Releasing everyone's SSN and the hacks used to acquire them | Hacker News Reader

Releasing everyone's SSN and the hacks used to acquire them

github.com

100 pointssgammon50 comments

ALL CREDIT CARD PIN CODES IN THE WORLD LEAKED: https://pastebin.com/Nn2ZcdfC

I can't find my PIN in that list!

(some countries use five- or six-digit PIN as the default length, and you could set it up to 12 digits if your bank allows it)

are your sure? type it out here and I'll double check for you

Bosco

******

hunter2

What next, all the CVV/CVC numbers, validity dates? Maybe someone should list all the credit card numbers too...

What's next? A list of all bitcoin private keys: https://privatekeys.directory/keypage/1?coin=btc

Going with the satire idea there is of course a PR to "rewrite it with Rust" https://github.com/PatrickJS/everyone-ssn-usa/pull/16

Be sure to create a pr to remove your ssn from this list.

Also your passwords: https://github.com/danielmiessler/SecLists/pull/155

There is an attempt to satirize, to position oneself on a level of higher understanding than those who are concerned by one of the biggest leaks in history.

It reminds me of when people used to make fun of covid and cough in each others faces before they knew shit was real.

Of course it isn't a list of ssns, it's a list of ssns attached with names and addresses...

So what are we supposed to do about it? Everyone has known for years that SSN's aren't secure or supposed to be used in the manner that they are. Many have been screaming from the rooftops about it. I can't do anything about it, you can't do anything about it. So may as well laugh about it.

not give out your SSN unecessarily. freeze your credit. pay for monitoring service. pay for a service to delete you from other public data sets eg fastpeoplesearch.com.

there's not nothing you can do.

Or I could just do nothing, it's worked so far. When someone inevitably steals my ID, just use the Shaggy Defense, "It wasn't me"

Depends on the assets that you have or how public of a figure you are really, being targetted for kidnapping, break n enter, or home robbery is no joke. Especially if you have a family.

You need to take the backseat and let the grownups deal with this stuff.

It works until it doesn't.

Doesnt matter how hard ya beat ya dog. If ya dont feed it, itll come home.

I feel the question on what to do is an interesting one, but a thread that satirizes the problem is not an appropriate venue to resolve that question.

People have warned that ssns arent "secure or supposed to be used in the manner that they are" . What does that even mean, there's been a huge leak, ignore your previous quarrels and respond to the specific incident, nobody cares what people were saying about ssns before, wait for information and respond accordingly.

I guess but there's literally nothing I can do, the data wanted to be free and escaped. Oh well, I'll deal with any fallout as it happens. No sense worrying until the actual bad thing happens, because if it doesn't you worried for nothing.

If anything I'm happy SSN databases keep getting leaked. It furthers the case that identity fraud is the bank's problem and verifying identity by SSN is negligent.

I can't see the gov actually ever making identity fraud the banks problem. The best we can hope for is gov identity that's not ssn and we just move on

maybe we will finally switch to asymetric key auth

This is a joke, though it might be indicative of the state of software that I totally believed a JavaScript file could exfiltrate the names and security numbers of everyone in the US from some central system.

Yes, this is obviously a joke given that the first file starts with SSNs with prefix 000. That prefix is not used [1]. The only information listed here is what appears to be an enumeration of every possible SSN, without any other related fields.

[1] https://en.wikipedia.org/wiki/Social_Security_number#Structu...

Only on HN would someone figure out that this was a joke because of the implementation details of SSNs... lol

Book smarts vs. street smarts and/or common sense.

Common sense can be gamed and exploited; that's how social engineering and other tricks (like illusionists) work.

lol https://github.com/PatrickJS/everyone-ssn-usa/commit/25f60dd...

this was a joke.

referenced in the PR for this commit is tfa

https://www.govtech.com/question-of-the-day/question-of-the-...

hence the "lol"!

I am not American, so I don't know the rules of ssn. However, can someone calculate what are the chances I guess a valid ssn, if I know all the ssn rules?

Very good. I don't know all the details but part of the SSN is the hospital ID where you were born, and part of it is time-based. It's just enough that someone trying to drink coffee while perusing the rules won't instantly know everyone's SSN, but a sophisticated actor could probably get someone's SSN down to 100ish guesses.

Until a year or so ago, the Dutch equivalent of the SSN (BSN = Burgerservicenummer = Civilian Service Number), was embedded in the VAT number of freelancers. After much protest it finally got fixed by the Dutch IRS that this sensitive number is no longer embedded in a number that you’re supposed to display on your website and invoices.

The code formatting on lines 14-20 is a great example of how autoformatters can get it very wrong.

That has to be the least readable way to write that code.

https://github.com/PatrickJS/everyone-ssn-usa/blob/main/scri...

I'd be more concerned about the 7-level for loop than indentation

I wish this wasn't a joke, we need more things to be open source so everyone can share things for full transparency.

Maybe this will get people to stop using a 9 digit predictable and easy to obtain number as a secure identifier.

They got me. I first checked my own and my wife's SSN - neither was there. And then I checked the script.

This should not be flagged. The author's repo makes a valid point about how we should think about security; satire cannot be labeled and still retain its rhetorical and educative value.

I am disappointed that Hckrnews is missing this man's consistent security work and instead downvoting or flagging, presumably because the headline -- merely the title of the repo -- caused a heart or two to skip a beat.

But isn't that the point? Isn't that something we should think about?

tl;dr

The most obvious way to generate all SSNs you can think of: brute force enumeration

the numbers alone are useless.

There are only a billion numbers. Counting everyone who has already died since they were introduced, and all the "taxpayer id" numbers that are issued for people who don't have real SSNs, how long until we run out? Or are they already being re-used?

I googled that recently, and it sounds like:

They don't get reused.

There are about 70 years left.

The government is punting the problem to future people and there's no solution yet.

They are absolutely reused. I know this because mine was previously issued to a man who died in the late 50's.

I've heard people say that, but the SSA's FAQ says otherwise:

"Q20: Are Social Security numbers reused after a person dies?

A: No. We do not reassign a Social Security number (SSN) after the number holder's death."

https://www.ssa.gov/history/hfaq.html

It should be an error then, it isn't reused according to https://en.wikipedia.org/wiki/Social_Security_number#Exhaust...

There’s less actually. Each state has its own unique 3 digit prefix.

SSA implemented randomization in 2011 to remove that artificial constraint.

https://www.ssa.gov/employer/randomizationfaqs.html

I don't think that's true anymore. I was born in the same state as my wife and we have different 3-digit prefixes. But I agree that there are some rules about the different parts of the number that further constrain the theoretical one billion limit.

You can compare against the Social Security Death Master File of SSNs for those who are already dead.

https://www.ssa.gov/dataexchange/request_dmf.html

-.-

WTF

Reply on news.ycombinator.com