Re:What I'm Telling US Congress about Data Breaches
by PeterisP on Wednesday November 29, 2017 @07:18PM
(#15812193)
Verifying jurisdiction doesn't require you to know the whole address, just the country code and possibly the state.
Verifying if someone is legally an adult doesn't require you to know the exact age and definitely not the birthday, simply "yes" would be sufficient.
Re:What I'm Telling US Congress about Data Breaches
by ChuckMcM on Wednesday November 29, 2017 @07:42PM
(#15812324)
I don't disagree with your analysis, however I have been informed that there are reasons for asking things this way. At a class for booth volunteers for selling alcohol for example we were told to ask for someone's birthday rather than their age. The reasoning in that training was that someone could quickly lie about their age but they had to work at it to back compute a birth date that would fall within the range of legal drinking age and not be ridiculous for someone of their apparent youth.
I am not saying that this is a reason that everyone uses for asking these questions obliquely. I am simply sharing a situation for which I was explicitly told that was the reasoning behind asking the question in that way.
Re:What I'm Telling US Congress about Data Breaches
by vageli on Thursday November 30, 2017 @08:09AM
(#15815410)
There is usually no time constraint when filling out an online form. And I'd imagine the physical nature of the in-person alcohol exchange allows the booth operator to evaluate the physical response of the person being asked. All of this is to say, while I understand the idea in physical exchanges, to me the logic breaks down when I can find a completely valid and full address on Google maps in a couple of seconds (assuming one of the reasons they ask for full address is the difficulty in generating at random a valid address that exists).
Re:What I'm Telling US Congress about Data Breaches
by dingoonline on Wednesday November 29, 2017 @04:55PM
(#15811226)
The data doesn't need to be kept though. It can be requested, checked, verified and erased.
Much better examples would be "Gender" and "telephone number".
I completely agree with the notion that data maximization (or aggregation of meta data associated with a unique ID) are the roots of many evils and risks.