Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

No. The Chicago Tribune [0] reported on the type of data exposed:

> The files included names, addresses, dates of birth, the last four digits of many voters' Social Security numbers, driver's license and state ID numbers for the 1.8 million who are registered to vote in Chicago.

[0] http://www.chicagotribune.com/news/local/politics/ct-chicago...



Well, there's an unpleasant reminder of why knowledge-based authentication should never be based on something immutable.

How many services do all of use use that accept name/birthdate/SSN as identification? How many other services, like phone companies, claim not to but would still yield for someone who sounded earnest and knew all of that?

And what can the leak victims possibly do? TFA is great where you can get it, but it's not universal, and none of this information can be refreshed.


So the question becomes - what types of data is available using legal channels?


According to Forbes [0]:

- Name

- Street address

- Party affiliation

- Elections in which you did (or did not) vote

- Phone number

- Email address

[0] https://www.forbes.com/sites/metabrown/2015/12/28/voter-data...


Last four of social is so abused it shouldn't count, and date of birth is in nearly every company's loyalty database. That leaves drivers license and state ID number as the leaked data. I'm honestly not sure how important or secure those are.


Illinois is one of the states where driver's license numbers are computed from all the other information: http://www.highprogrammer.com/alan/numbers/dl_us_shared.html


wow. I had no idea about this, but it correctly calculated my DL number.


> Last four of social is so abused it shouldn't count

Yet it does. Almost every single business/government service in America uses DoB + last 4 SSN to identify you. The two together make fraud trivial.


Exactly. Every leak already has it. Every company already has it. The fact that fraud is trivial is already true, and this leak really adds little to it.


Can I have the last four numbers of your social security number?


-


OK, now would be so kind as to pretend that we've been leaked your birth year and state of birth?

Before you answer, you may want to poke your answers into this site and have a look at the outcome: https://www.ssn-check.org/lookup/

Caveat: This tracks your issue date, not truly your birthdate. In the past couple of decades many/most babies get registered at birth, but if I stick my own (birth) data in there I actually get the wrong answer, because when I was born issuance wasn't automatic yet. But that will work for a lot of people.


They are a requirement if you were wanting to fraudulently open a bank account in someone else's name.


Need a whole SSN for that no?


Both the first three and the middle two have a pretty clear rhyme and reason to them which would likely make getting them right a not-so-difficult task after a bit of homework.

https://www.ssa.gov/history/ssn/geocard.html

Anecdotally, while bored in math class we figured out that 10 or so of the guys in the class had one of two numbers for their first three.


fuck. I live in Chicago.




Consider applying for YC's Fall 2026 batch! Applications are open till July 27.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: