5 ms·
That means you could brute force your way into getting someone else's tax return... scary
by omgitstom 12y ago
That means you could brute force your way into getting someone else's tax return... scary
- thrownaway2424 12y agoThis has always been possible. I knew a guy who bulk downloaded returns from hr block because they required only last name, zip, and partial ssn. He picked a zip where everyone is named Stein and was born at the same hospital (which gets its own ssn shard) and went to town. Naturally they had no rate limiting.
- gaadd33 12y agoHow do you find a zipcode where everyone has the same last name? I'm guessing a very small town several hours from a single hospital?
- thrownaway2424 12y agoWrong it's one of the most populous zips in the nation and I'm being flippant about the name but when you are brute forcing things an unusual probability is all you need.
- gaadd33 12y agoOh seems like it would have been just as easy to grab census data for the past 50 years and run through last names by decreasing frequency. Here I thought you had found a unique zipcode.