Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×
Privacy The Internet Your Rights Online

What Web Surfers Can Find Out About You 234

Posted by kdawson from the private-first-class dept.
cweditor writes in with an updated version of a story the likes of which you might have read before, What the Web Knows About You. But reporter Rob Mitchell found out vastly more about himself (his research subject) online than he could have even a year or two ago. The big difference is that state and local governments are putting online digitized records, often with Social Security numbers and other personal details intact. Mitchell ends by questioning how much good it does for banks or credit card companies to require 4, 5, or more independent identity "factors" before providing access to account details, when most or all of the factors they request can be found online about nearly anyone.
This discussion has been archived. No new comments can be posted.

What Web Surfers Can Find Out About You More

What Web Surfers Can Find Out About You

Comments Filter:

  • Bad News (Score:5, Funny)

    by El Torico ( 732160 ) on Tuesday January 27, 2009 @03:47PM (#26627555)

    I googled my name and found 3 obituaries.

    • Re:Bad News (Score:5, Funny)

      by Mr. Sketch ( 111112 ) <`mister.sketch' `at' `gmail.com'> on Tuesday January 27, 2009 @03:50PM (#26627607)

      Well, if google says you're dead three times, who am I to claim otherwise?

      • Re: (Score:3, Funny)

        by siriuskase ( 679431 )

        What's the big deal? Just because you are now dead doesn't mean you never had a life or three.

      • Re:Bad News (Score:5, Funny)

        by geobeck ( 924637 ) on Tuesday January 27, 2009 @04:35PM (#26628269) Homepage

        Phone conversation overheard in a bank:

        "Hello, Mr. Anderson? This is Washington First National Citi Wells Fargo Mutual. I'm afraid we are unable to process your loan request. Well, unfortunately it appears that you're dead. Yes, it is surprising. My sincerest condolences on your recent loss.

        Well, according to your obituaries, you initially died on October 12, 1982, of trauma resulting from a car accident. Wow, that looked like a terrible accident. I hope you didn't suffer too much. Then on February 23, 1997, you were decapitated in an industrial accident... oh, I'm glad to hear you're feeling much better. Except for being dead, of course.

        "Mr. Anderson, no, I'm sorry, we cannot approve a loan to a dead person. You may be feeling fine, but Google says you're dead. Well, killed by an IED in Iraq most recently. 2005? You don't remember being there? Well, that doesn't prove anything because you're dead; I wouldn't expect you to remember it.

        "Mr. Anderson, please calm down. It's not healthy to get so agitated. I mean, it's definitely not healthy to be dead, but there's no need to make matters worse... Yes, as a matter of fact I did find an obit for myself. Died after a lingering coma. Fortunately, it's not a problem, because being brain dead is not an impediment to my line of work. Yes, I'm sorry, please feel free to re-apply when you're not dead. Goodbye."

      • Re: (Score:3, Funny)

        by Frosty Piss ( 770223 )

        Well, if google says you're dead three times, who am I to claim otherwise?

        Isn't that the standard at Wikipedia?

      • Re: (Score:3, Funny)

        by Hognoxious ( 631665 )

        if google says you're dead three times, who am I to claim otherwise?

        Google schmoogle. Did you check netcraft?

    • Re: (Score:2, Funny)

      by morgan_greywolf ( 835522 )

      That's okay. I googled my name and found three wedding announcements! By the end of the next month, I'll be married to four different people!

    • Re:Bad News (Score:5, Interesting)

      by Jason Levine ( 196982 ) on Tuesday January 27, 2009 @04:03PM (#26627801) Homepage

      I googled my name and my site came up #4 in the listing. There were a lot of other people with my name, though. Years back, I didn't see any reason not to use my real name while online. Perhaps I was naive or perhaps it was a simpler online time. Either way, circumstances have changed. I don't want to go about "killing off" my accounts on various sites (like Slashdot) and starting over, but any new sites I sign into I want connected to a username that isn't my real name. It's one reason why I decided to start my new blog under a pseudonym. (No, I'm not posting the pseudonym here. That would link my pseudonym and my real name up in Google listings.)

      • Re:Bad News (Score:5, Interesting)

        by kklein ( 900361 ) on Tuesday January 27, 2009 @05:17PM (#26628863)

        I, too, used to use my real name. Then, time went on, I grew up, mellowed, and suddenly the political screeds I penned in the heady days of youth looked like, um, really bad ideas. And in one case, I was a complete sanctimonious prick and was correctly called out for it...

        I've been on pseudonyms ever since. I have a lot, and they are kind of characters depending on what kind of presence I want to have on that site. Slashdot is the only place where I kinda just speak freely, although this is also a pseudonym.

        • Re: (Score:3, Funny)

          by Anonymous Coward
          I took my anonymity a step further and have pseudonyms for real life, too - the name I use for work is not my real name. It seems to be the only way to have a fully private Private Life.

          It's already taken for granted that actors, writers, porn stars, prostitutes, and Indian call centre staff will use a fake name for work - why not everyone else?

          Hi. I'm Bob.
      • I googled my name, and I was only on one listing, and that was just a page at a company I used to work at. Very little personally identifiable. The rest are all for lots of other people sharing my name... sometimes it's good to be common ;)

      • Re:Bad News (Score:5, Funny)

        by Anonymous Coward on Tuesday January 27, 2009 @05:43PM (#26629279)

        I think we've all made the "mistake" of linking a pseudonym to our given name at some point. Im posting as AC because I can't figure out how to log in on this terminal, but my real name is Jason Levine

    • Re: (Score:2)

      by vlm ( 69642 )

      We have the identity of the fifth cylon!

    • Re: (Score:2)

      by genner ( 694963 )

      I googled my name and found 3 obituaries.

      Your not dead until Netcraft confirms it.

  • ID information available to the public (Score:5, Interesting)

    by LoadWB ( 592248 ) on Tuesday January 27, 2009 @03:51PM (#26627629) Journal

    I have complained about this crap for years to my credit card companies, phone companies, mortgage company, and even my college. How can they claim to protect your account information when their verification questions are all publicly available information? (In the case of the colleges, students are often asked to sign in for roll or exams using a social security number, and that sheet is either passed around or otherwise completely viewable.)

    At least some allow you to select a special pass phrase. Only one of my vendors will not allow me access to the account if I do not provide the pass phrase. Every one else has a way around that.

    Security. Pfah.

    • Re:ID information available to the public (Score:5, Insightful)

      by CannonballHead ( 842625 ) on Tuesday January 27, 2009 @03:57PM (#26627725)

      I'm always surprised that more "secure" websites don't let users use their own security question. It makes no sense to just always use "mother's maiden name" or "city of birth" or whatever. Why can't I use my own security question and pick something that I actually am one of the few people that know (me and maybe my wife or something)?

      I'm not sure adding one more column to a database is going to produce a ton more overhead :)

      • Re: (Score:3, Interesting)

        by siriuskase ( 679431 )

        Just pretend you have two moms. Make up a nice name for your real mom's girlfriend. Maybe even a man's name. Some women have masculine names.

        • Re: (Score:3, Insightful)

          by Attila Dimedici ( 1036002 )
          If you made up a name, how do you remember it 3 years later?

          • Re: (Score:2)

            by Luyseyal ( 3154 )

            Well, the name is sequential based on year so you can guess within a year or two pretty easily. It also has Unicode characters of dubious displayability. And a monkey.

            -l

          • Re:ID information available to the public (Score:5, Insightful)

            by LaskoVortex ( 1153471 ) on Tuesday January 27, 2009 @04:35PM (#26628267)

            If you made up a name, how do you remember it 3 years later?

            The idea is to have a set of false, made up answers that you *always* use to the same old security, so you don't forget them. No one is going to find that stuff on line because it's not affiliated with you except in your imagination. If you are afraid of forgetting your passwords and to remember passwords like "d8u*mF@3KowcCR", use an encrypted password keeper.

            • Re:ID information available to the public (Score:5, Funny)

              by s.bots ( 1099921 ) on Tuesday January 27, 2009 @05:01PM (#26628619)

              If you are afraid of forgetting your passwords and to remember passwords like "d8u*mF@3KowcCR", use an encrypted password keeper.

              Shit, now I have to change all my passwords AGAIN, just like after someone else posted my old one, 09:F9:11:02:9D:74:E3:5B:D8:41:56:C5:63:56:88:C0

            • The idea is to have a set of false, made up answers that you *always* use to the same old security, so you don't forget them. No one is going to find that stuff on line because it's not affiliated with you except in your imagination.

              So it isn't quite publicly available, but it is available to anyone with at least administrative access to the sites you've signed up on and used the same information (and chances are that info gets stored in a cleartext file or at best a database). So if you use the same info at all websites it reduces your security to that of the least secure website you've given the info to.

          • You constantly use it. I have about 3-4 pseudonyms that I use everywhere. First one I flipped through the phone book and pointed to a name. That was my first name. Repeat for last. I use it everywhere.

            Now I have a mysql database full of 2000 census data. I found a website that had it all in CSV, I imported it along with a variable for frequency. So I can decide if I want an obscure name and by gender. It also scrapes Yahoo for an address with someone matching my last name, twice. It then merges the address

          • Re: (Score:2)

            by HiThere ( 15173 )

            Have it tattooed onto your shoulder? That should work, of course, you'd need a mirror to read it.

      • Interestingly enough, I just signed up for online banking with RBC. Not only do they let you choose the security questions, you can't access your account until you've written out three of them (and their intended responses.) I was suitably impressed.

      • Re: (Score:3, Informative)

        by zehaeva ( 1136559 )
        why not just put in a odd answer? for city of birth put the city of your fathers/mothers birth, or the name of your first pet? and for your mothers maiden name your grandmothers maiden name or the city of your birth? or the title of your favorite book, or the name of your favorite author. so long as you know what to substitute all should be fine.

      • Re: (Score:3, Insightful)

        by dkleinsc ( 563838 )

        That's why my mother's maiden name is "f03itncvl102$#(2l$" (for purposes of site logins).

      • why don't you then? My security question is always "What do you listen to to calm you down?"

        Nobody will ever guess my security question... Because my mother's maiden name or my pet's name isn't "Rammstein" (or whatever my answer *really* is...)

      • You can't make up the question, but you can make up the answer... nothing says you have to use REAL information in those questions....

        Most of the time, its none of their business anyway...

    • Re:ID information available to the public (Score:5, Interesting)

      by siriuskase ( 679431 ) on Tuesday January 27, 2009 @03:58PM (#26627735) Homepage Journal

      The secret is that they don't ever check to see if it really is your SS#. they just need a uniquie 9 digit number. Make one up.

      • If you make it up, how do you know that it will be unique?
        • This is a very good question. The immediate answer I've thought of is:

          Things like this usually do have some kind of checksum as the last digit (I know PESEL numbers in Poland do). Make up one with an invalid checksum and pray they do not actually check them (although I know for sure that some of the assigned PESELs have an invalid embedded checksum).

    • Just make an answer up (Score:3, Informative)

      by dfm3 ( 830843 )
      I treat "verification questions" as another password. City of birth? gc5f*kmn. Mother's maiden name? r4#dcViop. And so on. Most institutions don't have a problem with it. And if they do, you can still just use a random word. "Okay, okay, my first pet's name was really Albuquerque."

    • Re: (Score:2, Insightful)

      by Anonymous Coward

      The biggest problem isn't security questions for accounts that you open. For that, you just monitor your statements to ensure that there's nothing on there that wasn't you and it's really simple to dispute a charge.

      The huge gaping security hole is people opening new accounts in your name. It's also a much harder problem to solve since you need a way to prove that you are you without any prior interaction between you and the company and, in most circumstances, without any in-person interaction.

  • Multi-Factor Authentication (Score:5, Interesting)

    by rlp ( 11898 ) on Tuesday January 27, 2009 @03:54PM (#26627679)

    Real multi-factor authentication requires some thought and the expenditure of time and money. Is it any wonder that some banks have implemented extremely LAME (mother's maiden name, pick a picture) versions of two factor authentication. Ideally, it should be (choose at least two): something you know, something you have, and something you are (and perhaps somewhere you are). Something you know is typically an ID / password pair. Something you have can include a one time pad (Gibson's perfect paper password), an RSA dongle, a Yubikey, or even a cell phone (bank sends key as text message). Something you are is biometrics: fingerprint readers, retina readers, etc. (There's an amusing and horrible joke based in this in a "Red Dwarf" episode). Finally, you can have location based authentication: IP / Mac addresses (potentially spoofable), physically secure workstations (with optional armed guard), etc.

    • Re: (Score:3, Insightful)

      by guruevi ( 827432 )

      Actually banks have to keep your money safe to keep your business so they are the ones that implement the best (imho) workable authentication. All banks these days have SSL certificates (I think required by law), they have some sort of picture system where the bank shows you something to authenticate who THEY are (so MITM are more difficult as long as your or their computer isn't compromised) and then they have a username and password which the user is responsible for and a lot of banks are implementing (op

      • And let us not forget 4) not tied to any specific computer architecture or OS. It should be usable from Windows, Linux, FreeBSD, Mac or whatever else you want to use.

      • Re: (Score:3, Informative)

        by bakuun ( 976228 )
        In Sweden, all banks provide a challenge/response - based physical keyfob to their customers, for free. I still find it amazing how bad bank security is in most other countries. Many banks just have passwords... all it takes is a keylogger. Insane.

    • Re: (Score:3, Interesting)

      by twiddlingbits ( 707452 )
      Mulit-factor authentication is NOT expensive (i.e dongles or RSA keyfobs) and doesn't have to be elaborate. I built a credit report site 10 yrs ago that used MFA. We would ask you user name and then based on that we asked the name of a two creditors and an information for each that only you would know and gave your 4 pairs of choices to chose from. For example the amount of your mortgage and the bank plus say your auto loan bank and car make/model, two of those pairs were correct two were false but not obvi

      • Based on your description, your credit-report site used single-factor authentication. You asked for more than one data point, but all the data together amounted to just one factor, something the user knows. It's not multi-factor authentication unless you add something the use has, or is.

        Plus, you were apparently handing out the user's private information before they were authenticated. Sure, it was mixed in with misleading data, but it would still dramatically narrow down the search space for anyone trying

        • At the time this site was built that was considered pretty good security, it passed the checks by the banks and other agencies reporting your credit info into the database the site used. Joe Public isn't going to have a RSA token or such to have a 100% seperate factor! So we used a factor only they would know which was right! Yes it was based solely on user knowledge, as I said there is a balance between usabilty, cost and level of security!

  • pipl (Score:5, Interesting)

    by Finallyjoined!!! ( 1158431 ) on Tuesday January 27, 2009 @03:57PM (#26627713)
    Check it out, you will all be surprised what it will find:

    http://www.pipl.com/ [pipl.com]

    • Sweet! I've lead such a useless existence, pipl isn't able to find anything about me!

    • Holy crap, they know I post on slashdot.

    • Re: (Score:3, Informative)

      by Anonymous Coward

      Not surprising in the least. There are many of these services online and the free ones are little more then goggling your own name if anything.

      OTOH there are pay services like lexis.com and others that i used to use in my skip tracing days. Now with nothing more then a name and a county i could usually get everything from SSN's to VIN numbers of cars you have/do own. DL number's phone number's (including potentially unlisted). Hell itll tell me if your married divorced (with links to the pdf's of the court

    • Re: (Score:2)

      by Darth ( 29071 )

      None of the items it found were me.

    • either it's crap, or I'm in hiding. I checked my real name and found three hits on addresses I haven't lived at for nearly a decade, listings for my parents at addresses they've never lived at, and about 40 hits to other people, and hits to two of the several hundred web pages over the years that have had my name on it. This really isn't helpful for finding me, and I'm not trying to hide - I would think it would be pretty useless against someone actually trying to hide something.

  • Stupid Slashdot. (Score:5, Informative)

    by Creepy Crawler ( 680178 ) on Tuesday January 27, 2009 @03:59PM (#26627741)

    <Page 1>
    Why
    Cant
    You

    <Page 2>
    Provide
    A
    Link

    <Page 3>
    So
    Everything
    is

    <Page 4>
    on
    One
    Page?

    how abut a link here [computerworld.com]

  • Search all you want (Score:5, Funny)

    by MarkusQ ( 450076 ) on Tuesday January 27, 2009 @03:59PM (#26627745) Journal

    Mitchell ends by questioning how much good it does for banks or credit card companies to require 4, 5, or more independent identity "factors" before providing access to account details, when most or all of the factors they request can be found online about nearly anyone.

    Psha. Search all you want, and you'll never discover whether "rw^j8*=1IF9d" is my mother's maiden name, my favorite desert, or where I got my first kiss. And it won't matter anyway, 'cause that's not actually one of the strings I use.

    --MarkusQ

    P.S. And for an added level of security, I'm not really me, nor am I the person I told the bank I was.

    • ... In fact, not only is my name not actually my name nor am I even the person I actually am, I actually don't bank at the bank I have account with. It's all a ruse.

      We should all just go by the name of "Linus."

  • I find it really irritating when a site requires you to give them (made up) personal information when it clearly doesn't need it. That's why Game! [wittyrpg.com] doesn't ask for any personal information whatsoever. Of course, that's probably a drop in the bucket compared to everybody pouring their life into Facebook...

  • It is good SSN becomes totally public (Score:4, Insightful)

    by 140Mandak262Jamuna ( 970587 ) on Tuesday January 27, 2009 @04:17PM (#26627989) Journal
    Social security number has never been designed to be a fool proof identity verification authentication tool. High time the government site get hacked and all the SSNs of ALL Americans are out in the public. Then the onus will be on the banks and others to actually verify people's identity and come up with real authentication mechanisms. Right now it is a joke. Any Tom Dick or Harry can impersonate me if he knows my name and my SSN. How ridiculous is the expectation that I have to take efforts to keep my SSN secret, while the banks and credit issuers have no obligations to check if the applicant is really who he/she says who he/she is?

    What? Anonymous Coward? you dare me to publish my SSN? Get lost. It does not make sense for me to do it alone. But if the entire person-SSN map of all people becomes public, it will actually help us all.

    • Social security number has never been designed to be a fool proof identity verification authentication tool. High time the government site get hacked and all the SSNs of ALL Americans are out in the public. Then the onus will be on the banks and others to actually verify people's identity and come up with real authentication mechanisms. Right now it is a joke. Any Tom Dick or Harry can impersonate me if he knows my name and my SSN. How ridiculous is the expectation that I have to take efforts to keep my SSN secret, while the banks and credit issuers have no obligations to check if the applicant is really who he/she says who he/she is?

      I would also like to see the day that all this gets so out of hand that none of this "personal" data can be used as a legitimate means of identity verification, i.e. when identity theft is not my problem, but the problem of whatever sucker institution failed to do due diligence and was taken by some crook.

      Scratch that -- that day is long past, and nothing has changed. Greasing the wheels of commerce still trumps (what should be) my right to remain blameless and unconcerned when failed morals and policies o

    • Re:It is good SSN becomes totally public (Score:5, Interesting)

      by wtarreau ( 324106 ) on Tuesday January 27, 2009 @05:04PM (#26628661) Homepage

      It's amazing that you Americans have such problems with your identities. I think it is because you don't have an ID card. Here in France, there's no such problem. I can give my SSN to anyone, because it's not used as an authentication system, just identication for a few things. It's written in plain numbers on some non-confidential papers and it causes no problem.

      The reason is that we all have an ID card which is delivered after several controls have been performed. So we all present our ID card to prove our identity when paying by cheque, when we want to take money out of the bank, etc...

      I regularly read about Americans taking care of destroying any ID information they can have so that nobody can reuse it. This sounds so much prehistoric to us out there that almost nobody believes it ! And I think that you're now in a situation where it will be difficult to make people accept the concept of the ID card simply because they will fear that someone somewhere will then know their ID. It's a shame, really.

      Now don't get me wrong. ID stealing also happens here but is very rare because they require that the imitator either has got your ID card and looks exactly like your photo, or that he owns a fake ID card, which happens but is very limited due to the various security items which are not trivial to reproduce for the average Joe around.

      I really hope that in 10-20 years you'll have got out of this archaic system, it's really a shame !

      • Re: (Score:2, Interesting)

        by Anonymous Coward

        Now don't get me wrong. ID stealing also happens here but is very rare because they require that the imitator either has got your ID card and looks exactly like your photo, or that he owns a fake ID card, which happens but is very limited due to the various security items which are not trivial to reproduce for the average Joe around.

        I really hope that in 10-20 years you'll have got out of this archaic system, it's really a shame !

        It is a shame but it doesn't sound like you are in much better shape. Thanks

      • As another poster alluded to, we have ID cards, but they aren't mandatory, and they are given out at the state (rather than federal) level.

        Seems the big problem is that credit card companies, other stores which offer cards, and banks (to a lesser extent) are so eager to give out credit they don't require we use them.

        So I'm not familiar with France... do you really need your physical ID to borrow money? If so, then I would say you do indeed have a more advanced system.

  • they found that most /. posters are bored, self-important, anti-social, regular garden-grade assholes in general, or some combination thereof. Me? I'm more bored and an asshole. Others fit the criteria differently.

  • Inspirational (Score:3, Insightful)

    by DoofusOfDeath ( 636671 ) on Tuesday January 27, 2009 @04:23PM (#26628073)

    Ask not what You can learn from the Web,
    but what the Web can learn from You.

  • Google your SSN? (Score:4, Interesting)

    by damn_registrars ( 1103043 ) * <damn.registrars@gmail.com> on Tuesday January 27, 2009 @04:23PM (#26628091) Homepage Journal
    Do people regularly google their own SSNs? I have contemplated trying mine, but I'm a little apprehensive about where it might end up and what it might get electronically tied to.

    • Re: (Score:2)

      by vlm ( 69642 )

      Dash format 123-45-6789 will return the math result.

      Searching on a nine digit integer will generally provide a few pages where it's used as an internal ID number. For example this slashdot comment had a URL with a SID value of 1106263, now if that were a couple powers of ten larger... someday slashdot UIDs will be nine digits long, etc.

      It is alot of fun to search on your phone number, see what else it's used for in other area codes.

      Searching on dead peoples SS# will probably pull up a social security death

    • Re: (Score:2)

      by skeeto ( 1138903 )
      Just don't directly follow any results. The site you go to gets to see that you did a search for a 9 digit number, what the number was, and because you connected they also have your IP address. An SSN tied to an IP address: that's only ~63 bits of info but can tell them a lot.

      • Not if you're signed in to your Google Account, not if you're not signed into your Google Account either! (Whoda thunk it?)

        Google will still have the data in their logs, even if the sites you visit don't have it.

        Even if you're not signed in, the search will still be tied to your IP address for 18 months, or whatever Google's "anonymisation" policy is.

        You could use Scroogle [scroogle.org], which claims to store no cookies, and re-route your request through a random IP address out of their pool, but who's to say they'

  • It's worse than that (Score:5, Interesting)

    by roc97007 ( 608802 ) on Tuesday January 27, 2009 @05:12PM (#26628785) Journal

    My credit union suddenly adopted an "enhanced security" system where they come up with 10 personal questions (you don't have a choice which ones) and you have to provide answers to each one.

    I looked over the questions, and decided I didn't want anyone knowing that information, even my bank. Called them and asked to opt out of the program. Was told that their system administrator said it was a new federal requirement. (Is this true? I haven't seen this practice at the competing credit union that has my car loan, or at the bank that has my mortgage.) They said it was for my own protection and there was no way to opt out.

    I asked if I could use an additional, randomly generated password instead. (I already used a random string for my main password.) She said no, it had to be personal information.

    I said it was an invasion of privacy and asked them what happens when their system administrator scoops all this personal information for his own use? (That was probably unfair, but I was getting annoyed at that point.) I pointed out that if everyone was required to use this system (which I still hadn't verified), Sysadmin from bank A could take your answers and use them to compromise your accounts B, C and D -- For instance posing as the account owner and answering the "magic question" (which is often a personal question) to reset the account password. She said that she didn't know about that, but I had to live with it.

    I'm willing to bet that the "enhanced security" answers aren't even encrypted.

    So with a little experimentation, I discovered that the "enhanced security" system will take any string as an answer. So, for instance, to the question "what is your maternal grandmother's middle name" (I actually don't know the answer.) you could answer "20382-0qopw" (string was generated by pounding on my keyboard) and the answer will be accepted.

    I also found out that you could put random strings (or a rude phrase) for each answer, or use the same passphrase for every answer, and the system will accept it.

    This opened whole new vistas of "security".

    So, for my daughter's account, which doesn't have much to lose, I set all her "enhanced security" questions to the same passphrase, (you will never guess it, don't even try) and set up different passphrases for each security question for my accounts.

    One big win to making up your answers is that a bad guy can't use the information to break into accounts in other institutions. Even if it's sold to a third party or published on the internet, the information only works with that one account. Moreover, there's no way someone can research my family history and come up with "asawi0egh" for my mother's maiden name. (Again, generated by slapping the keyboard a few times.)

    In other words, don't buy into it. Treat it as just another password that you make up yourself.

    How does one keep track of all these passwords? Find a secure password keeper application and use it religiously. Sourceforge is a good place to look. Some even work on PDAs.

    • Re: (Score:2)

      by Eberlin ( 570874 )

      So, for my daughter's account, which doesn't have much to lose, I set all her "enhanced security" questions to the same passphrase, (you will never guess it, don't even try)

      1234 what do I win?

    • One big win to making up your answers is that a bad guy can't use the information to break into accounts in other institutions. Even if it's sold to a third party or published on the internet, the information only works with that one account. Moreover, there's no way someone can research my family history and come up with "asawi0egh" for my mother's maiden name. (Again, generated by slapping the keyboard a few times.)

      We must be related.

    • Re: (Score:2)

      by mgblst ( 80109 )

      So with a little experimentation, I discovered that the "enhanced security" system will take any string as an answer.

      Really? So you discovered that the program doesn't actually know this personal information about you? And it can't actually tell the difference between a normal grandmas name, and a random string? So you figured out that the system wasn't actually AI alive? Congratulations.

      • Re: (Score:3, Informative)

        by roc97007 ( 608802 )

        Oh, don't be like that.

        Let me give you an example. When I got my American Express corporate card, part of the activation process was to create a PIN. The process is done through a voice menu system. The message suggests that you use your mothers birthdate (month and day).

        My intention was to make the PIN a random four digit string. Turns out the system would not accept a four digit string that was not a valid month and day. They actually had software in place to make sure you didn't pick the 32nd o

  • Ummm, I'm confused... do I Google my birth name or one of my too-numerous-to-mention split cyber-personalities?

  • I find it quite odd that this article was written by Bob Mitchell. Usually when someone writes about how they've discovered that google knows everything about them, the byline is something like Corvus McLazerpants. Although I don't personally know of this guy, I'm guessing that he must be popular enough that the other few thousand Bob Mitchells of the world providing chaff for him have an insufficient pagerank to be effective.

  • Times Changes (Score:5, Insightful)

    by olddotter ( 638430 ) on Tuesday January 27, 2009 @05:59PM (#26629553) Homepage
    I used to think that people who were afraid to give out their SSN probably also slept with tinfoil hats on. Now I only give it to companies that have to report something to the IRS. If someone isn't reporting income to the IRS, they don't need a SSN.

    • Re: (Score:2, Informative)

      by KPexEA ( 1030982 )
      We have a small mail-order business in Canada selling die-cast model cars and if a US customer orders over $200 worth of model cars, we need to supply Fedex their SSN so they can pass that along to Homeland Security so the shipment can clear US customs. We do get a fair number of customers who refuse, but there is nothing we can do about it, most of our long-term customers don't have a problem with it.

  • If you want real privacy (Score:4, Funny)

    by extrasolar ( 28341 ) on Tuesday January 27, 2009 @06:12PM (#26629761) Homepage Journal

    I don't usually have these problems. Just use someone else's identity, bank account, gmail etc, and you're set.

  • FOSS (of sorts) Anonymizer Service (Score:4, Interesting)

    by religious freak ( 1005821 ) on Tuesday January 27, 2009 @06:38PM (#26630139)
    I recall reading the last few of Arthur C. Clarke's books; he mentioned, a few times, a social movement geared toward intentionally providing misleading and incorrect information about people on the web to provide for a more anonymous society... or at least one where you couldn't find everything out about someone with just a click of a mouse.

    I'm actually quite surprised something like that has not actually come into being, because I believe the odds of stopping your info from going online is pretty close to zero. But if you have a bunch of other misleading stuff, at least only you and your friends know what's true and what's not.

    It's an interesting concept.

Slashdot Top Deals

"Protozoa are small, and bacteria are small, but viruses are smaller than the both put together."

Close