Slashdot Mirror
What Web Surfers Can Find Out About You
cweditor writes in with an updated version of a story the likes of which you might have read before, What the Web Knows About You. But reporter Rob Mitchell found out vastly more about himself (his research subject) online than he could have even a year or two ago. The big difference is that state and local governments are putting online digitized records, often with Social Security numbers and other personal details intact. Mitchell ends by questioning how much good it does for banks or credit card companies to require 4, 5, or more independent identity "factors" before providing access to account details, when most or all of the factors they request can be found online about nearly anyone.
They will see that I am suave, handsome, and well-groomed. Also I have a shapely nose. Will you marry me. My address is on the webernet.
Anonymous coward was the first to respond here
I googled my name and found 3 obituaries.
In the land of the blind, the one-eyed man is usually crucified.
Nice MASSIVE WALL of ADs, you douche.
I have a mostly blank facebook account just because some people I know use it.
Since date of birth is so widely (mis)used as a security question, I use a false dob and people often wish me happy birthday a week or so before it actually is.
I have complained about this crap for years to my credit card companies, phone companies, mortgage company, and even my college. How can they claim to protect your account information when their verification questions are all publicly available information? (In the case of the colleges, students are often asked to sign in for roll or exams using a social security number, and that sheet is either passed around or otherwise completely viewable.)
At least some allow you to select a special pass phrase. Only one of my vendors will not allow me access to the account if I do not provide the pass phrase. Every one else has a way around that.
Security. Pfah.
Real multi-factor authentication requires some thought and the expenditure of time and money. Is it any wonder that some banks have implemented extremely LAME (mother's maiden name, pick a picture) versions of two factor authentication. Ideally, it should be (choose at least two): something you know, something you have, and something you are (and perhaps somewhere you are). Something you know is typically an ID / password pair. Something you have can include a one time pad (Gibson's perfect paper password), an RSA dongle, a Yubikey, or even a cell phone (bank sends key as text message). Something you are is biometrics: fingerprint readers, retina readers, etc. (There's an amusing and horrible joke based in this in a "Red Dwarf" episode). Finally, you can have location based authentication: IP / Mac addresses (potentially spoofable), physically secure workstations (with optional armed guard), etc.
[Insert pithy quote here]
Muah Hahahaahaha!!! My facebook page doesn't even make it into the first couple pages of google, thanks for lots of people in much better paying positions having my name!!
Check it out, you will all be surprised what it will find:
http://www.pipl.com/
If I had an Ass, I'd call it Fanny Bottom, then I could slap my Ass; Fanny Bottom, on the Arse.
<Page 1>
Why
Cant
You
<Page 2>
Provide
A
Link
<Page 3>
So
Everything
is
<Page 4>
on
One
Page?
how abut a link here
Psha. Search all you want, and you'll never discover whether "rw^j8*=1IF9d" is my mother's maiden name, my favorite desert, or where I got my first kiss. And it won't matter anyway, 'cause that's not actually one of the strings I use.
--MarkusQ
P.S. And for an added level of security, I'm not really me, nor am I the person I told the bank I was.
I find it really irritating when a site requires you to give them (made up) personal information when it clearly doesn't need it. That's why Game! doesn't ask for any personal information whatsoever. Of course, that's probably a drop in the bucket compared to everybody pouring their life into Facebook...
Game! - Where the stick is mightier than the sword!
What? Anonymous Coward? you dare me to publish my SSN? Get lost. It does not make sense for me to do it alone. But if the entire person-SSN map of all people becomes public, it will actually help us all.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
Luckily, there are a ton of people with my name who are much more open on the web than I am. Producers, directors, artists, musicians, writers, attorneys general, you name it. 10 pages of Google still didn't come up with anything close. I guess there is a plus to having a really common name.
they found that most /. posters are bored, self-important, anti-social, regular garden-grade assholes in general, or some combination thereof. Me? I'm more bored and an asshole. Others fit the criteria differently.
Tony Blair's Ex bodyguard and some lady that owns an original Unicorn Jones art piece. I am luckily fairly invisible I guess.
Ask not what You can learn from the Web,
but what the Web can learn from You.
Do people regularly google their own SSNs? I have contemplated trying mine, but I'm a little apprehensive about where it might end up and what it might get electronically tied to.
Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
Human Embedded RFID Chips
"found 3 obituaries" and "a ghost"
That means, (according to this article), we can now find and share out El Torico's bank account. Its what he would have wanted.
"You're dead, honey!"
I treat "verification questions" as another password. City of birth? gc5f*kmn. Mother's maiden name? r4#dcViop. And so on. Most institutions don't have a problem with it. And if they do, you can still just use a random word. "Okay, okay, my first pet's name was really Albuquerque."
My credit union suddenly adopted an "enhanced security" system where they come up with 10 personal questions (you don't have a choice which ones) and you have to provide answers to each one.
I looked over the questions, and decided I didn't want anyone knowing that information, even my bank. Called them and asked to opt out of the program. Was told that their system administrator said it was a new federal requirement. (Is this true? I haven't seen this practice at the competing credit union that has my car loan, or at the bank that has my mortgage.) They said it was for my own protection and there was no way to opt out.
I asked if I could use an additional, randomly generated password instead. (I already used a random string for my main password.) She said no, it had to be personal information.
I said it was an invasion of privacy and asked them what happens when their system administrator scoops all this personal information for his own use? (That was probably unfair, but I was getting annoyed at that point.) I pointed out that if everyone was required to use this system (which I still hadn't verified), Sysadmin from bank A could take your answers and use them to compromise your accounts B, C and D -- For instance posing as the account owner and answering the "magic question" (which is often a personal question) to reset the account password. She said that she didn't know about that, but I had to live with it.
I'm willing to bet that the "enhanced security" answers aren't even encrypted.
So with a little experimentation, I discovered that the "enhanced security" system will take any string as an answer. So, for instance, to the question "what is your maternal grandmother's middle name" (I actually don't know the answer.) you could answer "20382-0qopw" (string was generated by pounding on my keyboard) and the answer will be accepted.
I also found out that you could put random strings (or a rude phrase) for each answer, or use the same passphrase for every answer, and the system will accept it.
This opened whole new vistas of "security".
So, for my daughter's account, which doesn't have much to lose, I set all her "enhanced security" questions to the same passphrase, (you will never guess it, don't even try) and set up different passphrases for each security question for my accounts.
One big win to making up your answers is that a bad guy can't use the information to break into accounts in other institutions. Even if it's sold to a third party or published on the internet, the information only works with that one account. Moreover, there's no way someone can research my family history and come up with "asawi0egh" for my mother's maiden name. (Again, generated by slapping the keyboard a few times.)
In other words, don't buy into it. Treat it as just another password that you make up yourself.
How does one keep track of all these passwords? Find a secure password keeper application and use it religiously. Sourceforge is a good place to look. Some even work on PDAs.
Oliver's law of assumed responsibility: If you're seen fixing it, you will be blamed for breaking it.
Apparently I was at one time an inventor for IBM and co-invented the "Scannerless message concentrator and communications multiplexer"....what ever the hell that is!
I haven't came across anybody else with my name. Only 3 people in my state have my last name, and that's my parents and me. I don't know how many in the entire USA have my last name, but it can't be more than 20.
Ummm, I'm confused... do I Google my birth name or one of my too-numerous-to-mention split cyber-personalities?
I find it quite odd that this article was written by Bob Mitchell. Usually when someone writes about how they've discovered that google knows everything about them, the byline is something like Corvus McLazerpants. Although I don't personally know of this guy, I'm guessing that he must be popular enough that the other few thousand Bob Mitchells of the world providing chaff for him have an insufficient pagerank to be effective.
Pound! Bang! Bin! Bash! is this a shell script or a Batman comic?
I used to think that people who were afraid to give out their SSN probably also slept with tinfoil hats on. Now I only give it to companies that have to report something to the IRS. If someone isn't reporting income to the IRS, they don't need a SSN.
Think Deeply.
See also: Privacy is Dead
I don't usually have these problems. Just use someone else's identity, bank account, gmail etc, and you're set.
To making online security questions real gates. The only places that have my real info are the places that really need it. Even then the answers that I give to the security screen questions are certainly not true.
What is the name of my first pet?
Last three places I worked?
Childhood friend?
Favorite sports team?
Favorite president?
etc.
Anybody that knows the real me and knows the true answers to these questions will not be able to log on to my bank accounts using those "right" answers.
I construct passwords and these answers based on the site name itself and something else that is easy to remember. Using shapes is pretty simple. Things like: my yahoo email password makes a "Y" shape on the keyboard.
Good judgement comes from experience, and experience comes from bad judgement.
- W. Wriston, former Citibank CEO
I recall reading the last few of Arthur C. Clarke's books; he mentioned, a few times, a social movement geared toward intentionally providing misleading and incorrect information about people on the web to provide for a more anonymous society... or at least one where you couldn't find everything out about someone with just a click of a mouse.
I'm actually quite surprised something like that has not actually come into being, because I believe the odds of stopping your info from going online is pretty close to zero. But if you have a bunch of other misleading stuff, at least only you and your friends know what's true and what's not.
It's an interesting concept.
If you can read this... 01110101 01110010 00100000 01100001 00100000 01100111 01100101 01100101 01101011
I googled to find my name on a site called reunion.com along with the last 3 cities I lived in, my brother, father, mother, and live-in ex-girlfriend all associated with my name. Kinda scary when I generally hold tight on my personal information whenever possible.
Ezekiel Running Bear, is that you?
Not if you're signed in to your Google Account, not if you're not signed into your Google Account either! (Whoda thunk it?)
Google will still have the data in their logs, even if the sites you visit don't have it.
Even if you're not signed in, the search will still be tied to your IP address for 18 months, or whatever Google's "anonymisation" policy is.
You could use Scroogle, which claims to store no cookies, and re-route your request through a random IP address out of their pool, but who's to say they'll not keep logs as well?
Only way to be sure is to not even look.
Could you imagine the horror of four mothers in law?
I stopped using my real name after some gay guy started stalking me in an online game. I've been pseudonymous ever since in games, chat and whatnot, except with a handful of people I trust.
You can always make a new pseudonym. You can't start a new life.
Unless you're REALLY good at this game, "Widowhood" is female. (The male is Widowerhood). So, my condolences. Care for a date?
My first Journal Entry ever, in 8 years! http://slashdot.org/journal/365947/aphelion-scifi-fantasy-horror-poetry-webzine
And his pr0n stash. To spare his mother from finding it and being embarassed, obviously.
Only three things are certain; death, taxes, and apocryphal quotations - Ben Franklin.
Hey, pipl found some of my blog posts from 1985! That means I've been posting on the internet for 25 years. All the rest of you are noobs!
I looked up my SSN. Google told me it equaled -1958, and also said look up "More about calculator." Either the web knows I'm in the sciences, or I need to remove the dashes when googling it.
A.
Here in the US, we have government issued IDs. And they're required for plenty of things, especially in person. We don't have the Post Office as part of the system you're referring to, but that's not the biggest problem.
The problem is that there's no possible way to even reasonably verify whether a moron is who they think they are online without having already laid some groundwork. (Like mailing something to prove address) Anything they can know, someone else can know. And as a parent mentioned, the skip-tracing people have AT LEAST as much information as a major credit card you just applied for - available for a couple $.
And the credit reporting agencies and credit companies here want you to be able to get drunk and call up and apply for a credit card and get instant gratification for it with no verification whatsoever...
They ought to have to at least mail you something at the address on your credit report and call you at the phone number on your credit report. If the credit reporting agency wants to do that and setup a secret PIN with you, you could share that secret with a credit card company...
They DO mail your PINs out, so you can't take too much direct cash from a fraudulent app - you can only buy an infinite quantity of goods. So that proves they know how to keep it safe - they just don't value ensuring that you're the right person to give credit to... because the incentives aren't in place.
Looking for freelance Actionscript (Flash/Flex) or ColdFusion work and/or freelance developers. Email me, put Slashdot
OK, so you're precisely demonstrating that the laws protect the service providers and not the individuals.
If an online bank does not even require you to send officially stamped papers to prove your ID, then there's a real problem. Here it would not happen because such a bank would not be paid and would have no resort. That's why they're asking for a lot of papers.
It seems some poeple fear that it would slow the process down, but in fact it would not. How many times a week do you open a bank account ? This is typically the thing which can suffer several days latency for paper verification.