7 ms·

Psssst! Your date of birth can be a random number!

35 points by ColinWright 2y ago

bell-cot 2y ago
Um, yes. And similar for any other PII that YetAnotherCompany wants for such purposes. But First - look for the little gray "continue as Guest" alternative to creating an account. And if there isn't one, take a few seconds to think about good-enough alternatives. Your purpose in life is not to help boost online account count metrics.
deleted 2y ago
[deleted]
PreInternet01 2y ago
Oh, yeah, my password manager is full of answers to 'security questions' like 'place of birth', 'name of first pet' and 'high school name'. Just about the only time that gets awkward, is when the same answers turn out to be required during certain phone conversations. Yes, I do in fact, happen to be born in Qjhdfoudvprx -- quaint little, very traditional village...
- yohannparis 2y ago
  I do the same, but I have been using random words. So for my gas bill, my pet name is `chlorine wastrel percept`. Easier than pure randomness, and strong enough for the purpose.
  - mdiesel 2y ago
    I wonder how many people have pet names 'correct horse battery staple'
- pushcx 2y ago
  I used to give random strings like that. Next time you get asked one on a call, say "Oh I hate those intrusive questions so I just mashed the keyboard." Many support agents will accept that as a valid answer!
  - PreInternet01 2y ago
    Yes, well, unless the poor CSR cannot actually see your answer, but has to enter it for a 'yes/no' response. Had a fun time with Rackspace support around the turn of the millennium, where I had used the output of 'openssl rand -base64 16' or somesuch, and that had to be entered verbatim, with the person on the other side apparently not understanding what a 'forward slash' was, and, yes, it was urgent... Anyway, I don't find these questions intrusive as much as 'not fit for purpose', with a bit of (cultural) insensitivity mixed in. I once had to console a very-upset very-serious person from an African country with regards to the the 'name of pet' question they just had to answer as part of a mandatory signup for a US-based third-party service, and which they just couldn't find an answer to. And whenever I'm asked about "name of high school" or (even worse) "high school mascot", I'm tempted to flip out with something like "yeah, which of the seven-or-so I attended, for no-fun-at-all reasons, and most of which I don't even remember, but I can assure you none of them had a mascot", but then I just take a chill pill and mash my keyboard...
    - swiftcoder 2y ago
      Try being raised as a nomadic homeschooler. I didn't have an actual concrete street address until I went to university :) About half of those mandatory questions I legitimately don't have an answer to.
      - vaylian 2y ago
        Related: Falsehoods programmers believe about addresses: https://github.com/kdeldycke/awesome-falsehood?tab=readme-ov-file#postal-addresses https://github.com/kdeldycke/awesome-falsehood?tab=readme-ov...
  - hughesjj 2y ago
    Which... Is kind of a bug given Mallory can just say that if they know you do that
Hizonner 2y ago
One of the more underappreciated negative effects of COPPA has been normalizing sites' asking for birth dates they do not need and should not have.
- dredmorbius 2y ago
  Any DoB > 18 years should more than suffice. The practice suggested of offering a DoB at the earliest date accepted by the system (a practice I've long since adopted ... amongst other things, 100+ y.o. individuals tend to have weak appeal to advertisers) will also suffice. I've also felt that, as with several other online issues, the matter of age-gating is probably best handled at the ISP level. Most people have a fairly strong relationship with their ISP (whether willingly or happily is another matter), and a combination of site-specific self-ratings (which would also fall under consumer-protection/fraud regulation) and an ISP toggle to enable or disable +18 / NSFW / sexual content, or other categories on an account-wide basis would enable a household or business to set such filters with a minimum of hassle. For instances where multi-level tiers of access would be required, the ISP should be able to provide that through two or more virtual service addresses (effectively VPNs which various devices are configured through). And a household or business should be able to define specific exceptions to any filtering rules to avoid the overclassification problem and put ultimate control in the subscriber's hands rather than the ISP's.
  - deleted 2y ago
    [deleted]
  - amarant 2y ago
    In theory this is a good idea, but in practice I'm not sure I trust my ISP to manage that system. I'm not worried that they'll leak my data, they already do that, but I think they'd probably lock me out of content they shouldn't because of bugs and/or poorly designed system.
    - dredmorbius 2y ago
      In practice your ISP already has this information and more (all traffic you're currently transacting). The information is less distributed than it would be in the case of providing all and sundry online publishers with that same information, and would offer less effective privacy control over how that information is used. For those who'd bypass their ISP's access limitations/controls using a VPN ... you've now got additional complications and really no less effective control than voluntary age-disclosure rules. Another option would be imputed age classification, which again is something that major sites (e.g., Google, YouTube, FB, Instagram, TikTok) can already perform via algorithmic / AI assessments of marketing categories based off of on-site activities, consumption trends, etc.
jmclnx 2y ago
Plus when you are asked things like: Where where you born: make something up, I have used colors, planet names, star names... you get the idea :) You first pet name: Some nonsense string You get the point. Plus make different per WEB Site.
- leipert 2y ago
  Two things to keep in mind: I have had interactions with support in the past where “wait-a-second-it’s-a-long-nonsense-string” was good enough for them and they did NOT ask me to read it out. I also had the interaction with a bank that asked me to read it out, and I was glad that my nonsense string was a list of 8 hyphenated words rather than a barfed up random string. 8henna-Such-Brain-Civil0-Grown5-modified8 is better than gpqmxsc5utowduc8fhqvntsXsgvMDzs0rclsiwzt
  - 1659447091 2y ago
    I use something similar to the hyphenated words now, as well. I use to make up random things like "Error Invalid" answer or missing input until I had to get support on one and the guy started his "I just need to ask you a coup...wait a second....hold on sorry, I'm getting an error, I need to put you on hold" and put me on hold before I could say anything, I waited and jumped in the moment he came back because I felt bad (the support center didn't make the system). He found it funny at least.
  - kijin 2y ago
    If the support staff can compare what you said with what's on their screen, it's obviously stored in plaintext. And they probably won't even distinguish uppercase from lowercase letters, or 5 from S. So it's a waste of time to insist on a large amount of entropy for these things. Battery horse staple is where it's at. :)
  - meowster 2y ago
    Yes, always use a fake but plausible answer. Q) What was your first pet's name? A) Peachtree
deleted 2y ago
[deleted]
DavideNL 2y ago
I always use 01-01-1970 : https://en.wikipedia.org/wiki/Unix_time https://en.wikipedia.org/wiki/Unix_time
dvh 2y ago
Years ago I used some leaked database to find if birth dates correlate with moon phase and there was no obvious correlation.
- Someone 2y ago
  This myth has been researched to death, and AFAIK, nobody has found such a correlation. Examples: https://obgyn.onlinelibrary.wiley.com/doi/full/10.1080/00016340802233090 https://obgyn.onlinelibrary.wiley.com/doi/full/10.1080/00016...: “in this analysis no evidence was found to support the maintained popular belief that lunar cycle might affect birth” https://pubmed.ncbi.nlm.nih.gov/15970864/ https://pubmed.ncbi.nlm.nih.gov/15970864/: “Although there exists a popular belief that the phase of the lunar cycle and weather conditions affect birth rate, no such evidence was found in this study.” ⇒ If there is a correlation, it is a very, very, non-obvious one.
anArbitraryOne 2y ago
Using the earliest possible date isn't a great idea because it's very easy to guess if necessary for security purposes. Same for whatever the default date is, 01/01/1970, or any other date that follows a similar pattern
- kijin 2y ago
  Besides, lots of badly designed systems spit out the Unix epoch if they can't handle a date string for whatever reason. Then you can't tell whether you're looking at the date you actually selected or the default fallback date.
hislaziness 2y ago
I also use some email providers ability to have +xyz at the end of the username. So for a registration I would for user.name+sitea@domain.com. has helped me track spam and leaks in the past.
- setopt 2y ago
  Same here! Both GMail and iCloud Mail support this, among others. It works 95% of the time, but be aware that it sometimes doesn't: - Some webpages refuse addresses with a + in it. - I’ve had at least one instance where I lost an important email because I could register and receive emails from them, but one of their internal databases silently failed on my address. (I lost the proofs for a paper accepted in a journal, and it took some time to figure out what was going on…) - There was at least one web page that was smart enough to just remove the +… from my address after I registered. - Some webpages require you to be able to send emails to them from the exact address you sign up with (including the +…) Overall I’ve been happy with the feature since it makes e-mail sorting easier, and you can just redirect a given subaddress to spam if they leak it, and it’s less effort than creating a “real” email alias per page. Just keep in mind that there are many ways it can fail, so you might not want to use it for anything that is actually important.
  - Z7YCx5ieof4Std 2y ago
    When you can't use a + use a . Name@email.com is n.ame@email.com is n.a.me@email.com is n.am.e@email.com etc
    - alexriddle 2y ago
      This works for some providers (Google) but definitely isn't universal - MS/Outlook doesn't support it for example
      - andrewSC 2y ago
        I literally setup an alias last week in O365 Outlook using the pattern a.b@c.com? I’ve been able to receive and send using the alias as well. Maybe this is a new feature/behavior?
sph 2y ago
Wasn't there a cheeky post by Valve saying that most of its users claim to be born on the 1st of January?
- CUViper 2y ago
  Whenever I hit the age gate in the Steam store, I just bump the year to continue, so January 1st it is!

35 points by ColinWright 2y ago

Um, yes. And similar for any other PII that YetAnotherCompany wants for such purposes. But First - look for the little gray "continue as Guest" alternative to creating an account. And if there isn't one, take a few seconds to think about good-enough alternatives. Your purpose in life is not to help boost online account count metrics.

deleted 2y ago

[deleted]

PreInternet01 2y ago

Oh, yeah, my password manager is full of answers to 'security questions' like 'place of birth', 'name of first pet' and 'high school name'. Just about the only time that gets awkward, is when the same answers turn out to be required during certain phone conversations. Yes, I do in fact, happen to be born in Qjhdfoudvprx -- quaint little, very traditional village...

yohannparis 2y ago
I do the same, but I have been using random words. So for my gas bill, my pet name is `chlorine wastrel percept`. Easier than pure randomness, and strong enough for the purpose.
- mdiesel 2y ago
  I wonder how many people have pet names 'correct horse battery staple'
pushcx 2y ago
I used to give random strings like that. Next time you get asked one on a call, say "Oh I hate those intrusive questions so I just mashed the keyboard." Many support agents will accept that as a valid answer!
- PreInternet01 2y ago
  Yes, well, unless the poor CSR cannot actually see your answer, but has to enter it for a 'yes/no' response. Had a fun time with Rackspace support around the turn of the millennium, where I had used the output of 'openssl rand -base64 16' or somesuch, and that had to be entered verbatim, with the person on the other side apparently not understanding what a 'forward slash' was, and, yes, it was urgent... Anyway, I don't find these questions intrusive as much as 'not fit for purpose', with a bit of (cultural) insensitivity mixed in. I once had to console a very-upset very-serious person from an African country with regards to the the 'name of pet' question they just had to answer as part of a mandatory signup for a US-based third-party service, and which they just couldn't find an answer to. And whenever I'm asked about "name of high school" or (even worse) "high school mascot", I'm tempted to flip out with something like "yeah, which of the seven-or-so I attended, for no-fun-at-all reasons, and most of which I don't even remember, but I can assure you none of them had a mascot", but then I just take a chill pill and mash my keyboard...
  - swiftcoder 2y ago
    Try being raised as a nomadic homeschooler. I didn't have an actual concrete street address until I went to university :) About half of those mandatory questions I legitimately don't have an answer to.
    - vaylian 2y ago
      Related: Falsehoods programmers believe about addresses: https://github.com/kdeldycke/awesome-falsehood?tab=readme-ov-file#postal-addresses https://github.com/kdeldycke/awesome-falsehood?tab=readme-ov...
- hughesjj 2y ago
  Which... Is kind of a bug given Mallory can just say that if they know you do that

Hizonner 2y ago

One of the more underappreciated negative effects of COPPA has been normalizing sites' asking for birth dates they do not need and should not have.

dredmorbius 2y ago
Any DoB > 18 years should more than suffice. The practice suggested of offering a DoB at the earliest date accepted by the system (a practice I've long since adopted ... amongst other things, 100+ y.o. individuals tend to have weak appeal to advertisers) will also suffice. I've also felt that, as with several other online issues, the matter of age-gating is probably best handled at the ISP level. Most people have a fairly strong relationship with their ISP (whether willingly or happily is another matter), and a combination of site-specific self-ratings (which would also fall under consumer-protection/fraud regulation) and an ISP toggle to enable or disable +18 / NSFW / sexual content, or other categories on an account-wide basis would enable a household or business to set such filters with a minimum of hassle. For instances where multi-level tiers of access would be required, the ISP should be able to provide that through two or more virtual service addresses (effectively VPNs which various devices are configured through). And a household or business should be able to define specific exceptions to any filtering rules to avoid the overclassification problem and put ultimate control in the subscriber's hands rather than the ISP's.
- deleted 2y ago
  [deleted]
- amarant 2y ago
  In theory this is a good idea, but in practice I'm not sure I trust my ISP to manage that system. I'm not worried that they'll leak my data, they already do that, but I think they'd probably lock me out of content they shouldn't because of bugs and/or poorly designed system.
  - dredmorbius 2y ago
    In practice your ISP already has this information and more (all traffic you're currently transacting). The information is less distributed than it would be in the case of providing all and sundry online publishers with that same information, and would offer less effective privacy control over how that information is used. For those who'd bypass their ISP's access limitations/controls using a VPN ... you've now got additional complications and really no less effective control than voluntary age-disclosure rules. Another option would be imputed age classification, which again is something that major sites (e.g., Google, YouTube, FB, Instagram, TikTok) can already perform via algorithmic / AI assessments of marketing categories based off of on-site activities, consumption trends, etc.

jmclnx 2y ago

Plus when you are asked things like: Where where you born: make something up, I have used colors, planet names, star names... you get the idea :) You first pet name: Some nonsense string You get the point. Plus make different per WEB Site.

leipert 2y ago
Two things to keep in mind: I have had interactions with support in the past where “wait-a-second-it’s-a-long-nonsense-string” was good enough for them and they did NOT ask me to read it out. I also had the interaction with a bank that asked me to read it out, and I was glad that my nonsense string was a list of 8 hyphenated words rather than a barfed up random string. 8henna-Such-Brain-Civil0-Grown5-modified8 is better than gpqmxsc5utowduc8fhqvntsXsgvMDzs0rclsiwzt
- 1659447091 2y ago
  I use something similar to the hyphenated words now, as well. I use to make up random things like "Error Invalid" answer or missing input until I had to get support on one and the guy started his "I just need to ask you a coup...wait a second....hold on sorry, I'm getting an error, I need to put you on hold" and put me on hold before I could say anything, I waited and jumped in the moment he came back because I felt bad (the support center didn't make the system). He found it funny at least.
- kijin 2y ago
  If the support staff can compare what you said with what's on their screen, it's obviously stored in plaintext. And they probably won't even distinguish uppercase from lowercase letters, or 5 from S. So it's a waste of time to insist on a large amount of entropy for these things. Battery horse staple is where it's at. :)
- meowster 2y ago
  Yes, always use a fake but plausible answer. Q) What was your first pet's name? A) Peachtree

deleted 2y ago

[deleted]

DavideNL 2y ago

I always use 01-01-1970 : https://en.wikipedia.org/wiki/Unix_time https://en.wikipedia.org/wiki/Unix_time

dvh 2y ago

Years ago I used some leaked database to find if birth dates correlate with moon phase and there was no obvious correlation.

Someone 2y ago
This myth has been researched to death, and AFAIK, nobody has found such a correlation. Examples: https://obgyn.onlinelibrary.wiley.com/doi/full/10.1080/00016340802233090 https://obgyn.onlinelibrary.wiley.com/doi/full/10.1080/00016...: “in this analysis no evidence was found to support the maintained popular belief that lunar cycle might affect birth” https://pubmed.ncbi.nlm.nih.gov/15970864/ https://pubmed.ncbi.nlm.nih.gov/15970864/: “Although there exists a popular belief that the phase of the lunar cycle and weather conditions affect birth rate, no such evidence was found in this study.” ⇒ If there is a correlation, it is a very, very, non-obvious one.

anArbitraryOne 2y ago

Using the earliest possible date isn't a great idea because it's very easy to guess if necessary for security purposes. Same for whatever the default date is, 01/01/1970, or any other date that follows a similar pattern

kijin 2y ago
Besides, lots of badly designed systems spit out the Unix epoch if they can't handle a date string for whatever reason. Then you can't tell whether you're looking at the date you actually selected or the default fallback date.

hislaziness 2y ago

I also use some email providers ability to have +xyz at the end of the username. So for a registration I would for user.name+sitea@domain.com. has helped me track spam and leaks in the past.

setopt 2y ago
Same here! Both GMail and iCloud Mail support this, among others. It works 95% of the time, but be aware that it sometimes doesn't: - Some webpages refuse addresses with a + in it. - I’ve had at least one instance where I lost an important email because I could register and receive emails from them, but one of their internal databases silently failed on my address. (I lost the proofs for a paper accepted in a journal, and it took some time to figure out what was going on…) - There was at least one web page that was smart enough to just remove the +… from my address after I registered. - Some webpages require you to be able to send emails to them from the exact address you sign up with (including the +…) Overall I’ve been happy with the feature since it makes e-mail sorting easier, and you can just redirect a given subaddress to spam if they leak it, and it’s less effort than creating a “real” email alias per page. Just keep in mind that there are many ways it can fail, so you might not want to use it for anything that is actually important.
- Z7YCx5ieof4Std 2y ago
  When you can't use a + use a . Name@email.com is n.ame@email.com is n.a.me@email.com is n.am.e@email.com etc
  - alexriddle 2y ago
    This works for some providers (Google) but definitely isn't universal - MS/Outlook doesn't support it for example
    - andrewSC 2y ago
      I literally setup an alias last week in O365 Outlook using the pattern a.b@c.com? I’ve been able to receive and send using the alias as well. Maybe this is a new feature/behavior?

sph 2y ago

Wasn't there a cheeky post by Valve saying that most of its users claim to be born on the 1st of January?

CUViper 2y ago
Whenever I hit the age gate in the Steam store, I just bump the year to continue, so January 1st it is!