They were. It was the _VIEWSTATE thing that ASP.NET sticks into pages. The developers put the full SSN into the _VIEWSTATE object, which is base64 encoded int

They were. It was the _VIEWSTATE thing that ASP.NET sticks into pages. The developers put the full SSN into the _VIEWSTATE object, which is base64 encoded into the pages. See https://news.ycombinator.com/item?id=28992667 https://news.ycombinator.com/item?id=28992667 There's a good comment there that the Microsoft ASP.NET help pages specifically call out an SSN as a terrible thing to put into _VIEWSTATE :)