[HN Gopher] Googling Strangers: One Professor's Lesson on Privac...
       ___________________________________________________________________
        
       Googling Strangers: One Professor's Lesson on Privacy in Public
       Spaces (2019)
        
       Author : ddtaylor
       Score  : 106 points
       Date   : 2021-03-11 13:09 UTC (9 hours ago)
        
 (HTM) web link (www.npr.org)
 (TXT) w3m dump (www.npr.org)
        
       | throwawy54350 wrote:
       | Someone turned right in front of me one day, almost causing me to
       | hit them when I had my kids in the car. I was absolutely furious.
       | It was a distinct car, with a vanity plate, that quickly led me
       | to an Instagram account with a link to their business websites.
       | The sites were PHP messes with a bunch of vulns and directory
       | listings with links to admin pages, domain control panels, email,
       | you name it. I was very tempted to nuke everything before common
       | sense returned to me and I just let it go.
       | 
       | I (when I am not using a throwaway) try to act like anyone I
       | interact with online could be standing outside my house. You just
       | never know.
        
       | [deleted]
        
       | jrimbault wrote:
       | I confess to having played that game in the subway. Never with
       | bad intention, just bad manners and curiosity on my part.
        
       | underseacables wrote:
       | Imagine if we did Google every single person we met, and started
       | a dossier of them with all of the information that we could find
       | and collect about them. That would be a lot of work, but Facebook
       | does it for us.
        
         | mywittyname wrote:
         | I think this was FB's secret sauce. We _love_ creeping on
         | people we know.
        
         | falcolas wrote:
         | Now imagine an ITTT-style automation of this collection, so it
         | requires virtually no input from you to have a dossier on
         | almost everyone around you based on their ambient presence.
         | 
         | Could even potentially use Facebook et.al. facial recognition.
         | 
         | Bundle it up with your Instagram or Google glasses.
        
           | HDMI_Cable wrote:
           | This is both so scary, and somewhat feasible. I could imagine
           | this database having more information than all of the
           | government ID systems.
        
       | drooby wrote:
       | The internet is also a public place in many ways. If someone
       | overhears my name and sees my face and discovers my personal
       | website or LinkedIn page, then they have only discovered MORE
       | public information about me. There is no privacy breach if I
       | don't divulge private information on public spaces, i.e the
       | internet.
        
         | jedimastert wrote:
         | I think there needs to be more consciousness that the internet
         | as a whole is a public commons, as public as doing something on
         | the square. It's something I'm going to endeavor to teach my
         | kids when they start interacting with the internet (a thought
         | that already gives me great anxiety)
        
           | hc-taway wrote:
           | The norm used to be _never_ to post personal info online.
           | Yes, some things could still be found out, and there were
           | still attack vectors, but typing your real name in a web
           | form, except _maybe_ (and only fairly late in the time period
           | I 'm talking about) to pay with a CC on a well-known site?
           | LOL no. Posting photos of yourself, and with your name and
           | maybe even a location attached? Madness! Are you nuts!?
           | 
           | I'm convinced Zuckerberg's infamous "dumb fucks" comment was
           | made in a state of puzzlement that all these n00bs just had
           | _no idea_ they shouldn 't be giving him that info, and
           | indeed, the dawn of Facebook and all the people it added to
           | the set of folks posting information online ended the
           | previous "no-one knows you're a dog" set of norms of the Web.
           | 
           | Now there's money tied up in it, so of course people insist
           | they must be able to post all kinds of things under their
           | real names so they can market themselves. Never mind that it
           | remains a terrible idea.
           | 
           | This is the source of conflict, I think, between people who
           | want _more_ real names online and those who want _none_. The
           | former are the new folks who think posting personal info
           | online is normal, or even necessary (see again: personal
           | brand-building and marketing) and believe that we need to be
           | able to ID everyone to prevent abuse (i.e. be able to find
           | abusers to punish them), and the latter are the old-school
           | Web users (post-Eternal-September, pre-Facebook) who don 't
           | get why all these idiots are making themselves easy to abuse
           | in the first place, who see _more_ anonymity as the obvious
           | cure.
        
             | jedimastert wrote:
             | > This is the source of conflict, I think, between people
             | who want more real names online and those who want none.
             | 
             | I think there is a space for both, tbh. There is always
             | business based on reputation, and for that you need to
             | self-identify. I used to be a professional gigging
             | musician, and there was absolutely no way to do that while
             | remaining anonymous online, nor would I want to.
             | 
             | The difference being, I suppose, was business vs personal,
             | but personal brand was a thing long before the internet (I
             | assume).
        
         | bogwog wrote:
         | > There is no privacy breach if I don't divulge private
         | information on public spaces, i.e the internet.
         | 
         | You also have to keep in mind that you can be publicly
         | divulging things without even realizing it, especially because
         | everything you post online is stored permanently, and tons of
         | private information about you can be extrapolated from it by
         | anyone who bothers to pay attention.
         | 
         | It's also insanely profitable, just look at Google and
         | Facebook!
        
           | asdfasgasdgasdg wrote:
           | For Google, the most profitable thing (to my understanding)
           | is advertisement on product-seeking queries. If you look and
           | a SERP for a privacy-invading search, like Googling someone's
           | name or email address, you'll notice that there are not
           | really so many ads. I tried searching for my real name, my
           | real name with my locale, and my email address. I was able to
           | find an old breached password and I was able to find my home
           | address, but I didn't see any ads. You could argue that this
           | feature provides some halo benefit to Google's more
           | profitable queries, but to be honest it seems like a stretch
           | to me.
           | 
           | For Facebook, they make money from advertising to logged in
           | users. Broadly speaking, they keep users logging in by
           | offering users the ability to broadcast private information
           | to friends, and by offering the ability to receive such
           | broadcasts from friends. To the extent FB does invade
           | privacy, they do so to more effectively advertise to users on
           | their site. They don't make the results of that invasion --
           | the profiles they build from their tracking bits, in other
           | words -- available for public search. What's available for
           | public search is instead only what the users choose to
           | broadcast about themselves.
           | 
           | The exposure of private information to public search engines
           | is _not_ what is profitable about either of these companies.
           | It 's an incidental effect of the persistence of digital
           | storage and the difficulty of curating what is stored.
        
       | jancsika wrote:
       | > Instead, she wanted them to understand the gap between our
       | perception of how much privacy we think we have in public spaces
       | -- and the reality. And, as she puts it, "to show them how thin
       | our privacy constructions are in the modern day."
       | 
       | It doesn't matter that my neighbor, or hell-- even a rando
       | drunken tourist-- can poison my drinking supply.
       | 
       | It does matter if a doe-eyed, tech-fetishizing HOA busy-body
       | hooks up an IoT device which somehow connects the control system
       | for water supply to the internet.
        
         | ggggtez wrote:
         | You're conflating two disparate issues. Privacy and Security
         | should not be thought of an analogs. You're talking about
         | security. I don't think that's helpful for understanding the
         | issues at hand.
        
       | ChrisArchitect wrote:
       | previous old discussion:
       | 
       | https://news.ycombinator.com/item?id=19362793
        
       | datavirtue wrote:
       | I did a little experiment and yielded , what to me was expected,
       | results within seconds. I pretended I was at a Starbucks and I
       | heard them call out my grandmother's first name for her coffee
       | order. I googled her first name and the name of the town the
       | Starbucks is in--no state or other info--just two words.
       | 
       | I scroll down, swipe through a few pictures, and now I have her
       | life story in front of me. From that I can go down the rabbit
       | hole and easily construct a phishing profile that I can use on
       | her family members.
       | 
       | I just assumed everyone already knew you could do this.
        
       | sodality2 wrote:
       | I found it scarily easy to find info on some people. I was
       | talking to my friend about it, so I tested it out on them (with
       | their permission).
       | 
       | With just their public facing instagram account handle, I:
       | 
       | Found full name from family members in following list -> email,
       | phone #, etc from full name
       | 
       | Found email + phone of most of the close family
       | 
       | Found address, PO box, and usernames from their past accounts
       | 
       | Found their (current!) password for email, social media, etc (but
       | not bank) from a breach from 2016 (!!!)
       | 
       | Found their old wattpad account (!!!!!!)
       | 
       | Found out that their instagram had no 2fa and "hijacked it" with
       | them next to me, changed email and password (not sure if they
       | could have recovered it afterwards). Notifications did come
       | through but given their email, I used an email newsletter spammer
       | I made and a text spammer to blow up their phone to hopefully
       | distract for the few minutes it took, to simulate a real attack.
       | 
       | Needless to say, it was bad news all around. (I already knew some
       | of the info I found, but my search consisted of me pretending I
       | didn't)
       | 
       | Edit: the irony of me posting about data security when I just
       | divulged where I grew up & school district less than 2 weeks ago
       | :'( (though I bet I'm fine given I have no other accounts with
       | this username)
        
         | Item_Boring wrote:
         | That reminds me when I was still in high school and got to
         | school by bus.
         | 
         | I was around 16 and used to carry a binder with my full name on
         | its back in my hand because it was a bit too large for my
         | backpack.
         | 
         | One day, I got a letter by a guy whose name I didn't know. He
         | saw me on the bus and thought I was cute, so he decided to look
         | me up and somehow found out my current address. He couldn't
         | have used the phone boom because my family wasn't listed, so he
         | must've googled me. Luckily, the guy didn't have any bad
         | intentions but it was very scary nevertheless.
        
           | sodality2 wrote:
           | That sounds very scary- I'm glad he didn't have any overtly
           | malicious reason for it. What did the letter say? Was it a
           | "hi date me" type of thing?
        
             | Item_Boring wrote:
             | Yeah, me too.
             | 
             | Yes, it was essentially a love letter ending with "please
             | call me".
             | 
             | I actually did text him - since he included his phone
             | number and I wanted to know who he was - but I "ghosted"
             | him after some months when he kept asking me to come to his
             | home (he was twentysomething so several years older than
             | me).
             | 
             | Afterward, I received one more postcard from him telling me
             | how much he misses me and how he wished I was there with
             | him (he was travelling at that time) but then it stopped.
        
               | sodality2 wrote:
               | Wow, that's very weird and very inappropriate of him,
               | hopefully he got in trouble / didn't do that to anyone
               | else. I'd be very anxious if someone had my home address
               | and was harassing me, I'm sorry you had to deal with
               | that.
        
         | raisedbyninjas wrote:
         | If they're still on Facebook, their parents are likely there
         | too. Find an uncle and you may have their mother's maiden name.
         | 
         | Facebook still allows non-friends to see the friends list of
         | private accounts through URL tweaking AFAIK.
        
           | sodality2 wrote:
           | Don't think I found anyone on facebook when I searched- just
           | an instagram. If that's true, though, that's... par for
           | Facebook I guess? I wish any other better site took off with
           | people (especially teenagers) than something Facebook has
           | their tendrils in.
        
           | dado3212 wrote:
           | If you submit the URL thing through the bug bounty, FB will
           | pay out.
        
         | ggggtez wrote:
         | > Found their (current!) password for email, social media, etc
         | (but not bank) from a breach from 2016 (!!!)
         | 
         | When a friend of mine asked me to do a similar challenge, I
         | actually forgot to check password dumps.
         | 
         | Then again, I also didn't bother spending the $10 for ancestry
         | information which probably would have yielded yet more info
         | (mother's maiden name, etc). But I kind of lost interest after
         | reading several dozen pages of their Twitter feed.
        
         | aesclepius wrote:
         | I've got another anecdote about exposed information. Saw a
         | car's 'Instagram handle' while next to them (was passenger) and
         | got curious. Sure enough, their car's Instagram handle was
         | public-facing and had links to the presumable owner's instagram
         | handle (public facing) and his wife's handle (also public).
         | Within five minutes of horrified clicking, I found both
         | parents' birthdays, occupations (and photos of locations where
         | they worked at) full legal names and birthdays of their
         | parents, sisters, brothers (they had posted birthday
         | celebrations and funeral announcements with names and dates),
         | their wedding date (and all subsequent vacations they took),
         | residence (posted about buying a new house), their children's
         | full legal names and where they went to school (posted dropping
         | them off at school), and the makes and models of all their cars
         | (posted about buying new cars) over the last 5-6 years. It was
         | a little scary to see how open they were.
        
           | RandallBrown wrote:
           | What potential dangers do you see from getting this
           | information?
        
             | sodality2 wrote:
             | That's likely enough to pull off an identity theft on some
             | level.
        
             | sneak wrote:
             | Extortion, blackmail, stalking, credible threats of
             | kidnapping or robbery due to pattern of life exposure, et
             | c.
        
         | dogman144 wrote:
         | This is an area of sec research I'm very interested in: classic
         | attacks with a major IRL impact.
         | 
         | It's similar to social engineering but that's not a correct
         | comparison. More like an attack that hops the cyber<>physical
         | barrier but uses standard TTPs from pure-cyber.
         | 
         | There are proof of concepts like this out there, to start. It's
         | like you DDoS'd someones real life - that's intense.
        
           | ggggtez wrote:
           | > It's like you DDoS'd someones real life
           | 
           | No... It's called "doxxing".
           | 
           | DDoS is completely different.
        
             | luisfmh wrote:
             | I think they meant DDos'ing as in the person gets
             | overwhelmed with notifications and can't actually see the
             | notification about the password change. (i.e. the person's
             | attention is the service)
        
               | dogman144 wrote:
               | You got it!
               | 
               | Like I sort of referenced in my OP, it's part of a group
               | of exploits which still lacks firm industry terminology,
               | but definitely are out there.
               | 
               | The only firm things I can ID so far in this
               | cyber<>physical attack space is:
               | 
               | - cyber<>cyber TTPs definitely apply in a certain way
               | 
               | - Vulns->exploits can start with CIA-like threat modeling
               | (so ID'd starting point)
               | 
               | - the indicators of compromise show up both in the cyber
               | domain, and physical domain, as part of a single attack
               | 
               | - it's a greenfield on defining what an IOC in the
               | physical domain part of this attack is. If you attack
               | plant watering system, is there anything unique on the
               | outcome of plants that indicate it's definitely cyber?
               | 
               | - The physics of the real world play a large role in
               | governing how the physical aspect of the attack occurs(my
               | human ability to read, process notifications at certain
               | scales of notification receipt)
               | 
               | Another example is "AI/ML" can generate financial reports
               | that are believable. If you consider the behavior that a
               | lot of folks trade purely on Twitter news, you can model
               | exploits via thinking how you could compromise the
               | integrity and availability of financial reports that
               | people trade off of (I and A in CIA) by:
               | 
               | - Integrity: if you can get the fake report to get uptake
               | on Twitter on key nodes, "the truth" of a company's
               | finances can be replaced via this false report, as you
               | have a legion of twitter traders following a much smaller
               | legion of key accounts for trading views
               | 
               | - Availability: if you generate enough volume of this
               | fake report vs. the real report, a metric humans use to
               | eval the truth of things is "is it in every newspaper,"
               | so you can reduce the availability of the real report as
               | it is drowned out.
               | 
               | And so on... there's definitely real attacks here, but
               | they exist a bit outside of current security models. Very
               | cool area.
        
               | ggggtez wrote:
               | Oh, I see. Sure I guess. But it's not a DDoS either. It
               | would just be a DoS.
        
             | dogman144 wrote:
             | No, it's called DDoS'ing, at least for threat model that
             | I'm referring to.
             | 
             | The user just near about doxx'd themselves by all the OSINT
             | that was available. That's not particularly interesting.
             | Trolling with IRL effects is a the better peer as well, in
             | that case. It's also similar to malicious pop-ups in a
             | browser, but a browser never had the life-governance
             | abilities that a smart phone has now.
             | 
             | What is interesting, from an exploit dev standpoint, is
             | that in a sense you can DDoS someone's life by overwhelming
             | their human data intake systems of notification-based
             | services, which they use to govern their own behaviors.
             | 
             | Think of this in terms of a notification == a connection,
             | and human == router.
             | 
             | * Baseline: 5 notifications per hour -> parseable by a
             | human with 1 brain and a single iphone to triage them. No
             | discernable effect on ability to rely on other key
             | notifications (calendar alerts, banking messages, so on).
             | 
             | * Elevated from baseline: 5 notifications per 10 mins: odd,
             | but still parseable, maybe calendar alerts and watching for
             | an important email take a back seat.
             | 
             | * Malicious DDoS: 5 notifications per minute, on repeat:
             | you don't know what's going on, it is overwhelming, you
             | can't particularly turn off a phone because you still need
             | the calendar app, and so on.
             | 
             | When the notification system, taken in aggregate, is
             | providing some key service to how a person runs their life,
             | overwhelming that system is a DDoS.
             | 
             | Another vector: many calendars such as Gcal and especially
             | with recreational users, allow appointments to be dropped
             | onto the calendar. This is a common sales tactic too.
             | Generate N appointments, overwhelm a calendar, and it's up
             | to the user to remove malicious appointments manually vs. a
             | very bulk, automated appointment attack. DDoS as well.
        
         | btown wrote:
         | That "spam distraction" tactic is scary - no doubt it's being
         | used in the wild!
        
           | iamacyborg wrote:
           | It was, a few years ago Mailchimp and a few other ESP's were
           | subject to major listbombing attacks.
           | 
           | https://wordtothewise.com/2016/08/subscription-bombing-
           | esps-...
        
             | sodality2 wrote:
             | Unfortunately nearly every mailing list sends a
             | confirmation email. that's good enough for an initial
             | flood...
             | 
             | A better solution would be "send an email to
             | newsletter@domain.com"! Very surprised this hasn't been
             | implemented
        
               | iamacyborg wrote:
               | Mailchimp turned off double opt-in as the default list
               | behaviour, presumably as a result of this listbombing
               | taking place.
               | 
               | It eliminates the immediate flood from the listbomb
               | attack but does mean the email address now has to opt-out
               | from every list they've been susbcribed to.
               | 
               | https://wordtothewise.com/2017/10/mailchimp-changes-
               | signup-p...
        
               | LeifCarrotson wrote:
               | Ah, but then fewer people would "sign up for the
               | newsletter" by failing to toggle the box on the checkout
               | page. Then your list membership growth rate would go
               | down! Can't risk that, no wonder it hasn't been
               | implemented.
        
           | sodality2 wrote:
           | Surely so!
           | 
           | I just spent a few hours signing up for newsletters I had
           | saved previously and gathering submit POST requests,
           | concatenating it into one script, etc. I honestly can't think
           | of any white hat use for it (besides what I did). I haven't
           | open sourced it, because it will probably be used for
           | malicious purposes by script kiddies 99% of the time, and I
           | don't really want that associated with me.
        
       | paul7986 wrote:
       | There is no privacy with sites like SearchPeopleFree (dot) com
       | 
       | That's all u need to find out almost anything about anyone! Even
       | if a prospective online dater gives you their Google voice number
       | the site is gonna most likely tell you almost all about them.
        
         | saalweachter wrote:
         | I'm looking at that now out of curiosity. I don't know if I'm
         | more outraged that they link you to multiple sites (for more
         | information) which are clearly just reskinned versions of the
         | same underlying code, that the sites are clearly trying to
         | harvest more and more information from me as a user, or that
         | they are using a "please wait while we search for more
         | information!!!" anti-pattern to keep you on them for _ever_.
         | 
         | [EDIT: And oh look, the "more information" site asks for your
         | money after dragging you through the longest anti-pattern in
         | the world.]
        
           | paul7986 wrote:
           | They give plenty of info for free..type in phone number and
           | get their full name, age, current and previous addresses,
           | people they associate with. Everything except criminal record
           | which once you have a name in most US stated you can then go
           | to the local court website and get that info. Why pay
           | anything?
        
       | mariodiana wrote:
       | Some years ago I was applying for a job and had to fill out a
       | form for a background check. The background check asked for my
       | last several addresses -- and I had no idea what they were. Even
       | then, it seemed obvious to try googling myself. Scary! In a few
       | minutes I had every address I had ever lived at.
        
       | mediascreen wrote:
       | In a weird way it feels like we are more prepared for this in
       | countries like Sweden where your social security number, tax
       | returns, income, credit history, address, spouse, children,
       | company board positions, pet ownership, car ownership and
       | criminal records are public information and easily available.
       | 
       | At least we have no illusions of privacy. Someone could start
       | with your licence plate and two minutes later know pretty much
       | everything.
       | 
       | Since 1905 you have been able to buy a book every year that
       | listed up to date income and net worth for everyone in your area
       | [0]. Now, of course, everything has moved to web services and
       | APIs. Take a look at the example response from this API for an
       | idea of the information available [1].
       | 
       | [0] https://en.wikipedia.org/wiki/Taxeringskalendern
       | 
       | [1]
       | https://api.ratsit.se/swagger/ui/index.html#/Person/get_api_...
        
         | sib wrote:
         | Note to self: never move to Sweden.
         | 
         | (Although I lived there as an exchange student for a summer
         | many years ago...)
        
         | PeterisP wrote:
         | The key part there is that in such an environment it is obvious
         | for any company (and their customers) that "something your
         | spouse or mom would know" is not an acceptable security measure
         | for anything, so it does not get used. But it does not have to
         | be a tradeoff, we could easily have companies avoid such
         | security questions even if privacy is still mostly a thing we
         | get.
        
         | dhosek wrote:
         | This was part of why author Stieg Larsson never married his
         | girlfriend: To do so would expose her to people who had made
         | credible threats on his life because of his journalism work.
         | Unfortunately, this also meant that she was locked out of his
         | estate after his death.
        
       | 0xCMP wrote:
       | A lot of conversations around privacy and using encryption would
       | be much easier if those in the conversation understood just how
       | simple and permissionless it is to snoop information and become
       | way more knowledgeable about someone than you should.
        
       | BaseS4 wrote:
       | 1990s: open source all the code!
       | 
       | HN: yaaaaaay
       | 
       | 2020: open source all the intelligence!
       | 
       | HN: Now hold your horses, mister
       | 
       | What did you think making programming widely available was going
       | to do? Did you think nation-states and their bloated
       | bureaucracies would magically step in and go full North Korea
       | about privacy to protect us from you?
       | 
       | This accountability-denying pearl-clutching HN does every time
       | they see an OSINT technique is ridiculously predictable... and
       | only demonstrates your culpability in creating this mess in the
       | first place.
        
         | ggggtez wrote:
         | Your comment doesn't make any sense.
         | 
         | Open Source Software is a solution for the problem of companies
         | writing bad software under the assumption that no one will
         | bother finding bugs if they are too annoying to find. History
         | proved that wrong.
         | 
         | There would be no point in doing _any of that_ if you wanted
         | the data to be freely available too. If so, you could just
         | publish your database as a read-only file, and call it a day.
         | Or just forgo any accounts at all.
         | 
         | It literally makes no sense to blame OSS for privacy problems.
         | The last I checked, Google Search is not open-source... These
         | are two completely separate issues.
        
       | jacquesm wrote:
       | I once showed an UHNWI what information I could dig up on them,
       | their family and so on in a couple of minutes starting from a
       | single 'checkin' on FourSquare. They were so shocked that it was
       | hard to believe they had been utterly unaware of this right up
       | until that moment. The next couple of days were spent on reducing
       | their information footprint to something manageable, making sure
       | that children were no longer visible and/or easily traceable and
       | so on. Today you can barely find that person even if you know
       | they exist.
       | 
       | If you don't actively manage your privacy you are very likely
       | leaking information that you do not wish to be made public.
        
       | monoideism wrote:
       | I thought that the lesson of this assignment was something that
       | they never mentioned: all this public information that the
       | students manually googled is available for automated passive
       | surveillance to record, look up, and store.
        
       | possiblelion wrote:
       | I think most of us have done something along these lines, whether
       | out of boredom or just curiosity.
        
       | [deleted]
        
       | caseysoftware wrote:
       | I used to do a presentation called "Shattering Secrets with
       | Social Media" where we'd do a "live attack" on a volunteer from
       | the audience.
       | 
       | Starting with their name from their badge, we'd see how many of
       | the top 10 security questions we could answer. For most people we
       | could get 4-6 in a matter of minutes. For a select few we could
       | only get 1-2.
       | 
       | Despite it all, there were two we could almost never get: street
       | you grew up on and first pet's name. My theory was that those are
       | tied to a time and place that predates social media for many
       | millenials and all gen-x.
       | 
       | But there was another approach.. one of those silly threads from
       | years ago was "What is your porn star name?" which required your
       | first pet's name and the street you grew up on. Yes, that was a
       | social engineering attack at scale.
       | 
       | And even if you didn't answer it, if you had a sibling roughly
       | the same age, odds are theirs were the same.
        
         | fanatic2pope wrote:
         | One of the benefits of using a password storing app (in my case
         | keepassxc) is that I answer those kinds of secondary questions
         | with random words.
        
           | lfowles wrote:
           | Isn't the danger now that someone could call into your bank
           | and say "I forgot them exactly, but the answers are just
           | random strings"
        
             | ggggtez wrote:
             | In my experience, I told them I didn't remember, and they
             | told me "yeah it's just a bunch of random letters..." but
             | they didn't let me through and required me to go through
             | different security confirmation instead.
             | 
             | In this case, it's as if the security question just didn't
             | exist. That's fine with me. I'd rather the attackers figure
             | out the other security measures (e.g. get access to my
             | email or phone in order to receive a security code) than
             | just get into my account by pure guesses. (Though I like
             | the solutions here of using very uncommon two-word phrases
             | to avoid the chance of an incompetent phone operator
             | accepting "random letters" as an answer).
        
             | yohannparis wrote:
             | Then there is a clear breach of the terms of services from
             | your bank, and it might be easier to get issue on their
             | hands. But you are right, the best solution would something
             | in between.
        
             | caseysoftware wrote:
             | I had that exact thing with a bank last year.
             | 
             | Them: Can you confirm your mother's maiden name?
             | 
             | Me: Sure but just a second. I need to open my password
             | manager because it's a long random string.
             | 
             | Them: Okay, that's good enough!
             | 
             | I reported that to their security and compliance team.
             | Never heard back but moved my accounts from there.
        
               | Moeancurly wrote:
               | At one point I did the same, until I also had to read a
               | long random string to a CSR over the phone. Now I use
               | real-sounding fake answers.
        
               | mywittyname wrote:
               | I've found that goofy answers are both easy to remember /
               | say, but impossible to guess.
               | 
               | Like, "what's your mother's maiden name?" "Lady with
               | cheeto-colored hair." Or, "what street did you live on
               | growing up?" "We liked to imagine it was the moon"
        
               | saalweachter wrote:
               | I like to imagine that one day, after the Singularity,
               | the super-intelligent AI overmind that society merges
               | into will be able to resurrect me from the security
               | answers I've left throughout the internet.
               | 
               | And all of the virtual reincarnations of all you
               | security-minded suckers will be stuck thinking your
               | mother's maiden name was X1r$9ox01.
        
               | caseysoftware wrote:
               | aka Elon's descendants.
        
             | EricE wrote:
             | They didn't say random strings, but random words.
             | 
             | I use the same technique too and at first I used words
             | until I thought about having to call in, so now I just use
             | two random words.
             | 
             | First rule of security questions - never answer them
             | truthfully!
        
             | jakub_g wrote:
             | This issue always come up with those discussions indeed.
             | Probably to be safe you could just come up with plausible
             | unique non-random name, and still store it in keepass.
             | 
             | > What's your cat's name?
             | 
             | Site X: Kareem Abdul-Jabaar
             | 
             | Site Y: Cassius Clay
             | 
             | Site Z: Franz Beckenbauer
        
         | not2b wrote:
         | Yes, this is how someone "hacked" (if you can call it that)
         | Sarah Palin's Yahoo mail account: the answers to her security
         | questions were all Google-able or easily guessed.
        
           | Minor49er wrote:
           | > this is how someone "hacked" (if you can call it that)
           | 
           | Given that the term "hacker" comes from someone who hacks
           | away at a keyboard until they get a desired result, I would
           | call it that
        
             | sneak wrote:
             | The term hacker significantly predates keyboards.
        
         | Swizec wrote:
         | > Starting with their name from their badge, we'd see how many
         | of the top 10 security questions we could answer
         | 
         | A fun thing I do is to just not use my legal name. Online or in
         | person (unless talking to a doctor and such). Many of my
         | friends don't even realize.
         | 
         | Of course the problem is that at this point I've used this name
         | enough that you can probably do all the same tricks with it.
         | That's why I use yet a 3rd name as a throwaway at coffee shops
         | or with transient strangers.
         | 
         | Getting death threats from dad's business dealings once was
         | enough.
        
           | kibwen wrote:
           | This is a great idea that I've been coming around to for a
           | while now.
           | 
           | 1. Have a legal/professional name. This is what shows up on
           | your birth certificate, your IDs, what the people at your
           | work know you by, etc.
           | 
           | 2. Have a personal name. This is what your friends and family
           | know you by, and can be completely disjoint from your legal
           | name. A low-effort way of approximating this is just to go by
           | your middle name among friends, since you're usually not
           | required to divulge your full middle name on formal
           | documents, so you can still maintain some degree of
           | separation.
           | 
           | 3. Have a public name, or a variety of public names, that are
           | disjoint from the prior two. These are your social media
           | account names, email address, Twitter handle, etc. Let these
           | be as disposable as possible and, if feasible, rotate them
           | out every few years.
        
             | BitwiseFool wrote:
             | Interestingly enough, having multiple names for different
             | situations was commonplace before bureaucracy wanted
             | standardized personal and surnames for better record
             | keeping and taxation. Names used to be a lot more flexible
             | and contextual before statecraft.
        
             | caseysoftware wrote:
             | That's an okay idea but it still dependent on secrets. The
             | first time some books a flight or hotel on your behalf or
             | your company pays an expense report, it's no longer a
             | secret.
             | 
             | But your third point of having a variety of public names is
             | good. Ideally, don't connect or link them in any way
             | either.
        
           | Kye wrote:
           | This happens a lot among furries. Way more people know me as
           | Kye than by my legal name.
        
           | mxstbr wrote:
           | > Getting death threats from dad's business dealings once was
           | enough.
           | 
           | I would love to hear that story if you're up for telling it
           | Swizec!
        
             | imoverclocked wrote:
             | If I were him, I wouldn't post it here because it's a link
             | between his previous (attacked) identity and his current
             | online identity.
        
         | ggggtez wrote:
         | I think the key to the Street address question is to actually
         | first find their _parents_ and then find the addresses that
         | _they_ lived at.
         | 
         | There is a non-zero chance their parents still live at the same
         | address. And if not, there are likely records of home buy/sales
         | which can give more guesses.
         | 
         | First pet though, I agree is difficult. I can't think of any
         | public records which would list this kind of info. However, pet
         | names also follow predictable patterns. You can probably get
         | very far with names like "Mittens, Duke, Spike, Spot ..."
        
           | yourapostasy wrote:
           | _> First pet though, I agree is difficult._
           | 
           | Someone, somewhere, is mapping out all the sites that ask
           | that as a "security question", and they'll be ready to add to
           | their dictionaries when one of those sites is breached.
        
         | MattGaiser wrote:
         | One bank of mine has "first job" as a security question. If I
         | put the real one, you could easily get it from my LinkedIn.
        
       | intrasight wrote:
       | Cool idea for a class project!
        
       | ThrustVectoring wrote:
       | One of the things that I accidentally got is an _extremely_
       | common first + last name combination. Googling it gives you eight
       | digits of results and an info box for an athlete. My childhood
       | library system had five other people with my name, and my
       | childhood pediatrician had one other.
       | 
       | It makes me a _lot_ more confident about my pseudonyms ' online
       | anonymity. Not that I don't think concerted attackers could
       | figure out who I am - people have, given access to additional
       | info like previous employers or the college I attended. But I
       | think it severely limits the ease and scope with which people
       | could attack my personal life through my posts online. When I
       | have children I'm going to do the same for them, I can only think
       | it'll be even _more_ important thirty years from now.
        
         | inetknght wrote:
         | On the other hand someone trying to hack you could cause
         | collateral damage to others with your name
        
           | 29083011397778 wrote:
           | That's one reason to advocate for good security hygiene for
           | everyone. "I'm not important" is not a defence here, helping
           | your aunt set up a password manager that syncs automagically
           | for her is.
        
         | dhosek wrote:
         | When I taught high school in the '00s, they used first+last
         | name as a primary identifier for students. For duplicates, they
         | added an asterisk on the end, repeating as necessary. I had one
         | student on my roster who was Jose Ramirez**** (not his actual
         | name or number of asterisks, both of which I've long since
         | forgotten).
        
         | BitwiseFool wrote:
         | All of these Millenial mom and dads probably didn't realize
         | giving their child a rare/unique name would make the kids so
         | much easier to track online.
        
         | InitialLastName wrote:
         | This, I don't have a common name, but I'm roughly the same
         | age/regional origin as someone with the same name as me who has
         | generated enough internet noise from things like sports that
         | the tracker pages (as an example) have us deeply confused. Very
         | comforting, except for when we get emails meant for each other.
        
       ___________________________________________________________________
       (page generated 2021-03-11 23:01 UTC)