Hacker News Reader

That means you could brute force your way into getting someone else's tax return... scary

This has always been possible. I knew a guy who bulk downloaded returns from hr block because they required only last name, zip, and partial ssn. He picked a zip where everyone is named Stein and was born at the same hospital (which gets its own ssn shard) and went to town. Naturally they had no rate limiting.

How do you find a zipcode where everyone has the same last name? I'm guessing a very small town several hours from a single hospital?

Wrong it's one of the most populous zips in the nation and I'm being flippant about the name but when you are brute forcing things an unusual probability is all you need.

Oh seems like it would have been just as easy to grab census data for the past 50 years and run through last names by decreasing frequency.

Here I thought you had found a unique zipcode.

Can anyone on HN with a TurboTax account confirm this is true?

Criminal! If only.