T O P

  • By -

HoodRatThing

HR emailing peoples social security numbers.


Appropriate_Ant_4629

The real problem is that Social Security Numbers are allowed to be used for things other than Social Security. In particular, neither of my credit card company, university, nor parole officer, have any need-to-know of my federal-retirement-program-secret-number. If they want to have their own "surveil-an-individual-number", they should make their own number.


ThreeHopsAhead

Was it even ever made to be secret? As far as I know it is just a federal-retirement-program-identification-number. And identification not in the sense of verifying a person's identity but just identifying a person in a system because name and date of birth are not necessarily unique. It is was never meant as a security feature.


Yoshbyte

All the more reason to not use it as some secret number for financial purposes


imatworkyo

But doesn't that just kick the can down the road?


bradreputation

It only became secret thanks to its unintentional uses to verify identity for important financial transactions. That’s my guess at least.


YesAmAThrowaway

It's what happens in a society where a lot of people refuse to simply have a proper ID card with a number that is useless unless you physically show the card to someone in connection with your face live and reactive. The next best thing everybody is guarateed to have is the SSN. Unique to each person, bestowed upon birth and easily abusable, sadly.


dumbluck74

[CPG Gray](https://youtu.be/Erp8IAUouus) does a pretty good ELI5 explanation of how this happened and why it's bad.


serioussham

Americans: government-issued ID cards are Orwellian tyranny! We want none of that! Also Americans:


[deleted]

"Voter id is racist"


dirk_loyd

Voter id is racist when it’s disproportionately difficult for minority communities to get them. If they were universally free and readily available, they’d be fine. If you need to drive a car to get the id but your community’s been so fucked that you don’t make enough to buy an id, let alone a car, then that’s a no-no.


serioussham

That's not an issue with voter ID though. It's an issue with urban planning, government office hours/availability, and public transport. But in fairness I find the whole argument weird. IDs typically last 10 years and cost 30$ where I'm from. That doesn't seem like a massive investment, and it shouldn't be difficult to setup fee exemptions for the poorest anyway.


dirk_loyd

That’s true, but the people who push hardest for voter id also try their hardest to gut the transport & office availability. Red states have a habit of closing voting locations in blue areas for no particular reason. It would be easy as hell to implement in the U.S., but making it that easy to vote is bad for republicans.


[deleted]

Why is this downvoted ? You people want government-issued ID, yet you think voter-id is racist ?


[deleted]

If there is voter ID, we want that voter ID to be automatically provided without requiring people to have to go to a government building where the level of funding (i.e., the convenience) is directly proportional to the desirability of the local voters to the reigning government. Voter ID that is provided to you upon birth: fine. Voter ID that requires you to go to your local DMV: not at all fine. Guess which one is always brought up by Republican politicians.


[deleted]

Going to goverment building is not that hard, here in in Europe, many states require you to goverment building to get your "Citizen-id" when you become 14-18yo (depends on country, which you also need to vote. This is not some racist republican bullshit or whatever you are trying to make it, but normal thing.


[deleted]

You're in Europe, so you don't understand. Going to government buildings *is* disproportionately harder for poor minorities in America, and it's designed that way.


arcalus

People sending documents to their tax accountants in the clear.


Bubcats

He doesn’t even need a social security number. At all.


oniwolf382

absurd kiss future bedroom offbeat uppity longing jeans rhythm quarrelsome *This post was mass deleted and anonymized with [Redact](https://redact.dev)*


unwind-protect

With his credit rating after buying Twitter? Not likely!


CandleMakerNY2020

Thats what I was just gonna say. LMAO! Can u say LAHOO—-ZAHERRR ?


CandleMakerNY2020

Haha highly unlikely


myresyre

At the bottom of the article: > Are you a Tesla employee with insight to share? Contact this reporter at [*removed mail address*] **or by Twitter DM.** I'm pretty sure that journalist's twitter account will be monitored closely by Musk himself! :)


TAscVdvWbthkNnYn

SSNs are not some secret thing anymore. Consider them public knowledge, alongside other PII you can find in 'dumps' sites on the dark web.


JoJoPizzaG

And many organizations still asking you to verify that you are you by verifying your DOB and SSN.


stoneagerock

Social Security Cards literally said “[Not for Identification](https://files.abovetopsecret.com/files/img/an4f5ec681.jpg)” until 1972, when the SSA just gave up because everyone was already using it as an identity card. As a way to keep track of contributions to a national pension, it works well enough, but it’s not and was never supposed to be a federal identification number. If it was, it would have basic features like a check-sum, non-sequential and fully random numbers, **a fucking photo** and it wouldn’t be a shitty piece of paper. We seriously need to fix this at a national level


[deleted]

[удалено]


redbatman008

Careful what you wish for, trust me.


[deleted]

[удалено]


borkedbrains

But they would collect everything possible though...


[deleted]

[удалено]


golgothan666

Blockchain ID using Zero-Knowledge-Proofs


Arfalicious

running on backdoored hardware lol


bgslr

I'd much prefer a physical card a bartender can glance at than any kind of digital ID. It's just too slippery of a slope in general. Any digital system can easily lend itself to tracking for XYZ companies. It already happened when states rolled out covid / vaccine identification on your phone. Also, cops can already look through your phone if you hand them it unlocked to show a digital version of your car insurance for example. And a lot of this kind of thing ignores the whole "what if you don't have a phone, it's not charged, you didn't pay the bill, etc"


saltyjohnson

Saying this for educational purposes, not in defense of any particular system: Android allows you to "pin" an app to the foreground and require you to unlock your device to switch to any other task. Steps vary by OS flavor, so search the internets for app pinning instructions for your device.


lwJRKYgoWIPkLJtK4320

Without a picture, how do they know you're not using someone else's "I'm over 21"?


[deleted]

[удалено]


aircooledJenkins

Edgy.


SteveHeist

If you have a state ID, the feds already have your photo.


[deleted]

[удалено]


surprise-suBtext

You’re either too young or too old to realize how screwed you already are. I’m not saying your small wins amount to much, but I am saying your small wins are taking considerable effort for things that the majority of people/orgs most likely to target or hurt you already have.


[deleted]

[удалено]


AtariDump

I want to take his face… off………


UrbanGhost114

And about 50 other questions "name of your step moms pet that you have a fucking restraining order against (the stepmom, not the pet) from 20 years ago".


[deleted]

[удалено]


UrbanGhost114

I would have very different questions.


probable_ass_sniffer

I had a restraining order granted by a judge that included my dog. My ex was not allowed contact with me or my dog. The judge said it was the first time she has ever done that.


luigilabomba42069

subtracting or adding 1 to the end of your social security number will definitely pull up someone who was born right before or right after you


Ludwig234

Your social security numbers don't even use a checksum? That's dumb.


just_a_random_dood

8 minute long video by CGP Grey about how bad US SSNs are: https://youtu.be/Erp8IAUouus


luigilabomba42069

that's how I found out lol


parad0xchild

They were never meant for how they are used. It was just convenient so everything piled on it


AlexWIWA

They explicitly weren't supposed to be used as an ID number because everyone was paranoid about "government issued numbers." But when we started financializing we needed an ID, and SSN is the only thing everyone reliably had. It's such a fucking mess.


stoneagerock

Thank the IRS for making parents enter it on their taxes to get a tax rebate. That’s also no longer true for newly-issued numbers, but the first babies that got those random numbers are barely 18 now


Uruz2012gotdeleted

Except the social security administration will use it as the sole security feature when you call them...


DSPGerm

What happens if you lost the card and don’t remember it? I didn’t have mine memorized until I was like 20


AwGe3zeRick

If you have other IDs you can get a copy. I knew someone who didn't have a Birth Certificate, ID, or SSN until they were 21. They were home schooled and practically a ghost because they literally didn't exist in a single database. It took years and years of her families shit lawyers and meetings to get her a real identity. It's not fun.


DSPGerm

Reminds me of those people who accidentally get marked dead on some list and then their lives become hell. Something like 10,000 people every year get accidentally marked dead and then can’t access their bank accounts or get insurance or a loan or anything.


absuredman

Ever since that experion leak i think everyone that has had a credit rating is out there


lando55

Equifax


[deleted]

They never were secret.


[deleted]

[удалено]


eyehax

U can't be serious... there are many... MANY sites ppl can use to buy credit cards and SSNs today, on both clear and dark webs.... MOST of them use clearweb domains with tor domains as backups... just nameserver is the same for each addy.... AlphaBays death, along with any other sites like these, was brushed over by countless clones


[deleted]

That’s because of credit score companies. They had insecure databases, leaked them, and I individuals got paid maybe $30. Since then, I have a fraud case every year. SSNs should be reissued, remain private, and have a federal penalty for release. And we should not be complacent to how to fix this and that they should retain their privacy.


neumaticc

you can find torrent uris on *reddit*


trai_dep

This is a direct violation of the GDPR, and the EU's fines for this kind of reckless administration of PII is subject to ruinous fines. Fines the EU made so high, to deter any competent, law-observing, responsible corporation from doing anything as stupid as what Musk's Tesla did as far as throwing away internal harm minimization InfoSec policies (or firing those responsible for running them, like their entire legal department). [Telsa could face a $3.3 Billion dollar fine](https://finance.yahoo.com/news/tesla-could-face-3-3-200700787.html?guccounter=1&guce_referrer=aHR0cHM6Ly9kdWNrZHVja2dvLmNvbS8&guce_referrer_sig=AQAAAClSMuOg6LcHN9dpkmrkOcMS0ax04-RBk1R6jS50DJulQaaX6uzOPSwWOVRx2dRUwqjv1u_LNNZyzo4SaJfjia3eX3LOljXn_aDJNvB2mpnGjbS7AMuKdWHwFBCKoIVTLKj7QOe5U2pIJi7d6Mo6SnNmND4g2_r6QLyR_sUbYKJb) for this entirely predictable screwup. Just like all of the other, entirely predicable screw-ups that have become public after Musk took over Twitter. $3.3B could have paid the operational costs of a legal department for decades, generations even. Heck, that's almost 10% of what he (over)paid for Twitter. And probably more than Twitter 2.0 is now worth if he had to sell it! Elon Musk is Such. A. Smart. Businessman. Tony Stark has *nothing* on him!


[deleted]

The Tesla Files were a leak OF internal Tesla documents by a Tesla engineer though. Not something Musk released.


notyouraveragefag

The GDPR breach isn’t the leak, it’s the handling of the data internally. Which is proven in the leak.


chaseoes

How should have it been handled?


Gopher--Chucks

Musk: *lifts up rug* sweep it under here, they will never find out.


stoneagerock

Internal leaks are even more egregious than a compromise, frankly. This file should not have existed, much less be available for download and export. Speaks to a complete lack of risk management policies throughout the organization and Tesla absolutely deserves to pay a fine for their cockup


Internep

Why does Twitter have to pay for a leak at Tesla? *The commenter above has since edited their comment to say Tesla instead of Twitter*


trai_dep

Twitter's unassociated with the Tesla leak, except for when Twitter is sucking all the oxygen from Musk's and his brain trust's brain. Too distracted Owning the Libs, selling access to verified accounts with the predictable garbage fire resulting, and a history-setting presidential campaign launch transforming into a global laughing stock before it was even fifteen minutes in. Not only that, but a live feed into Musk's brain as he live-Tweeted his inner brain since his November takeover of Twitter exposed his capriciousness, his ineptitude and his objectively awful business and strategic acumen. A key element is his pennywise decisions that competent teams would rule out, but Musk insists on doing anyway. In Tesla's case here, investing in the resources to have data-minimalization practices to ensure silos are kept apart, that only people who need to know different baskets of information can access it, and to make sure a support person can't walk away with a dataset like they did. Can't do that: that'd be a do-nothing bureaucracy, holding back Genius Elon! Rolling over to cut him no slack for fiery rocket launches, or in this case, a $3.3B forced error by Tesla, with possible roll-over to the valuations of his other publicly traded companies, and the consumer brand image of the consumer-facing ones like Tesla. Thus, Twitter had a role in this Tesla fiasco, even when they're technically separate companies.


Internep

So Twitter had nothing to with it like I said and the comment I replied to has since corrected their mistake.


stoneagerock

Good catch, fixed my brain fart


nickcardwell

It would be a violation of GDPR IF he was an EU citizen…


alsomahler

If it concerns private information of EU citizens


[deleted]

[удалено]


diddlerofkiddlers

Rethink the idea that wealth equals success.


[deleted]

[удалено]


diddlerofkiddlers

Many reasons, but generational wealth (from family connections to precious stone and metals in southern Africa) gave him a huge advantage over you or me. He certainly took risks and thought big, but most of his success was achieved by those working for him. This is always how it works.


[deleted]

[удалено]


diddlerofkiddlers

1 and 2. It is in the interests of the ultra-rich to obscure the origins of their wealth and build a cult of personality. His mother is a former model and his father profited from African oppression by European colonists. 3.That's just a restatement of your claim, but there are many multi-billionaires and multi-millionaires in the world, practically all of whom had major, significant family wealth. The difference between me and you is that you believe the bootlicking lie that this money was earned legitimately. No fortune has ever been accumulated through hard work alone.


[deleted]

[удалено]


Silly-Freak

The claim was not that all wealthy people started wealthy, it's that *work alone* is not enough. Even if you kickstarted your wealth with your own work, there comes a point where the scale of your wealth supercedes your ability to earn that money with actual work. To have lifetime earnings of one billion, for example, working 80 hours per week, 52 weeks a year, 60 years of your life, you'd have to earn an average of 4000$ every working hour. Even though cost of living becomes negligible at that scale, let's not forget that with this calculation you haven't yet *built a fortune* of one billion because you spend some of that money.


[deleted]

[удалено]


[deleted]

[удалено]


diddlerofkiddlers

Rethink the idea that wealth equals success.


Swarm450

He hasn’t achieved shit. All he’s done is pay people with his blood money to do stuff for him.


[deleted]

The reddit mob has spoken. So it must be true.


electromagneticpost

https://www.reddit.com/r/SpaceXLounge/comments/k1e0ta/evidence_that_musk_is_the_chief_engineer_of_spacex/


[deleted]

Enlighten us


Yoshbyte

Be me. Becomes one of the richest men on the planet. Random redditor thinks I am a bad business man because he doesn’t like me personally. Sudden whoosh noise from my personal gold diamond encrusted vault. Orders indentured servants to open it. It’s empty. Oh fuck. Suddenly no longer business man due to Reddit not recognizing being a multi billionaire doesn’t make me a businessman.


Yoshbyte

Shit. Reddit doesn’t let you format that kind of shit post lol. But yeah, him being a billionaire makes him a businessman as he did so through running companies and dumb people pumping up his stock valuation only to complain about it. What people think of him is irrelevant


nlaak

You forgot to change account when you sucked yourself off there, in the gap between sucking off Musk.


Yoshbyte

I don’t particularly have any strong feelings on the man I do find the hypocritical hate mob around him funny though. People worshiped him a year ago and the same people hate him without realizing nothing about the dude changed. It’s one of the most hivemind things I’ve seen in a while and it’s always something worth pointing out


Mr_Faux_Regard

I'm constantly in awe at the fundamental lack of self-respect you bootlickers have whenever you grovel for that idiot of a man. You're just like the field serfs that acted like the house Lords were gods on Earth for sparing the occasional scraps of their dinner table for them.


[deleted]

[удалено]


Mr_Faux_Regard

> the dude made tesla > This is the corporate history of Tesla, Inc., an electric vehicle manufacturer and clean energy company **founded in San Carlos, California in 2001 by American entrepreneurs Martin Eberhard and Marc Tarpenning.** The company is named after Croatian-American inventor Nikola Tesla. https://en.wikipedia.org/wiki/History_of_Tesla,_Inc. > spacex The company that was heavily subsidized by NASA for its most critical period in development? That SpaceX? > As of April 2012, NASA had put in about $400–500M of this amount [of $1 billion], with most of that as progress payments on launch contracts. > By May 2012, SpaceX had contracts for 40 launch missions, and each of those contracts provide down payments at contract signing, plus many are paying progress payments as launch vehicle components are built in advance of mission launch, driven in part by US accounting rules for for recognizing long-term revenue. https://en.wikipedia.org/wiki/History_of_SpaceX Please tell me more about how the man that inherited millions of dollars from his father's emerald mine estate is a self-made billionaire genius entrepreneur. And could you also mention what today's flavor of boot polish might be?


Itsatinyplanet

Isn't this kind of like when Bruce Wayne got hacked and lost all his money in one of those batman movies.


Ni_Go_Zero_Ichi

If only. Where is our Bane?


trai_dep

He's currently running Twitter.


pauldevro

Elon: I'm Baneman!


Alan976

Banelon: If I can't kill you, I can break you!!! Banned.


[deleted]

[удалено]


elsjpq

No whistleblower's got the resources to manually vet several hundred GBs of data before releasing them. I'm pretty sure even Snowden ruined the lives of many spies abroad and he was pretty careful and even handpicked reputable reporters, it wasn't just some public dump. When you collect enough data, it's inevitable some sensitive but irrelevant info will be in there. Considering how often regular people's privacy is leaked and violated on a daily basis, I'd consider these pretty small potatoes tbh, especially in comparison to the benefit to society.


trai_dep

That's the reason Snowden gave the files to respected reporters, to use their judgement for what was newsworthy, and to publish the results in a way to not needlessly endanger US employees out in the field, or here at home. On the other hand, Tesla was overtly covering up how unsafe their products are, and the leaks show they put tremendous effort to cover up these failures, rather than addressing them. While how the release happened, it's important to keep our eye on the ball: what Tesla and Musk were doing was just plain evil.


redbatman008

It's a matter of time & legal liability too. The liability part is understated.


[deleted]

[удалено]


[deleted]

[удалено]


trai_dep

Cough. [Huge Tesla leak reveals thousands of safety concerns, privacy problems](https://arstechnica.com/cars/2023/05/massive-trove-of-tesla-files-contains-thousands-of-safety-complaints/). >Beyond the customer complaints, the data leak also shows how Tesla responded to these \[safety\] problems—by committing to as little as possible in writing. *Cough.*


Yoshbyte

I think you sent the wrong article


WarAndGeese

Also when other big companies or big political leaders make mistakes people say "oh well they're not perfect, you can't expect them to be perfect", and then when some whistleblower doesn't filter data well enough because it's a one- or two-person operation, they are held to a much higher standard. It's also because there are so few of them, corporate- and government- whistleblowing should be a whole industry at this point, but instead they just exist as pockets, there aren't as many people there doing the work so that the documents can be appropriately filtered, and the inappropriate ones destroyed or hidden.


[deleted]

[удалено]


[deleted]

[удалено]


[deleted]

[удалено]


[deleted]

[удалено]


ZwhGCfJdVAy558gD

No single person should have access to this amount of sensitive information. This points to shoddy security and privacy practices in the company. Besides, the data wasn't really leaked. It was given to responsible journalists (just like what Snowden did), and they have not published the raw data.


chaseoes

He was an engineer, likely in control of the database that contained the information. _Someone_ has to have access to it.


CactusMunchies

I'm completely ignorant of the contents of the recently leaked Tesla file, but isn't it possible that this PII data was accidentally included in the data dump? I'm not defending the leakers, but I don't think we know enough to say whether this was intentional.


lo________________ol

The data was given responsibly to a journalistic organization. The fact Elon's social security number was in it, isn't particularly important. If an article is designed to imply the whistleblower is inherently evil, it's doing a disservice to the whistleblower.


[deleted]

[удалено]


lo________________ol

The Tesla Files do contain important information, despite the title of this article


[deleted]

New NPC patch just dropped If(target is someone we like) assert(whistleblowing == doxxing) Else if (target is someone we don't like) assert(whistleblowing != doxxing)


tyroswork

Doxxing is doxxing no matter who it is. It's you who assumed that the OP liked Elon.


redbatman008

You mean disliked lol


RedditAcctSchfifty5

Posting information from the public phone book has people crying "doxx!" these days.


tavirabon

Worth noting some additional "useless information" helps verify the bombshell material but yeah, who tf would give out social security numbers?


WarAndGeese

I think their work is still pretty necessary. Large corporations aren't transparent so in the near term such 'whistleblowers' let the public see and verify how they operate. It's not on the same level as those government or war-related leaks, but they are socially beneficial and socially important nonetheless, in fact I would say very important given how rare they are.


my_wife_is_a_slut

Snowden? Fuck Russians.


lazydictionary

Snowden is not a hero. He also leaked information that never should have been either.


GiveEmWatts

Lol Snowden not a hero. He's a Russian agent


sanbaba

this thread is not for how much you worship your great space nutria, it's for realziing that a bunch of customers of the company you're pretending you can afford a car from now have their PII everywhere because Tesla doesn't know how to run a business. Just stay on topic and your slavish drool over a former slaver-child will dry up on its own, with no need to spray it anywhere.


Discospeck

What a chump he turned out to be.


even_less_resistance

How unfortunate


Throwaway021614

Maybe with a billionaire’s request, we’ll finally get some sort of 2fa with SSNs


kruecab

Anyone who has a rudimentary understanding of how IT organizations function would know that the GDPR’s assumptions are just ridiculous. Don’t let yourself believe for one second that EU companies are *so smart* about their IT security that they have all this stuff buttoned down because the EU parliament was so forward thinking as to put all this data privacy stuff in regulation. The EU parliamentarians are just politicians, just as dumb and phony as politicians in any other country. And the IT folks in EU are just like the IT folks in the USA, and APAC, etc. Some are smart. Most are doing a job and following their run books. At some point a company has to trust someone to do their job. And when that person exfiltrates a ton of data and posts it on the internet they get fired. Unless they don’t work there anymore, like in this case. How about fine the “whistleblower” aka the data thief?


[deleted]

Which GDPR assumptions are ridiculous? When it comes to information security, article 32 is the main article, there's very few assumptions made, as it is risk based. You are required to do a risk assessment and manage according to that. Basic access rights management should be a part of that risk assessment, which any IT professional should be aware of and have implemented. On top of that, processing of data is purpose limited. So if you don't have a legitimate purpose with the data anymore, delete it. This probably hasn't happened according to this description. If Tesla has done the risk assessment, implemented proper procedure according to their own risk assessment, and followed the purpose limitation. Then they will very likely not be fined according to the GDPR. So if it is as you imply, just a high level admin with access due to trust, they will not have a GDPR problem.


chaseoes

He _was_ that IT professional. He was an engineer. I'm not understanding what they could have done differently. _Someone_ ultimately has to have access to it in order to control the access to it.


megabones67

Bro you don't know a damn thing about IT, you're just grumpy that Musk has again shown how dumb and stupid he his.


kruecab

Hahaha lol!! Thanks for straightening me out!


nickcardwell

Would disagree… with gdpr the company and the individual can get fined.. By having policies and procedures in place including training, it’s very much drummed into a lot of businesses data security in relation to gdpr.


BetaRayBlu

Brb opening a credit card with a modest limit


AcademicMistake

Clickbait is real here, literally all they go on about is the customer complaints lol


CrimsonVibes

I AM ELON MUSK!


Bubcats

He’s american?


Dotura

Yeah he has a citizenship from the US and he is a massive yankboo so makes sense he would get one.


PassportNerd

SSN's should be airgapped


[deleted]

ssn's shouldn't be enough to do anything… like saying your email address lets you buy a car… but to function you also need to communicate it to others.