What Web Surfers Can Find Out About You 234
cweditor writes in with an updated version of a story the likes of which you might have read before, What the Web Knows About You. But reporter Rob Mitchell found out vastly more about himself (his research subject) online than he could have even a year or two ago. The big difference is that state and local governments are putting online digitized records, often with Social Security numbers and other personal details intact. Mitchell ends by questioning how much good it does for banks or credit card companies to require 4, 5, or more independent identity "factors" before providing access to account details, when most or all of the factors they request can be found online about nearly anyone.
Facebook (Score:1, Interesting)
I have a mostly blank facebook account just because some people I know use it.
Since date of birth is so widely (mis)used as a security question, I use a false dob and people often wish me happy birthday a week or so before it actually is.
ID information available to the public (Score:5, Interesting)
I have complained about this crap for years to my credit card companies, phone companies, mortgage company, and even my college. How can they claim to protect your account information when their verification questions are all publicly available information? (In the case of the colleges, students are often asked to sign in for roll or exams using a social security number, and that sheet is either passed around or otherwise completely viewable.)
At least some allow you to select a special pass phrase. Only one of my vendors will not allow me access to the account if I do not provide the pass phrase. Every one else has a way around that.
Security. Pfah.
Multi-Factor Authentication (Score:5, Interesting)
Real multi-factor authentication requires some thought and the expenditure of time and money. Is it any wonder that some banks have implemented extremely LAME (mother's maiden name, pick a picture) versions of two factor authentication. Ideally, it should be (choose at least two): something you know, something you have, and something you are (and perhaps somewhere you are). Something you know is typically an ID / password pair. Something you have can include a one time pad (Gibson's perfect paper password), an RSA dongle, a Yubikey, or even a cell phone (bank sends key as text message). Something you are is biometrics: fingerprint readers, retina readers, etc. (There's an amusing and horrible joke based in this in a "Red Dwarf" episode). Finally, you can have location based authentication: IP / Mac addresses (potentially spoofable), physically secure workstations (with optional armed guard), etc.
pipl (Score:5, Interesting)
http://www.pipl.com/ [pipl.com]
Re:ID information available to the public (Score:5, Interesting)
The secret is that they don't ever check to see if it really is your SS#. they just need a uniquie 9 digit number. Make one up.
Re:ID information available to the public (Score:3, Interesting)
Just pretend you have two moms. Make up a nice name for your real mom's girlfriend. Maybe even a man's name. Some women have masculine names.
Re:Bad News (Score:5, Interesting)
I googled my name and my site came up #4 in the listing. There were a lot of other people with my name, though. Years back, I didn't see any reason not to use my real name while online. Perhaps I was naive or perhaps it was a simpler online time. Either way, circumstances have changed. I don't want to go about "killing off" my accounts on various sites (like Slashdot) and starting over, but any new sites I sign into I want connected to a username that isn't my real name. It's one reason why I decided to start my new blog under a pseudonym. (No, I'm not posting the pseudonym here. That would link my pseudonym and my real name up in Google listings.)
Google your SSN? (Score:4, Interesting)
Re:It is good SSN becomes totally public (Score:5, Interesting)
It's amazing that you Americans have such problems with your identities. I think it is because you don't have an ID card. Here in France, there's no such problem. I can give my SSN to anyone, because it's not used as an authentication system, just identication for a few things. It's written in plain numbers on some non-confidential papers and it causes no problem.
The reason is that we all have an ID card which is delivered after several controls have been performed. So we all present our ID card to prove our identity when paying by cheque, when we want to take money out of the bank, etc...
I regularly read about Americans taking care of destroying any ID information they can have so that nobody can reuse it. This sounds so much prehistoric to us out there that almost nobody believes it ! And I think that you're now in a situation where it will be difficult to make people accept the concept of the ID card simply because they will fear that someone somewhere will then know their ID. It's a shame, really.
Now don't get me wrong. ID stealing also happens here but is very rare because they require that the imitator either has got your ID card and looks exactly like your photo, or that he owns a fake ID card, which happens but is very limited due to the various security items which are not trivial to reproduce for the average Joe around.
I really hope that in 10-20 years you'll have got out of this archaic system, it's really a shame !
It's worse than that (Score:5, Interesting)
My credit union suddenly adopted an "enhanced security" system where they come up with 10 personal questions (you don't have a choice which ones) and you have to provide answers to each one.
I looked over the questions, and decided I didn't want anyone knowing that information, even my bank. Called them and asked to opt out of the program. Was told that their system administrator said it was a new federal requirement. (Is this true? I haven't seen this practice at the competing credit union that has my car loan, or at the bank that has my mortgage.) They said it was for my own protection and there was no way to opt out.
I asked if I could use an additional, randomly generated password instead. (I already used a random string for my main password.) She said no, it had to be personal information.
I said it was an invasion of privacy and asked them what happens when their system administrator scoops all this personal information for his own use? (That was probably unfair, but I was getting annoyed at that point.) I pointed out that if everyone was required to use this system (which I still hadn't verified), Sysadmin from bank A could take your answers and use them to compromise your accounts B, C and D -- For instance posing as the account owner and answering the "magic question" (which is often a personal question) to reset the account password. She said that she didn't know about that, but I had to live with it.
I'm willing to bet that the "enhanced security" answers aren't even encrypted.
So with a little experimentation, I discovered that the "enhanced security" system will take any string as an answer. So, for instance, to the question "what is your maternal grandmother's middle name" (I actually don't know the answer.) you could answer "20382-0qopw" (string was generated by pounding on my keyboard) and the answer will be accepted.
I also found out that you could put random strings (or a rude phrase) for each answer, or use the same passphrase for every answer, and the system will accept it.
This opened whole new vistas of "security".
So, for my daughter's account, which doesn't have much to lose, I set all her "enhanced security" questions to the same passphrase, (you will never guess it, don't even try) and set up different passphrases for each security question for my accounts.
One big win to making up your answers is that a bad guy can't use the information to break into accounts in other institutions. Even if it's sold to a third party or published on the internet, the information only works with that one account. Moreover, there's no way someone can research my family history and come up with "asawi0egh" for my mother's maiden name. (Again, generated by slapping the keyboard a few times.)
In other words, don't buy into it. Treat it as just another password that you make up yourself.
How does one keep track of all these passwords? Find a secure password keeper application and use it religiously. Sourceforge is a good place to look. Some even work on PDAs.
Re:Bad News (Score:5, Interesting)
I, too, used to use my real name. Then, time went on, I grew up, mellowed, and suddenly the political screeds I penned in the heady days of youth looked like, um, really bad ideas. And in one case, I was a complete sanctimonious prick and was correctly called out for it...
I've been on pseudonyms ever since. I have a lot, and they are kind of characters depending on what kind of presence I want to have on that site. Slashdot is the only place where I kinda just speak freely, although this is also a pseudonym.
Re:Multi-Factor Authentication (Score:3, Interesting)
FOSS (of sorts) Anonymizer Service (Score:4, Interesting)
I'm actually quite surprised something like that has not actually come into being, because I believe the odds of stopping your info from going online is pretty close to zero. But if you have a bunch of other misleading stuff, at least only you and your friends know what's true and what's not.
It's an interesting concept.
Re:It is good SSN becomes totally public (Score:2, Interesting)
Now don't get me wrong. ID stealing also happens here but is very rare because they require that the imitator either has got your ID card and looks exactly like your photo, or that he owns a fake ID card, which happens but is very limited due to the various security items which are not trivial to reproduce for the average Joe around.
I really hope that in 10-20 years you'll have got out of this archaic system, it's really a shame !
It is a shame but it doesn't sound like you are in much better shape. Thanks to our underage drinking laws, we have just about the most advanced ID-faking equipment and skilled artisans in the world (aka, teenagers). An ID card doesn't help much online or for setting up automatic payments. Most establishments with which I do business never see me nor do I see them.
There is no getting around the need for a LAP (long-ass password).
Re:It's worse than that (Score:2, Interesting)
Well you seem to have figured out the secure way to answer the security questions: use a psuedo-identity.
Make up a fake persona and use that as the basis for all of the answers. Even if someone discovers your mother's maiden name, they won't know about the mother that's all in your head.
Re:It's worse than that (Score:3, Interesting)
Agreed, but for it to be effective, you have to make up a different fake persona for each account. You certainly wouldn't want to use the same fake persona for multiple accounts. That would only mean that the police wouldn't know whom to notify when "Norm D. Plume" got completely cleaned out.