2 ms·

I heard about that, but when you publicly tell a bunch of hackers "come at me bro", you have to expect that kind of reaction. But realistically, the cat is out

by exelius 12y ago

I heard about that, but when you publicly tell a bunch of hackers "come at me bro", you have to expect that kind of reaction. But realistically, the cat is out of the bag with regards to SSNs. Legally you can obtain someone's SSN for very little money. If you go the illegal route, I'd be willing to bet that there is black-market identity data on over half of Americans. We really need to treat SSNs as about as secret as your e-mail address, because for all intents and purposes they are already. I wouldn't be surprised if online ad networks were using your SSN as a primary key in the background - the information is so easy to get and it would solve a lot of problems. I guess I'm saying that sticking your head in the sand and pretending that SSNs are secure won't make them any more so. I'd doubt that a whole lot of SSNs were gathered in this hack that weren't already effectively disseminated widely in black market circles or marketing databases already.

windexh8er 12y ago
Conversely getting 100k SSNs vs spending a significant amount of time and/or money on a handful is a different story. I'm not disputing that SSNs might be easy to obtain, but obtaining them at scale via breaches as this are apples and oranges. One is targeting a company because it is known to handle this information, the other is targeting an individual. The difference is simply data dispersion. If a breach dump ends up on the public Internet everyone has access to that data, worst case scenario, infinitely. Individual targeting has a similar risk but the overall impact is smaller. Not sure what your point is with the "head in the sand" comment - I happen to work for a security company in an engineering role. I'm not, in any way, defending security through obscurity or the way SSNs are used or (mis)handled. Reading through these comments it is apparent credit agencies don't even get it - and that is disturbing in itself. But stating that you "doubt a whole lot of SSNs were gathered in this hack that weren't already effectively disseminated widely" is, in fact, a head-in-sand approach compared to doing everything you can to preserve and prevent in the mean time. I, personally, don't agree. edit: added "compared" to second to last sentence for clarification
justin66 12y ago
> Legally you can obtain someone's SSN for very little money. Not legally. You certainly can go onto a website and buy them, if you misrepresent your purposes, and you won't be caught... but it's still illegal.

by exelius 12y ago

windexh8er 12y ago

Conversely getting 100k SSNs vs spending a significant amount of time and/or money on a handful is a different story. I'm not disputing that SSNs might be easy to obtain, but obtaining them at scale via breaches as this are apples and oranges. One is targeting a company because it is known to handle this information, the other is targeting an individual. The difference is simply data dispersion. If a breach dump ends up on the public Internet everyone has access to that data, worst case scenario, infinitely. Individual targeting has a similar risk but the overall impact is smaller. Not sure what your point is with the "head in the sand" comment - I happen to work for a security company in an engineering role. I'm not, in any way, defending security through obscurity or the way SSNs are used or (mis)handled. Reading through these comments it is apparent credit agencies don't even get it - and that is disturbing in itself. But stating that you "doubt a whole lot of SSNs were gathered in this hack that weren't already effectively disseminated widely" is, in fact, a head-in-sand approach compared to doing everything you can to preserve and prevent in the mean time. I, personally, don't agree. edit: added "compared" to second to last sentence for clarification

justin66 12y ago

> Legally you can obtain someone's SSN for very little money. Not legally. You certainly can go onto a website and buy them, if you misrepresent your purposes, and you won't be caught... but it's still illegal.