5 ms·
Releasing everyone's SSN and the hacks used to acquire them
- paultopia 2y agoWTF
- pellmellism 2y ago-.-
- mrcode007 2y agotl;dr The most obvious way to generate all SSNs you can think of: brute force enumeration the numbers alone are useless.
- SoftTalker 2y agoThere are only a billion numbers. Counting everyone who has already died since they were introduced, and all the "taxpayer id" numbers that are issued for people who don't have real SSNs, how long until we run out? Or are they already being re-used?
- pjot 2y agoThere’s less actually. Each state has its own unique 3 digit prefix.
- SoftTalker 2y agoI don't think that's true anymore. I was born in the same state as my wife and we have different 3-digit prefixes. But I agree that there are some rules about the different parts of the number that further constrain the theoretical one billion limit.
- firesteelrain 2y agoSSA implemented randomization in 2011 to remove that artificial constraint. https://www.ssa.gov/employer/randomizationfaqs.html https://www.ssa.gov/employer/randomizationfaqs.html
- 13of40 2y agoI googled that recently, and it sounds like: They don't get reused. There are about 70 years left. The government is punting the problem to future people and there's no solution yet.
- kolanos 2y agoThey are absolutely reused. I know this because mine was previously issued to a man who died in the late 50's.
- 13of40 2y agoI've heard people say that, but the SSA's FAQ says otherwise: "Q20: Are Social Security numbers reused after a person dies? A: No. We do not reassign a Social Security number (SSN) after the number holder's death." https://www.ssa.gov/history/hfaq.html https://www.ssa.gov/history/hfaq.html
- fuzzythinker 2y agoIt should be an error then, it isn't reused according to https://en.wikipedia.org/wiki/Social_Security_number#Exhaustion_and_re-use https://en.wikipedia.org/wiki/Social_Security_number#Exhaust...
- toomuchtodo 2y agoYou can compare against the Social Security Death Master File of SSNs for those who are already dead. https://www.ssa.gov/dataexchange/request_dmf.html https://www.ssa.gov/dataexchange/request_dmf.html
- JonChesterfield 2y agoThis is a joke, though it might be indicative of the state of software that I totally believed a JavaScript file could exfiltrate the names and security numbers of everyone in the US from some central system.
- atrettel 2y agoYes, this is obviously a joke given that the first file starts with SSNs with prefix 000. That prefix is not used [1]. The only information listed here is what appears to be an enumeration of every possible SSN, without any other related fields. [1] https://en.wikipedia.org/wiki/Social_Security_number#Structure https://en.wikipedia.org/wiki/Social_Security_number#Structu...
- IshKebab 2y agoOnly on HN would someone figure out that this was a joke because of the implementation details of SSNs... lol
- jesprenj 2y agoALL CREDIT CARD PIN CODES IN THE WORLD LEAKED: https://pastebin.com/Nn2ZcdfC https://pastebin.com/Nn2ZcdfC
- Ekaros 2y agoWhat next, all the CVV/CVC numbers, validity dates? Maybe someone should list all the credit card numbers too...
- jesprenj 2y agoWhat's next? A list of all bitcoin private keys: https://privatekeys.directory/keypage/1?coin=btc https://privatekeys.directory/keypage/1?coin=btc
- zinekeller 2y agoI can't find my PIN in that list! (some countries use five- or six-digit PIN as the default length, and you could set it up to 12 digits if your bank allows it)
- fragmede 2y agoare your sure? type it out here and I'll double check for you
- jcims 2y ago******
- woleium 2y agohunter2
- Teknomancer 2y agoBosco
- TZubiri 2y agoThere is an attempt to satirize, to position oneself on a level of higher understanding than those who are concerned by one of the biggest leaks in history. It reminds me of when people used to make fun of covid and cough in each others faces before they knew shit was real. Of course it isn't a list of ssns, it's a list of ssns attached with names and addresses...
- Spivak 2y agoI guess but there's literally nothing I can do, the data wanted to be free and escaped. Oh well, I'll deal with any fallout as it happens. No sense worrying until the actual bad thing happens, because if it doesn't you worried for nothing. If anything I'm happy SSN databases keep getting leaked. It furthers the case that identity fraud is the bank's problem and verifying identity by SSN is negligent.
- thatguy0900 2y agoI can't see the gov actually ever making identity fraud the banks problem. The best we can hope for is gov identity that's not ssn and we just move on
- sharperguy 2y agomaybe we will finally switch to asymetric key auth
- fuzzer371 2y agoSo what are we supposed to do about it? Everyone has known for years that SSN's aren't secure or supposed to be used in the manner that they are. Many have been screaming from the rooftops about it. I can't do anything about it, you can't do anything about it. So may as well laugh about it.
- fragmede 2y agonot give out your SSN unecessarily. freeze your credit. pay for monitoring service. pay for a service to delete you from other public data sets eg fastpeoplesearch.com. there's not nothing you can do.
- ein0p 2y agoThey got me. I first checked my own and my wife's SSN - neither was there. And then I checked the script.
- colesantiago 2y agoI wish this wasn't a joke, we need more things to be open source so everyone can share things for full transparency.
- roywiggins 2y agolol https://github.com/PatrickJS/everyone-ssn-usa/commit/25f60dd3f70b167b788233658180fce5175644d2 https://github.com/PatrickJS/everyone-ssn-usa/commit/25f60dd...
- thewisenerd 2y agothis was a joke. referenced in the PR for this commit is tfa https://www.govtech.com/question-of-the-day/question-of-the-day-for-073014.html https://www.govtech.com/question-of-the-day/question-of-the-...
- roywiggins 2y agohence the "lol"!
- rdtsc 2y agoGoing with the satire idea there is of course a PR to "rewrite it with Rust" https://github.com/PatrickJS/everyone-ssn-usa/pull/16 https://github.com/PatrickJS/everyone-ssn-usa/pull/16
- pjot 2y agoBe sure to create a pr to remove your ssn from this list. Also your passwords: https://github.com/danielmiessler/SecLists/pull/155 https://github.com/danielmiessler/SecLists/pull/155
- cbarrick 2y agoThe code formatting on lines 14-20 is a great example of how autoformatters can get it very wrong. That has to be the least readable way to write that code. https://github.com/PatrickJS/everyone-ssn-usa/blob/main/script.mjs#L14-L20 https://github.com/PatrickJS/everyone-ssn-usa/blob/main/scri...
- shepherdjerred 2y agoI'd be more concerned about the 7-level for loop than indentation
- jWhick 2y agoI am not American, so I don't know the rules of ssn. However, can someone calculate what are the chances I guess a valid ssn, if I know all the ssn rules?
- atomicnumber3 2y agoVery good. I don't know all the details but part of the SSN is the hospital ID where you were born, and part of it is time-based. It's just enough that someone trying to drink coffee while perusing the rules won't instantly know everyone's SSN, but a sophisticated actor could probably get someone's SSN down to 100ish guesses.
- api 2y agoMaybe this will get people to stop using a 9 digit predictable and easy to obtain number as a secure identifier.
- sgammon 2y agoThis should not be flagged. The author's repo makes a valid point about how we should think about security; satire cannot be labeled and still retain its rhetorical and educative value. I am disappointed that Hckrnews is missing this man's consistent security work and instead downvoting or flagging, presumably because the headline -- merely the title of the repo -- caused a heart or two to skip a beat. But isn't that the point? Isn't that something we should think about?
- sebazzz 2y agoUntil a year or so ago, the Dutch equivalent of the SSN (BSN = Burgerservicenummer = Civilian Service Number), was embedded in the VAT number of freelancers. After much protest it finally got fixed by the Dutch IRS that this sensitive number is no longer embedded in a number that you’re supposed to display on your website and invoices.