GitHub sued for aiding hacking in Capital One breach

Re:GitHub sued for aiding hacking in Capital One breach by dfcmt on Sunday August 04, 2019 @11:27AM (#20607074)

\w\d{3}[\s\-]?\d{2}[\s\-]?\d{4}\w should not have many wrong results.

You can also try to guess is something is a list of SSNs from the context.

[ Parent | on HN ]

Re:GitHub sued for aiding hacking in Capital One breach by marcinzm on Sunday August 04, 2019 @11:53AM (#20607239)

I'd assume many systems would store SS numbers without spaces or dashes in the backend so that rendering is up to the client. Which means you're looking for 9 digit strings. For example, full zip codes (xxxxx-xxxx) are also 9 digit strings.

[ Parent | on HN ]

Re:GitHub sued for aiding hacking in Capital One breach by greggyb on Sunday August 04, 2019 @01:06PM (#20607776)

I've posted elsewhere in this thread about this. There's really no reason to expect SSNs as strings for internal use. 32bit integers readily represent the same, as the max SSN is just a 9-digit number. I've seen at least one client store SSNs as INTs in a database and handle left-padding to 9 characters and interposing hyphens in display code.

Any 9-digit integers are immediately suspect under this reasonable storage choice.

[ Parent | on HN ]