6 ms·
I assume all of my information is public, from my SSN, email, name, DOB, to all my possible security questions. This is why I have my credit frozen with every
by 2024throwaway 3y ago
I assume all of my information is public, from my SSN, email, name, DOB, to all my possible security questions.
This is why I have my credit frozen with every agency, and all of my security question answers are plausible sounding, but entirely fake, answers stored in my password manager.
I'm not sure there is anything else we can do as consumers.
- TedDoesntTalk 3y agoMy mother has at least 20 maiden names.
- orblivion 3y agohtiusdhtehdhstansuhetauhtaneouh? Is that Finnish?
- 2024throwaway 3y agoThese answers suffer from a company support representative accepting "a long string of letters" as an answer, which they often do. Much better to use a 'plausible' answer like "Fielder" or "Pitt" or any random real last name.
- Sanzig 3y agoHyphenate it for more entropy - eg: Fielder-Pitt.
- numbsafari 3y agoYou can make it mildly more complex by hyphenating. For example “Moss Coane”. Sounds plausible enough, but clearly a fake.
- deleted 3y ago[deleted]
- nerdponx 3y agoMy first car was a FlipperMaster 367i and I grew up on Poopoopeepee Avenue with my favorite pet The Melting Clock In Dali Paintings.
- anotherhue 3y agoI don't know how you can persist that to your memory.
- equinoxnemesis 3y agoPut it in your password manager! In the additional fields/notes section.
- anotherhue 3y agoToo clever by half https://en.wikipedia.org/wiki/The_Persistence_of_Memory https://en.wikipedia.org/wiki/The_Persistence_of_Memory
- smeej 3y agoI feel so bad for all the people who have the same surnames as their unmarried mothers and don't think this through. I don't know how big that chunk of humanity is, but I feel for them.
- MOARDONGZPLZ 3y agoMy security question answers are also stored in my 1Pass but are not plausible or even reasonable. They’re memorable passwords. People asking them do need an explanation though, but no chance someone could guess one because it was plausible but wrong.
- asdjasflkj 3y agoA lot of times those are read by customer service reps. You'd hope if someone called up as MOARDONGZPLZ and said wazzup I'm MOARDONGZPLZ, my security questions are all gibberish, the CSR would be all "nope, need the exact answers." But instead they could be all "yeah kewl man, they are gibberish. How much $ would you like me to transfer again?
- soraminazuki 3y agoMaybe prefix the answer with "precise match only," in all caps?
- DANmode 3y agoYou can't "outsmart" someone whose salary is predicated on doing the most frictionless version of the work possible and still get paid.
- arsome 3y agoDoubt it'd actually work - remember, humans. I think the "random but actually meaningful" route is better. If you want it to get checked, grandma's name comes off fake name generator, not line noise from a CSPRNG.
- ncallaway 3y agoI just generate a short set of random words. A CSR is much more likely to expect correct or similar words than a correct or similar string of gibberish.
- bigiain 3y ago
- qwertox 3y agoMy security questions are random-character passwords.
- dheera 3y agoAlso, never give out your residential address to anyone except the government, and your employer. Use a virtual mailbox for all private companies because they leak info, just like this. Private companies are not the government and have no right to know where you sleep. Don't register to vote. It doesn't matter anyway unless you're in a swing state, and the idiots at the voting registration offices leak residential addresses.
- 2024throwaway 3y agoWhen I said "I assume all my information is public", that included my address.
- sneak 3y agoI’d go one step further and say that the government also has no right to know where you sleep. This isn’t a prison, my location isn’t anyone’s business but my own.
- dheera 3y agoYeah I agree with you in principle, though I don't want to get in trouble with the people who have guns and handcuffs. Private businesses on the other hand can f off. My credit card co can't come and handcuff me for not giving them an address to leak to 3rd party auto ads.
- xwolfi 3y agoWell it's not a prison but it's a big group of people reaching compromises to make it safer for everyone else. Look at it this way: if nobody knows your address, not even the people guaranteeing property law, someone could enter your house, get you to fuck right off, and you'd end up naked in the street with everyone asking where's your proof you live there. Simplification sure, but you started.
- sneak 3y agoMy landlord and I have a signed lease which can be produced on demand. No other party need have the information in advance, especially not those who claim the authority to enforce property rights. Courts enforcing notional rights weeks or months later can’t get you un-murdered in your sleep by home invaders. Did we all forget that swatting is a thing? The place that you sleep is secret, and you should never tell it to anyone that isn’t an invited guest, especially not apps or the DMV. Every other data leak can nominally be mitigated with time, inconvenience, or expense, but violence to your person or your children cannot be un-done after the fact. https://www.nbcnews.com/news/amp/ncna1274747 https://www.nbcnews.com/news/amp/ncna1274747
- swalsh 3y agoGoing to make a service for quick filling forms that takes advantage of this :)
- yieldcrv 3y agoWhats more amusing is that the DOJ and FinCEN think their KYC and anti money laundering regime works simply because people with sanctioned names don't have bank accounts here…. in their name They seem to completely not notice that every individual and business would never know if another bank account existed in their name if it wasnt used in a different kind of crime or overdrawn forever. there are plenty of people that just want access and dont do anything bad with it, aside frok the paradoxical standard of having access or impersonation to be bad same is true of credit, although the original identity can see the extra credit line added, sometimes the phantom is a better steward of your credit than you are. Like “wow mixed lines of credit, paid on time! thanks undocumented person!”
- xwolfi 3y agoYou mis-construct law enforcement / crime prevention. First, it's never about solving all crimes committed by "bad people", the first priority is to show a big red lock everywhere sensitive so that your nice grandma doesn't go "oh well, the door is open and nobody's looking, might as well go see what's in there". Opportunity is the biggest driver of crime in humans, and it would be unmanageable not to have those sanction regimes in place, just as if nobody had door locks. Second, they need to make it illegal FIRST, or there would be no sanction evasion crime: if they don't act all naive and say "you cannot have an account here at all", then having an account would be fine... now the criminals need to cheat and lie, which they can be charged for. Finally: not all crime will ever be punished and there's definitely a cost calculation: do we want to take fingerprints of all clients in banks to match them to a central id card database, to end up with criminals infiltrating the fingerprinting system anyway and everyone else having to do those dumb fingerprint checks for nothing ? Better keep it simple while the criming stays manageable.
- sneak 3y agoYou can give unique emails to every service, not provide your real DOB, use randomized security questions, and a per-service alias name. The only cases where this doesn’t work are banking and airlines, which are required to check your government ID. Trello isn’t, and you can give them a burner forwarding email and fake name so this kind of thing doesn’t affect you. You’d be surprised how much business you can conduct without providing your name. (pro tip: the “name” field in the credit card form is not matched against the cardholder.) Also, make sure your CC billing address is a post box, so you’re not giving your residential address to everyone you transact with (the address/zip is matched).
- xwolfi 3y agoNot only the name is matched here in Hong Kong, but the address as well: so many people don't believe it, and I have to strongly insist they just write it better and poof, payment works ! I think it's a sort of option / depends on amount: some sites don't ask more than your card number and it works, some other you need to redo 5 times before they match properly. And anyway here you need to approve in the app like for a Google 2FA in Android.
- 2024throwaway 3y agoTry getting the CC you left at a restaurant back from then with an ID that doesn’t match the name.
- sneak 3y agoNo restaurant has ever asked me for an ID when making payment. Also, I think perhaps you misunderstood me: I am talking about forms on the web, as this thread is about Trello’s leak. My ID and all of my payment cards match (as I used the same ID to obtain them).
- 2024throwaway 3y agoI didn't say when making a payment, I said if you forgot your card there. Also, I have been asked to show ID with a card when making payment at plenty of retail establishments, just not necessarily restaurants.
- ljm 3y agoSecurity questions often require you to share other bits of PII and they aren’t hashed or encrypted either. Why do I have to tell a stranger over the phone my mother’s maiden name to confirm I own the account? That’s not my info to share, it’s my mother’s.
- lolinder 3y ago> That’s not my info to share, it’s my mother’s. It's also, for many people, incredibly easy to find. People often keep their maiden names as a middle name, so if you can find someone's mother (relatively easy in the age of Facebook) it's not a far leap to figure it out from there. Even if they didn't keep their maiden name, finding it out is pretty simple by connecting the dots. It made a bit more sense in the era before a majority of people started posting their private lives on the internet. These days it's a security disaster. Thankfully, the increasing popularity of non-traditional naming arrangements will probably do away with it soon.
- deleted 3y ago[deleted]
- lmm 3y agoAs consumers, we're powerless. As citizens, we should be demanding our governments apply meaningful penalties when companies leak our data.