Hacker Newsnew | past | comments | ask | show | jobs | submit | dandelany's commentslogin

This was once common but is exceedingly rare these days. I'm sure exceptions exist, but nearly all Americans now treat this as a Very Secret Number.

Secret... But generatable since 2009. [0] 2011 randomisation slightly reduced the risk, but not by much.

As many as 1 in 7 SSNs may have been accidentally used by more than one person. [1]

Unlike Australia's TFN or the UK's VAT, SSN has no self-check, making it rather easy to just... Generate one that works.

And all an API check of the number will tell you, is what an attacker would already have: DOB and Place of Birth.

[0] https://pnas.org/doi/full/10.1073/pnas.0904891106

[1] https://www.nbcnews.com/technolog/odds-someone-else-has-your...


> nearly all Americans now treat this as a Very Secret Number

I don't think that they actually do in practice. Last time I opened an account with Comcast they required your social security number. Same with an AT&T cell plan.


Last time I opened an account with Comcast they required your social security number. Same with an AT&T cell plan.

Strictly speaking they require /a/ Social Security Number, not necessarily /your/ SSN.

When I signed up for my most recent cellular service, I hesitated at giving my information to the guy in the store. I told him that since it was a pre-paid account I wasn't asking for credit, so there's no need for him to have my information.

He was OK with that, and pulled out an ID card the store keeps in a drawer for just such occasions.

Salespeople have a sales quota, not an enforce-the-rules quota.


Same when I visited Germany, every phone account needs your name and address and passport number to prevent spam, I bought a prepaid card, since I don't live there I don't have an address, so he used the address of the store. Still needed a passport though.

I applied for my first credit card at a desk they had set up in front of the school. No SSN. When I entered my income (non existent), guy went "no man.. come on. put this amount. hey'll never give you a card with that". Week later I received the card with my name misspelled and everything. (I still see that misspelled name EVERYWHERE when I search for my name)

Probably something to do with checking credit history right?

I'm not sure people treat this as a Very Secret Number. Certainly using SSNs publically has gone away, but people are willing to provide their SSNs to basically anyone that asks for it. Heck, some job applications ask for your SSN.

*Super Secret Number

LOL.

Every single $&@ doctor's intake form: "We'd like to have you SSN".


Yes, I have seen doctors and dentists ask for the SSN, and categorically refuse to provide it.

Unless you personally are nearly all Americans, good for you, but not relevant to OPs post about "Very Secret Number"

And none of them have ever complained when I left if blank.

I've seen forms that explicitly say to put in all nines if you "don't have one", so that's what I do everywhere that insists on asking but doesn't have a legitimate purpose (ie tax reporting). To any human it should be obvious that all nines indicates an exception.

The property you are talking about is generally called "deniability" in the literature, whereas the GP is talking "verifiability" ie. being able to verify your own vote is cast correctly. They are both valuable, sometimes mutually exclusive, but not necessarily, see eg. https://petsymposium.org/popets/2024/popets-2024-0021.pdf


Like most things, guessing and proving require vastly different efforts. In aviation, a few more orders of magnitude than most.


You’re overthinking it. “Country” is simply more ambiguous when used as an adjective. “F5 announces attack from country hackers” sounds silly and confusing.


"F5 announces hack by foreign country" (or the infinite variations of) is less silly than "F5 announces attack from nation-state hackers", you're just used to hearing the latter repeated every incident. Anyone can intentionally use a phrase poorly, pointing out a silly sounding phrasing exists adds nothing.

Not that "F5 announces attack by state sponsored hackers", "F5 announces attack by nation-state backed hackers", or "F5 announces attack from nationally backed hackers" have to be invalid, particularly since the latter is often what is actually most specifically correct anyways.


yeehaw brother


I suspect they also empirically have less price-sensitivity on average, for a variety of reasons


As opposed to what we have now?


Yes - things could get worse from the status quo.

At the moment, ad networks don't pay for bot impressions when detected - so content farms tend to optimize for what passes for humans. All bets are off if human and bot visitors offer the same economic value via miners, or worse if it turns out that bots are more profitable due to human impatience.

Imagine an internet optimized for bot visitors, and indifferent to humans. It would be a kind of refined brainrot aimed at a brainless audience.


"Simple stochastic blob detection" is an abstraction. You write (or import) a function where the the gnarly logic lives and call `detectBlobs()`. "Use an abstraction" doesn't mean you should use the same abstraction for every task, you should use the right tool for the job.


He didn't "do it", he was one voice among many astronomers who have been calling for a reclassification for years, the IAU voted and made the decision. It's a little silly calling him out for "doing it" for ego reasons when you are the one implicitly giving him credit for it... He didn't write the definition, he didn't chair the committee, he wasn't even on the committee. All he did was leave it off the list of planets at the Hayden Planetarium, where he was director.


…you realize this happened nine years ago, right?


Is it still trespassing if the door was unlocked? Yes. Not sure why so many people have trouble applying the same principles of unauthorized access to computers.


The interesting bit is that social expectations matter.

There is a social expectation that people can generally only enter your home with explicit permission, and so if they didn't invite you it's trespassing even if the door is unlocked. But maybe you have some close friends who you get used to coming over and just entering even if you may be out at the moment -- and then it's not trespassing anymore.

Remote computer access is a much younger phenomenon than people living in houses, and so social expectations aren't as established. There's a legitimate need for discussion there.

For example, if you have an open webserver that you want people to access, is it trespassing if people fiddle a little with the URLs and encounter documents that you didn't mean to put out there? I'd argue it would make for a healthier and more tech-savvy society if we didn't consider that trespassing.

If we try to push the houses analogy further, it's a bit like inviting people into your house for a big party, and then somebody enters a room that you didn't want them to enter. It's a faux-pas, but you'd probably also have a hard time if you tried to label it trespassing.


There are echoes to discussions a few months ago about IMG_0001.

https://news.ycombinator.com/item?id=42314547

The site displays random, ancient videos uploaded from the early iPhone YouTube app, often without people understanding what they were doing.

I tend to err on the side of caution: I don't expect most people to be tech savvy, and I think those of us who are must exercise restraint to avoid trespassing.


I actually agree with you, but the point is the balance.

Don't steal. Don't share embarrassing or humiliating information you may come across.

At the same time, there should be safety from prosecution overreach.

I ask for this mostly not for my current self but for "kids" (including young adults, e.g. college students) who are on a hacker journey in the original sense of the word. As a society, we should encourage rather than stifle that sort of exploration.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: