Hacker News Reader

> Ad Tech companies don't want your SSN

Where do you get that idea? All they doin the background is to deanonymize as much data as they can get. Why do you think they would not actually want this ultimate deanonymizer of US citizens?

I'm with you on this one Dylan. Of course they do.

I feel like SSN is a big liability with little benefit over a different primary key like your phone number. SSN would be important if you're signing a mortgage, but these people are tracking how often you buy dogfood and pregnancy tests.

SHA256(<ssn>) ...there, boom, tracking with no liability. These slimy companies will grab every piece of data they can.

The article discusses hashing being an inadequate method of anonymization.

Considering that there are only 1 billion possible SSNs, that seems like it would be easily reversible simply by pre-computing a lookup table of all 1 billion hashes.

> I feel like SSN is a big liability with little benefit

Your feelings on the matter are quite irrelevant -- they want every bit of data about your financial life as possible. Including your mortgage, income, etc. The SSN it the ultimate primary key. You can't even get a new one if your identity is stolen. The more often they can link that to an email address, phone number, etc, the stronger the signal they get from sources that only have those bits.

Phone numbers change all the time. Some people have more than 2 phones. Phone numbers tied too names become less trustworthy when names change.

The reason an SSN exists is the same reason why it is one of the the best identifiers of a person in the US.

Nation state and domestic hackers look for these as a highly prized commodity for this reason as well. They can be used to find other records containing people. You may recall the Chinese hackers who exfiltrated the SSNs of US military personnel not too long ago.

Because they don't like regulatory costs of storing/using sensitive data e.g. legal costs, compliance requirements etc ( if not now, requirements that come up in the future). One can get the exact same utility by generating a user identifier themselves instead - user logins, device info, ip, usage pattern etc should give all the info needed. More over these companies operate in multiple countries.

I know of a local company that collected personal data for marketing including SSNs and there is no care given to how the data is stored. Most if not all of it was stored in plain text. You might have more faith in regulatory systems than you should.

> You might have more faith in regulatory systems than you should.

I don't. What I do have faith in us companies to have a profit motive and work in favor of self preservation. And that comes with reducing risk for the company.

An example of a local company with bad security practices due to negligence or malice is no evidence of a publicly traded big tech company wanting to do the same.

and what is your description of facebook?

You may want to look into the histories of equifax, transunion et al. Not local businesses and definitely repeatedly guilty of this flavor of transgression.

A local company with bad security practices does not, at its core, make money by collecting user data. The collection of that data and the security or insecurity of its storage is pretty much orthogonal to the central business of every company in the world except for tech companies that sell consumer data.

Hence, the dictum "don't ascribe malice where incompetence would suffice" doesn't carry across these two different classes of organizations.

Is Equifax not a publicly traded enough big tech company for you, or do you just not read the news?

This subthread is about, or at least started out when I initially responded as - adtech using ssn as an user identifier. I responded to that. I didn't intend to make any claims about anything else. Equifax is not adtech and is explicitly in the business of collecting ssn and related data.

> Equifax is not adtech

Equifax is absolutely adtech. Their data is sold used by advertisers all the time. You can make changes to elements of your credit report using techniques widely available on YouTube and watch the spam and junk mail you receive change.

Literally no adtech company would accept or attempt to target based on SSN.

Maybe your local company was collecting it out of ignorance, but if they uploaded it to google adsense, alarm bells would go off, the data would be purged, and you'd seriously risk having your account shut down.

Why not hash it and simply store it for future cross check while still being technically compliant?

There's no simple "compliant" checkbox here. It's a balance of risks, since there's no single regulatory PII-management regime.

And in this case, it's a huge toxic liability that adds almost no value over an email address.

SSNs can’t really be anonymized by hashing since they’re essentially sequential numbers. I think the law is at least broad enough to consider a hashed SSN that can be easily reversed to be to equivalent to a real SSN.

I agree with others that adtech companies want to proactively avoid SSNs. Too much liability and not at all necessary.

To clarify, this is one of the must common and dangerous misconception regarding hashing: a SSN is a 9-digit number. Regardless of the strength of your hash, you can hash them all, and compute a lookup table, in a matter of minutes.

You don’t have to hash it so it’s not reversible only such that you don’t appear liable in the event of an incident. Technically compliant is good enough

My point is that hashing a 9 digit number is almost certainly not even technically compliant. I believe storing hashed SSNs would incur all the legal liability of storing raw SSNs. The laws are robust enough to at least handle such a trivially reversible hash. No way any expert witness could claim otherwise. Hashed emails on the other hand seem like more of a gray zone (some are reversible, but there's enough variety that not all are).

for a fun "challenge", here's my md5 hashed SSN: 46fdccf9acc38d13321b0c13cf541ec9 (spoiler: not my real SSN, but since they're sequential it could be someone's. And, hint, I'd be jealous of them.)

Bro, you're commenting on a story where SSNs were uploaded to Google Adsense, alarm bells didn't go off, data wasn't purged, and a journalist came in and discovered the problem later.

> But while tax-filing websites were quick to stop collecting data, nobody's sure how much information was collected. One unnamed company told Congress that "every single taxpayer who used their websites could have had at least some of their data shared."

There is literally no evidence what you said is true. There are no details what information was shared. Can you avoid making stuff up?

I assumed everyone has looked at a tax form in their life and has an idea of what information they contain.

> Literally no adtech company

Do you mean this in the autoantonym sense? Because literally Meta did exactly this.

"local company" being the problem. Local/small companies do not care at all about this kind of thing. Google's perniciousness is being about to follow the letter of the law while still getting what they want, not flagrantly ignoring it.

Given the authentication services they provide, I suspect this is already a bar they reach. The point about future compliance makes me think about the floundering “You shouldn’t have made an account with us!” while they made their services compliant with GDPR.

I would expect they’d be eager to have this information and would not consider it to be a liability in the slightest.

I worked at a massive adtech company and we had our own unique ID for each "entity". All other data was gathered with cookies and some sort of compaction/merging algorithm. What would we do with the social? Run a credit report on every single one then only show ads to those people? Re run it every so often for updates?

I wasn't a developer but we already had income estimate by looking at past purchases, location, sites that the person looked at, etc. It wasn't super accurate but enough to know whether someone should see a Fendi bag

Ha well a nice strong fine then to discourage this stupid behavior of adding tracking scripts from 3rd party fines. I’d still like to see the executive that approved this spend 1 night in jail to prove a point that stupid has personal consequences

> a nice strong fine

Who receives the fine?

* The Tax Prep companies? That would be fair: they are obligated to handle private user data in a responsible manner

* The ad tech companies? That would not be fair: they didn't want the data, didn't know it was being sent, and almost assuredly didn't use it for any kind of ad serving, measurement, or optimization.

> The ad tech companies? That would not be fair

If I send you a video camera and tell you to put it in your retail store and stream me the video and you put in your changing room and send me the data and I don't tell you to stop, am I free from liability?

If you were doing that to millions of people and automatically analysing the video streams you get back for general trends then you wouldn’t really have a way to know that’s happening

Yep so maybe massive fines and jail time would be a good deterrent

I certainly hope I'm free from liability from you sending me illegal videos of naked people unless I've explicitly requested illegal videos of naked people.

More to the point, if companies are required to forensically analyse the hashes sent to their API endpoints to check they haven't received anything sensitive, the internet in its modern form would essentially cease to exist.

What if your app sucks up all the data from my phone without consent and you get my nudes? I’d like to claw back your bonus for that at the very least

> and I don't tell you to stop

Alternate analogy: an IoT thermometer vendor sells you a device to track temperature in your room, but you decide to stick it up someone's butt. Will the IoT vendor know the temperature reading is personal and rectal? Should they be held liable for not proactively attempting to scrub-out numbers which may represent gluteal climate?

It seemed flawed on first reading but I think this analogy holds if one assumes (for the sake of argument) that it’s Definitely Illegal to be accepting these readings. It would be pretty hard to be sure about filtering out arbitrary strings of numbers (ie SSN) when one is also intending to accept such strings.

Why not? Software has consequences and we need to hold people accountable for moving fast and breaking laws. We don’t but we should.

Here is a fun question. What law has been broken?

It seems like the claim is Internal Revenue Code §7216

Thanks! It will be interesting to see how this plays out. In the case of software the user is the one preparing the return and not the software itself. Although people using software on behalf of someone else would be guilty.

I am almost certain Meta has some basic filtering in place to make sure they aren't storing, say, obvious credit card numbers, SSNs, etc. So I would say they're open to at least a little liability if they failed to match on financial info.

It should be treated like any other illegal purchase, the seller and buyer gets brought to justice.

Try telling a cop that you didn't mean to buy fentanyl with your other illegal drugs.

I'm not sure jailing the low level employee that pasted some javascript into a footer template, or the low level employee that sent them the link with an email saying "this is the script we need to add to our signup flow" is going to achieve very much.

This stuff happens because there isn't an exec approval process...

Then make an example and disband the company and all shareholders lose all equity. Have people realize they will lose money if they don't pay attention to details.

Disbanding a company for including a Google Analytics tracker on their website, causing $0 worth of losses and damages seems a little excessive.

So what is the line, then? Inadvertently sucking up people's tax return info and sending to who knows where because they get a few incentives for it is fine? What about a VoIP company sending call metadata? Or a burglar alarm company sending when you are home or not? At what point can we say 'make your money decently and don't sell customer data for a few pennies or you get made an example of'?

It's far too little. The executives should be given the death penalty for this. They and the rest of the surveillance capitalists have waged war against society and deserve guillotines for it. We need to put a firm stop to this madness before the surveillance industry locks us all into a global panopticon. The stakes couldn't be higher.

All employees should lose their jobs because an incompetent engineer made a mistake? What’s with some people and irrational mob justice? Does it make them feel good or what…

> because an incompetent engineer made a mistake

Here’s my take which happens to agree with the parent commenter: the incompetent executive is responsible for the actions of this engineer and (in this hypothetical) the incompetent executive allowed their business to be destroyed by something which was easily avoidable.

An orderly revocation of a corporate charter isn't mob justice.

People calling for companies to be dissolved are pretty likely to be calling for an orderly process (if they weren't interested in an orderly process they'd likely be talking about using violence on the executives or shareholders or whatever).

Alternatively, maybe this could be the excuse for the IRS to walk away from that horrible deal they made with the tax prep companies. That's why they don't just automate the forms, fill them out for me, and send me the damn draft to approve or dispute. Like in other countries.

It's not like I have secret income the IRS isn't aware of. And for people who do have secret income, they'll either voluntarily report it or won't.

> Then make an example and disband the company and all shareholders lose all equity. Have people realize they will lose money if they don't pay attention to details.

do you not make mistakes, or do you not work with anything that matters?

the US criminal justice system, which isn't very popular, seems to be more tolerant to human error than you.

At some point we have to acknowledge that data is important and that it is easy to collect and hard to secure. Do it right or don't collect it. The 'we have been hacked' or 'we messed up' and now all your data is somewhere else is not OK. If we made their existence dependent on securing this data, don't you think they would start to take it seriously?

I don’t think anyone lower than an executive should go to jail for this. Ultimately they get rewarded when things go right so they would be punished even thing go wrong. That they didn’t make the direct implementation should not matter, it was their responsibility and they were the captain when the accident happened.

What law calls for such a harsh punishment?

Seriously? This post strains credulity.

1. This isn't just a gotcha. If you're storing private data, be a fucking responsible human being and do the work to store it securely. Stop downplaying this.

2. Ad tech companies don't want your SSN or to know if you purchased Plan B? Ad tech companies want to know everything about you, especially things that are private because other people don't know that stuff and that's where the competitive advantage lies.

> There were no profits here.

There were cut costs, which amount to the same thing.

> 1. Facebook asks advertisers to place some javascript on their website

:

> 3. These stupid tax prep companies placed the script on pages where users might view, interact with, or submit very private information

I think you're being far too easy on Facebook.

> Elizabeth Warren is just raising a boogeyman so she can keep sticking a knife into the hearts of these large, corporate entities

I’d say what you described at least comes close to being negligent. I’d hardly call that a “boogeyman”. It’s a serious issue that shouldn’t have occurred and there should be some repercussions for that.

And you have to wonder if they're screwing up something this simple, what else are they screwing up?

I had to spend most of my day doing a technical audit on this as well.

I can certainly see how they could have profited from data contained in certain forms that customers submitted on non-facebook websites, potentially confidential data which would be used to flesh out hidden user profiles and thus increase the prices for highly targeted ads.

Don't spend money securing customer data...voila! Profit!