News for hackers. Stuff that matters.

A comment on Tell HN: Salary data is for sale. Parent comment

Re:Tell HN: Salary data is for sale by cmeacham98 on Friday January 07, 2022 @12:15AM (#29835259)
Unless you are very young (read: born after 2011) your SSN can be trivially brute forced if an attacker knows where and when you were born, because those details were (before 2011) mapped onto 5 of the 9 digits in an SSN.
[ Parent | on HN ]
Re:Tell HN: Salary data is for sale by throwawayboise on Friday January 07, 2022 @12:50AM (#29835466)
You should assume your SSN is public anyway. There have been so many leaks, and it's not like a credit card where you get a new number if it is compromised.
[ Parent | on HN ]
Re:Tell HN: Salary data is for sale by drewcoo on Friday January 07, 2022 @04:05AM (#29836823)
Because it was intended as an identifier, not as a secret. The financial industry couldn't tell the difference between the two so now everyone tries to hide their IDs.
[ Parent | on HN ]
Re:Tell HN: Salary data is for sale by MertsA on Saturday January 08, 2022 @06:48AM (#29850777)
>The financial industry couldn't tell the difference between the two so now everyone tries to hide their IDs.

What's sad and funny is that the login page for "The Work Number" quite literally uses the following for their username field.

<input name="txtUsername" type="password" maxlength="256" id="txtUsername">

[ Parent | on HN ]
Re:Tell HN: Salary data is for sale by diggernet on Friday January 07, 2022 @03:08PM (#29844051)
It wasn't even intended as an identifier. It's just an account number. "NOT FOR IDENTIFICATION".

https://media.istockphoto.com/photos/social-security-card-pi...

[ Parent | on HN ]
Re:Tell HN: Salary data is for sale by dhosek on Friday January 07, 2022 @12:35AM (#29835377)
More accurately where you were born and when your SSN was issued (my brothers who are four years older than me got their SSNs at the same time I did). Some of us older folks were born in an era in which you didn't automatically get an SSN along with the birth certificate. And then there are people who weren't born in the US so will have had their SSN not matching birth year.

I also think it's less than 5 of the 9 digits that are reflected in this manner. That would not leave room for a lot of distinction in SSNs.

[ Parent | on HN ]
Re:Tell HN: Salary data is for sale by kevin_thibedeau on Friday January 07, 2022 @01:15AM (#29835627)
The first three digits are allocated in blocks to each state.
[ Parent | on HN ]
Re:Tell HN: Salary data is for sale by gzer0 on Friday January 07, 2022 @03:43AM (#29836639)
https://www.ssa.gov/employer/stateweb.htm

I'm guessing this is not a good thing if I am under the [NOT ISSUED] category but am definitely in the issued category?

[ Parent | on HN ]
Re:Tell HN: Salary data is for sale by peoplefromibiza on Friday January 07, 2022 @08:05AM (#29838626)
In Italy you don't even need to brute force them, you can generate them because the algorithm is public.

Except same rare case of same name, same birthday, same place of birth, the generated code is always valid.

https://en.wikipedia.org/wiki/Italian_fiscal_code

[ Parent | on HN ]
Re:Tell HN: Salary data is for sale by olliej on Friday January 07, 2022 @01:32AM (#29835750)
Hate to break it to you but that’s 21 year olds now :)

[edit: so I program for a living. you'd think I know how to subtract to integers??? I /assume/ I read 2001? at least I hope I did]

[ Parent | on HN ]
Re:Tell HN: Salary data is for sale by resonious on Friday January 07, 2022 @01:56AM (#29835907)
You mean 11? This freaked me out for a sec.
[ Parent | on HN ]
Re:Tell HN: Salary data is for sale by e-dt on Friday January 07, 2022 @01:55AM (#29835900)
2022 - 2011 = 11, not 21.
[ Parent | on HN ]