Slashdot Mirror
What Web Surfers Can Find Out About You
cweditor writes in with an updated version of a story the likes of which you might have read before, What the Web Knows About You. But reporter Rob Mitchell found out vastly more about himself (his research subject) online than he could have even a year or two ago. The big difference is that state and local governments are putting online digitized records, often with Social Security numbers and other personal details intact. Mitchell ends by questioning how much good it does for banks or credit card companies to require 4, 5, or more independent identity "factors" before providing access to account details, when most or all of the factors they request can be found online about nearly anyone.
I'm always surprised that more "secure" websites don't let users use their own security question. It makes no sense to just always use "mother's maiden name" or "city of birth" or whatever. Why can't I use my own security question and pick something that I actually am one of the few people that know (me and maybe my wife or something)?
I'm not sure adding one more column to a database is going to produce a ton more overhead :)
If you made up a name, how do you remember it 3 years later?
The truth is that all men having power ought to be mistrusted. James Madison
What? Anonymous Coward? you dare me to publish my SSN? Get lost. It does not make sense for me to do it alone. But if the entire person-SSN map of all people becomes public, it will actually help us all.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
Ask not what You can learn from the Web,
but what the Web can learn from You.
Actually banks have to keep your money safe to keep your business so they are the ones that implement the best (imho) workable authentication. All banks these days have SSL certificates (I think required by law), they have some sort of picture system where the bank shows you something to authenticate who THEY are (so MITM are more difficult as long as your or their computer isn't compromised) and then they have a username and password which the user is responsible for and a lot of banks are implementing (optional for now, required for certain transactions) an RSA-keyfob-like structure (whether it be on your cellphone or they charge you for a keyfob) where you get a one-time generated key that is valid for less than 10 minutes. Some accounts (>10.000) get that stuff for free.
Sure you can think of more safe versions of the above but in the end it has to be 1) usable by the very people we hate so much: Computer Illiterate Users 2) affordable for the common man (a free checking account with less than $100 in doesn't even cover the costs to provide online banking let alone extra's) 3) not drive customers away because of reason 1 or by being so complicated or expensive nobody wants to use it.
Custom electronics and digital signage for your business: www.evcircuits.com
If you made up a name, how do you remember it 3 years later?
The idea is to have a set of false, made up answers that you *always* use to the same old security, so you don't forget them. No one is going to find that stuff on line because it's not affiliated with you except in your imagination. If you are afraid of forgetting your passwords and to remember passwords like "d8u*mF@3KowcCR", use an encrypted password keeper.
Just callin' it like I see it.
That's why my mother's maiden name is "f03itncvl102$#(2l$" (for purposes of site logins).
I am officially gone from
The biggest problem isn't security questions for accounts that you open. For that, you just monitor your statements to ensure that there's nothing on there that wasn't you and it's really simple to dispute a charge.
The huge gaping security hole is people opening new accounts in your name. It's also a much harder problem to solve since you need a way to prove that you are you without any prior interaction between you and the company and, in most circumstances, without any in-person interaction.
I used to think that people who were afraid to give out their SSN probably also slept with tinfoil hats on. Now I only give it to companies that have to report something to the IRS. If someone isn't reporting income to the IRS, they don't need a SSN.
Think Deeply.