3 ms·

It's kind of bizarre to me that people now days don't think of their address as public information. In the US at least, until about a decade ago, we would get a

by donatj 2y ago

It's kind of bizarre to me that people now days don't think of their address as public information. In the US at least, until about a decade ago, we would get a physical book in the mail every year of everyone in our metro areas address and phone number, for free, whether we wanted it or not. You enter your abode via the public. It's really not hard for someone like a stalker or private investigator or paparazzi to figure out if they can find... you. That is to say if you go in public. It's readily available to anyone who actually wants to seek it out, and it's something you do in public. It's not particularly private information in the practical sense. Every time my address is leaked online, I am not worried in the least. I don't really need to do anything. It's readily available on any number of information sites online anyway. When my credit card gets leaked, it's a major headache regardless of if I am liable for charges. Now I have to cancel my card, change all my automatic subscriptions, reenter it on every single shopping site. It will take literally months for all that to resolve.

IshKebab 2y ago
That's the naive black and white way to think about security. If it's possible to learn something with a bit of work then why bother keeping it secret? The answer is that the bit of work - "really not hard" as you put it - actually can be quite hard, and it is a real deterrent. You don't really care about whether something bad can happen... you can about whether it is likely to happen. It's a probability. And making it hard to find your address reduces that probability. Also I would suggest that HN members are unlikely to be stalked. You might feel differently if you were a Twitch girl or whatever.
- donatj 2y ago
  I mean isn't security by obscurity generally accepted as bad practice? If everyone treated it as easily available data, and stopped using the act of having it alone as "proof" of anything we could be much more secure. E.g. merely having someones address should not be enough to get their house swatted.
  - skybrian 2y ago
    This catch phrase can be used to prove too much. All camouflage is bad? Hiding is useless? No, of course not. These things have deep, evolutionary roots, as a way of getting an edge in nature and in war. In its original context, relying on obscurity alone as your only defense isn't recommended when there are better alternatives like real authentication and encryption. Also, hiding isn't an option for things necessarily done in public. But it's still defense in depth when you can do it. People can just show up at your doorstep and that's a hassle or worse. There is also the crazy ex scenario. We should probably avoid assuming everyone has the same security needs.
  - IshKebab 2y ago
    It is considered bad practice when used instead of an obviously better alternative. E.g. running a service on an obscure port instead of using a password. Or having a hard-coded admin password instead of forcing the user to pick one. But when it's in addition to good measures, then it generally improves security.
    - lelanthran 2y ago
      It's defense is n depth. I used both obscure ports AND strong passwords or keys. Whether we like it or not, in practice the obscure ports stop a ton of drive by bots. Even if you are using a keys, the obscure ports stops the bot with a 0day exploit from getting in.
  - yjftsjthsd-h 2y ago
    > I mean isn't security by obscurity generally accepted as bad practice? That's an oversimplification. Obscurity is generally a really thin layer of security - not nothing, but if people think of it as "real" security then they neglect other things and just have the inadequate layer that is obscurity. By way of analogy - if you add a 3-character password to a system, it is strictly more secure than without that password. But if you think "oh, I have a password, so I'm safe and don't need anything else" then you will get owned the first time someone takes an actual run at your security. A system that depends on obscurity is probably doomed to failure, but that doesn't make its value zero, just low.
acdha 2y ago
Think around the edges: you could opt out of phone books because some people really needed the ability to do that, and that was in the era before bulk operations were easy. Someone targeted, yes, you could look them up and even get phone books from other areas, but the kind of data-mining and cross referencing which are now trivial were cost-prohibitive.
- bastawhiz 2y ago
  At least in the US, property ownership has been public record. You can look up who owns any parcel of land. You can't opt out of your address being public. It's just somewhat easier to search this data in today's era.
  - skybrian 2y ago
    There are apparently ways to opt out of that too, with a land trust or shell corporation.
  - acdha 2y ago
    Not everyone owns a house, and people with privacy concerns have for a long time used companies or trusts to hold property or to simplify family ownership (my next-door neighbors are nowhere near rich but used a family trust to simplify inheritance when the owner started getting old).

by donatj 2y ago

IshKebab 2y ago

That's the naive black and white way to think about security. If it's possible to learn something with a bit of work then why bother keeping it secret? The answer is that the bit of work - "really not hard" as you put it - actually can be quite hard, and it is a real deterrent. You don't really care about whether something bad can happen... you can about whether it is likely to happen. It's a probability. And making it hard to find your address reduces that probability. Also I would suggest that HN members are unlikely to be stalked. You might feel differently if you were a Twitch girl or whatever.

donatj 2y ago
I mean isn't security by obscurity generally accepted as bad practice? If everyone treated it as easily available data, and stopped using the act of having it alone as "proof" of anything we could be much more secure. E.g. merely having someones address should not be enough to get their house swatted.
- skybrian 2y ago
  This catch phrase can be used to prove too much. All camouflage is bad? Hiding is useless? No, of course not. These things have deep, evolutionary roots, as a way of getting an edge in nature and in war. In its original context, relying on obscurity alone as your only defense isn't recommended when there are better alternatives like real authentication and encryption. Also, hiding isn't an option for things necessarily done in public. But it's still defense in depth when you can do it. People can just show up at your doorstep and that's a hassle or worse. There is also the crazy ex scenario. We should probably avoid assuming everyone has the same security needs.
- IshKebab 2y ago
  It is considered bad practice when used instead of an obviously better alternative. E.g. running a service on an obscure port instead of using a password. Or having a hard-coded admin password instead of forcing the user to pick one. But when it's in addition to good measures, then it generally improves security.
  - lelanthran 2y ago
    It's defense is n depth. I used both obscure ports AND strong passwords or keys. Whether we like it or not, in practice the obscure ports stop a ton of drive by bots. Even if you are using a keys, the obscure ports stops the bot with a 0day exploit from getting in.
- yjftsjthsd-h 2y ago
  > I mean isn't security by obscurity generally accepted as bad practice? That's an oversimplification. Obscurity is generally a really thin layer of security - not nothing, but if people think of it as "real" security then they neglect other things and just have the inadequate layer that is obscurity. By way of analogy - if you add a 3-character password to a system, it is strictly more secure than without that password. But if you think "oh, I have a password, so I'm safe and don't need anything else" then you will get owned the first time someone takes an actual run at your security. A system that depends on obscurity is probably doomed to failure, but that doesn't make its value zero, just low.

acdha 2y ago

Think around the edges: you could opt out of phone books because some people really needed the ability to do that, and that was in the era before bulk operations were easy. Someone targeted, yes, you could look them up and even get phone books from other areas, but the kind of data-mining and cross referencing which are now trivial were cost-prohibitive.

bastawhiz 2y ago
At least in the US, property ownership has been public record. You can look up who owns any parcel of land. You can't opt out of your address being public. It's just somewhat easier to search this data in today's era.
- skybrian 2y ago
  There are apparently ways to opt out of that too, with a land trust or shell corporation.
- acdha 2y ago
  Not everyone owns a house, and people with privacy concerns have for a long time used companies or trusts to hold property or to simplify family ownership (my next-door neighbors are nowhere near rich but used a family trust to simplify inheritance when the owner started getting old).