8 ms·
> What was the subdomain I X’d out of his message? Just my Social Security number. I’d been doxed via DNS. That would freak me the fuck out wow.
by fotta 6y ago
> What was the subdomain I X’d out of his message? Just my Social Security number. I’d been doxed via DNS.
That would freak me the fuck out wow.
- paranorman 6y agoYeah that’s pretty brutal.
- wyxuan 6y agoIirc some ppl used it to extract his credit report from experian - we need better govt identification than just a few numbers
- Natsu 6y agoI'm surprised that governments aren't using some kind of 2FA tokens for peoples' identities, while credit cards are.
- djxfade 6y agoI don't know about most of Europe, but in Norway, we use a 2FA system called BankID. You authenticate with either with your phone using a custom SIM app, or an app, or a OTP device. This system is used for everything from banking, to checking taxes, medical records, or signing documents.
- BrandoElFollito 6y agoIt always amazes me that in the US there is such a weak identification system, relying on a single number. Then it is apparently to the owner of said number to worry if it leaked.
- WarOnPrivacy 6y ago> It always amazes me that in the US there is such a weak identification system, relying on a single number. Offer Govs/LEO/Biz an alternative that will allow them stronger & less visible influence over the public and it will be adopted yesterday.
- quercusa 6y agoUS Social Security cards used to say "NOT FOR IDENTIFICATION" but I guess it's just too hard to pass up a good primary key.
- dhosek 6y agoWhen I was first enrolled at University of Illinois of Chicago in 1985, your SSN was your student ID. You could log in to the mainframe using your SSN in the username field (although thankfully, the actual user ID was a sequentially assigned five-digit number and not the SSN. I was U10754). I think around 1986 or 1987, universities were instructed to stop using SSNs as student ID numbers.
- toast0 6y ago> I think around 1986 or 1987, universities were instructed to stop using SSNs as student ID numbers. And around 2005 they actually mostly stopped.
- macintux 6y agoIn the early 90s I had a professor who passed around a sheet of paper for us the first day of class to write down our names and our SSN. I had to point out to him after class that was a rather boneheaded idea (I'm sure I was a bit more polite than that).
- uniqueid 6y agoPretty sure every American's SSN has been public since 2017 anyways. Thanks Equifax!
- EvanAnderson 6y agoI thought for quite awhile that the whole list should be made public on a pre-announced date to "scorch the earth". On that date, liability for any fraud committed using the data would be placed on the party improperly using SSNs for authentication tokens. The Equifax breach did the publishing part, but nothing changed with liability. A golden opportunity missed to fix this particular bullshit.
- function_seven 6y ago100% agree with this. Our SSNs are fully “compromised” many times over at this point. Scare quotes because—as far as I know—they weren’t originally regarded as a secret to begin with. But the fiction of a secret SSN still persists. You're told to protect it; sensitive financial documents ask for it as part of proving you’re you; forgotten password pages use the last 4 digits as some sort of 2nd factor. The best thing that could happen is if the names and corresponding numbers were published far and wide. So obviously public that nobody could keep this fiction up. Banks and other high-stakes firms need to figure out how they want to identify their clients. It’s not an easy problem to solve, I get that. But that doesn’t mean we should be happy with them taking the easy way out.
- LinuxBender 6y agoI was required to write my SSN on all my checks and had to use it to get food in the chow hall whilst in the military. It was a very public number.
- function_seven 6y agoHa, you just reminded me of my student ID number in college. Also used to purchase snacks and meals at the commons. In the strangest of coincidences, it was my SSN.
- gsich 6y agoSeeing that Krebs doxed other people too, now he knows how that feels.