

[Cain]

The combination of my name and address is also linked to a lot of other information. But that does not mean every place which asks you to provide a name and address performs of thorough check of this identity. Just think of the countless online registration forms which require an name and address, unless it's needed for shipping or billing you can (and should) register as Damien Knight of 1600 Pennsylvania Avenue and nobody cares.

No, but that goofiness stops the moment you're supposed to pay for something online.

According to SR5, a SIN is "linked to every piece of information about them in the Matrix"-- which would include bank accounts, among others. By providing your SIN, you don't just give someone your address and phone number, you give them your entire credit history, every legal transaction you've ever done, all your medical records, the works. This system cannot work if identity theft is a big deal. And, apparently it's not-- it seems to be easier to create a totally false SIN than hack someone else's, for example.

Anyway, not only does a SIN link to all your information, in some cases it's all you need to access that information (or money). There's an example in one of the books about wifi purchases-- you just throw what you want into a bag, and walk out. The wifi detects your purchases and your SIN, bills you appropriately, and off you go. It's kind of like the paypoint card readers-- you don't need a PIN, the physical card is enough. In this case, just broadcasting the right SIN is enough--but that only works if the SIN itself is very very secure.

[Redjack]

According to SR5, a SIN is "linked to every piece of information about them in the Matrix"-- which would include bank accounts, among others. By providing your SIN, you don't just give someone your address and phone number, you give them your entire credit history, every legal transaction you've ever done, all your medical records, the works. This system cannot work if identity theft is a big deal. And, apparently it's not-- it seems to be easier to create a totally false SIN than hack someone else's, for example.

I'm really not sure if you're being purposefully obtuse here or not, but "linked" and "combined" do not mean the same thing. My social security number is "linked" to all my financial records but obtaining it does not grant you access to query all my financial records.

You are derailing this conversation and I would prefer that not happen...