11 ms·
Columnist asked researchers what they could find out from just his cell number
- skrause 7y ago> A hacker could try to reset my password for an online account by answering security questions like “What is your mother’s maiden name?” or “Which of the previous addresses did you live at?” That's why you don't answer those questions honestly. My mother's maiden name is always a random 32 character string living in my KeePass database...
- martin-adams 7y agoGood idea! I know this is often asked over the phone, so that'll be a little awkward, especially if using non alphanumeric characters. Interestingly though, I wonder how easy is it to reset your mother's maiden name to a new name if it go out in the wild.
- stronglikedan 7y ago> that'll be a little awkward For them, maybe, but I would relish reading each individual character to them in a slow deadpan monotone.
- deleted 7y ago[deleted]
- perspective1 7y agoI'm not sure that's any safer. It should protect you from the automated prompt-response systems, where an absolute match is required. But call-center workers see those answers in plaintext. Eventually an attacker will probably reach one where answering, "It's a lot of random letters and numbers. I forgot what they were but the real name is Smith!" will be enough to pass.
- MattSteelblade 7y agoRandom dictionary words would solve that issue.
- MrGilbert 7y ago"Oh, yeah... I found that question ridiculous, so I entered some garbage. Anyways, her real name is Smith, if that helps." Social Engineering.
- onion2k 7y agoPresumably the answer to that is to use a long but plausible random string that sounds like a posh English name like "Saint-John Winsor-Rothschild"
- SketchySeaBeast 7y agoThat sounds like the right solution to me - it's the "correct horse battery staple" of this problem. I'm going to start using this. 4 names all put together - pronounceable over the phone, visibly viable, and uniquely generated for each instance.
- fuzz4lyfe 7y agoPerhaps something like this? Q: "What is your mothers maiden name?" A: "Do not provide access under any circumstances unless this exact key is provided: WEWQEWQ321312"
- SketchySeaBeast 7y agoBut that doesn't give me an opportunity to say "Mrs. Sebastian Winifred Campershamp".
- jschwartzi 7y ago
- deleted 7y ago[deleted]
- deleted 7y ago[deleted]
- rhacker 7y agoSometimes these questions come from a database that knows things about your name already - from which you had no input.
- jjoonathan 7y agoIt's even more fun when the database for which you had no input is wrong.
- wool_gather 7y agoA small bank that I use sold itself to a slightly larger bank a few years ago; one of the things that I appreciated about the old bank was that they made this a "short arbitrary secret" field instead of "mother's maiden name" I had given them two randomly-chosen words, stored in my password manager. Earlier this year, I opened a new account with the (new) bank and discovered that they already had my mother's maiden name, were going to use it for identity verification, and wouldn't allow me to change it to something arbitrary (even another fake name that I sometimes use). Quite frustrating, this security based on insecure information.
- tinus_hn 7y agoThat’s possible if they asked you these questions in the first place, instead of getting the data from somewhere else.
- igammarays 7y agoThe reason I don’t store answers to security questions in my database is that it makes it a single point of failure. I want to have some recourse in case my password database is lost or broken into.
- samfriedman 7y agoI do this, and I actually had to use it for the first time yesterday when calling a credit card company. The rep said "I'll need your security question answer... is this right? It looks like it's just a bunch of numbers and letters?" Then I confirmed and started reading it out to her, and she hung up on me. I think I should move to correct-horse-battery-staple style in the future.
- LyndsySimon 7y ago> I confirmed and started reading it out to her, and she hung up on me. That's... troubling. I would have called back specifically to complain about that person. That's absurd.
- asquabventured 7y ago> I think I should move to correct-horse-battery-staple style in the future. The KeePass plugin Readable Passphrase Generator[1] is great for generating Diceware[2] passwords/usernames/security question & answers Source: Found on KeePass plugins page[3] [1] https://bitbucket.org/ligos/readablepassphrasegenerator/wiki/Home https://bitbucket.org/ligos/readablepassphrasegenerator/wiki... [2] https://en.wikipedia.org/wiki/Diceware https://en.wikipedia.org/wiki/Diceware [3] https://keepass.info/plugins.html#ppgen https://keepass.info/plugins.html#ppgen
- manfredo 7y agoI use a somewhat different system. Each common interview question is mapped to what is effectively an inside joke about my life. Usually something related to the interview question, but the actual keyword is tangentially related in a manner that would be incredibly difficult for an attacker to guess. This effectively allows using the security question as something that can be more reliably recalled by the user, but largely avoids the security issues of an easy to guess secret.
- altmind 7y agoI did exact same thing for my Apple account. Later I found that even if I have access to my email and to my password, they still keep asking for these secret questions I dont remember the answers.
- tunap 7y agoI have been living in the park & taking calls at the lottery hotline for 25+ years, according to all but my guv, insurance provider & LEOs. Some others may get a PO Box, but if X doesn't fall under the umbrella of the former mentioned, they get all the mis-info I can feed them. Sadly, today the institutions I must rely on sell all that info to the highest bidders, anyway. In the list of info gleaned from your phone # the writer forgot your online purchase history, vehicle VIN & plate number and pretty much EVERY MOVE YOU MAKE day-to-day thanks to O/L retailers, your cell provider, your TV/provider, your DMV, your insurance provider, your city/county/state/Fed & everyone else under the sun selling your info. Many ask for your phone # "for security reasons" and then immediately sell it. TFA states it is better than your "full name"... that's nothing, as I have >7 same-names in my metro alone. It is, indeed, better than your social security #(in the States, anyway).
- dopylitty 7y agoAll of the information the "hacker" found using the reporter's cell number could have been found using just the reporter's name and rough location. It seems strange to me that peoples names, addresses, and phone numbers used to be freely distributed in a large book to every house in town yet now any one of those details can be used to assume someone's "identity." It seems the only thing stopping this from happening en-masse is that nobody has tried.
- jhbadger 7y agoTimes change. When I was an undergrad in the 1980s (in the US) my professors would post the results of exams on their office doors labeled by social security number (for "privacy"). Nobody at the time saw a problem with it, although we would today.
- kobbe 7y agoAs a swede I don't really see a problem with this, SSN is publicly available in Swedden to anyone.
- hannasanarion 7y agoBecause you guys have more forms of ID aside from SSNs, many od them with security features. For Americans, it's the only number that everybody has, so it's become the password to your entire financial life. You can go to a bank, say "hi im John, my social is 123456789, I'd like to take a ten thousand dollar loan" and they'll give it to you if their records show that the name belongs to that number.
- Aardwolf 7y ago> You can go to a bank, say "hi im John, my social is 123456789, I'd like to take a ten thousand dollar loan" and they'll give it to you if their records show that the name belongs to that number. If that's so, why isn't this happening in massive numbers, given for example the 143 million SSNs that leaked through equifax?
- hnModsRDanger 7y agoI don't share what bank accounts I have, or how I keep things secure. I consider all of these potential attack vectors. Although, the older I get, the more I see how people can defeat me. It's a strange feeling.
- NoblePublius 7y agoI can’t read this article because the alleged bastion of journalistic integrity requires its readers to be tracked.
- unethical_ban 7y agoThen go get your news from thefreepatriotonline.com or some other completely legitimate, not-fake no-operating-cost international news organization.
- zajio1am 7y agoDoes not. You can just read it with disabled javascript.
- edm0nd 7y agoYou can use Tor Browser set to Safest mode and read it easily.
- tshtf 7y agoThis type of phone number intelligence is essentially free. In a few seconds, for just ten cents, one could use NextCaller (YC14) and get all of this: https://hackernoon.com/nextcaller-what-does-your-phone-number-say-about-you-1bc894d48c66 https://hackernoon.com/nextcaller-what-does-your-phone-numbe... Although I think NextCaller no longer has this Twilio integration, there are similar services that provide these details at this price point.
- rootusrootus 7y agoDoes anyone offer a monitoring service for consumers? I would pay a nominal fee to be able to dip in to the big databases like this to find out what they think they know about me. If it's so cheap on a per-lookup basis, maybe someone could offer a consolidated view. Pay us X dollars and we will go dip into the top 50 databases right now and see what they say. Of course, they probably contractually cannot do this and would get cut off immediately if they did. Edit: Didn't know, nextcaller is a YC company. LOL
- mxuribe 7y agoOn the surface, this sounds like a great idea (I certainly would pay for such a service)...But wouldn't that create an incentive for the data brokers to double-dip, and sell YOUR data to existing ad/marketing/scammer customers, PLUS sell YOU your OWN data? (I should caveat, I'm having a "pessimist day" today, so even sunshine and rainbows aren't as pretty today as they normally are.)
- rootusrootus 7y ago> PLUS sell YOU your OWN data Yeah, sounds like credit bureaus :). With the shear quantity of data analysis that goes on behind the scenes and affects citizens, I think we need a much better handle on transparency. We already have some level [inadequate IMO] of control over the established credit bureaus, I think that should be expanded to all data brokers that sell personal data like this. If I can't keep it from being sold, then I should at least be able to see what it is and make sure it's accurate. Maybe it's time to look into how to pollute the data set instead.
- razormouse 7y agoVery ironic article on a site that requires you to log in via social media just so you can read it.
- lota-putty 7y agoProblem is the 'public records' not 'sharing phone#'. Layers of security-levels to access records and appropriate log trails for audit shouldn't be that difficult to set up in this day & age. I suppose, it's hard to implement in pure capitalistic economy.
- DaniloDias 7y ago“Twilio, a communications company that works with phone carriers on combating robocalls.” - The New York Times
- lwansbrough 7y agoNo mention of the ability to obtain an exact real-time location, which is made possible by phone companies providing your real-time data to advertisers and other third parties.
- fromthestart 7y agoWhenever possible I use the burner app if I need to provide a number to sign up for a service that I'm not particularly worried about losing access to, that sends a confirmation code on login. Especially when its something I only need to use once, like anonymously downloading a file from a website that requires a Google or Facebook login, for example.
- ineedasername 7y agoThey make such a big deal of getting this from a cell number, but none of what they listed is very difficult from simply a name and general idea of who a person is. I recently found a lost wallet. The only things in it were cash and some credit cards (and a Kohl's loyalty card). The person had a semi unique name, only 4 in my state, and it was easy to find all of the data listed in this article about them. Whitepages-style sites usually have age, relatives, sometimes phone numbers and addresses, and you can put together the pieces from different sites: I found the wallet at a Dude Perfect Tour show with my kids, so out of the matches I found, I assumed it was less likely to be the 67 year old. Another came up repeatedly for crimes: Domestic Assault & Battery, and drug crimes. I doubted this was the owner, and wasn't sure I wanted contact with anyone like that. Anyway, that left two people. The first one I called had lost the wallet, and I mailed it to him. Again, all I needed was a name.
- LinuxBender 7y agoHow many here have set their LinkedIn profile to not be discovered if someone knows your number?