Psssst! Your date of birth can be a random number!

https://shkspr.mobi/blog/2024/08/psssst-your-date-of-birth-can-be-a-random-number/

by ColinWright • 2 years ago

35 39 2 years ago

bell-cot• 2 years ago

Um, yes. And similar for any other PII that YetAnotherCompany wants for such purposes.

But First - look for the little gray "continue as Guest" alternative to creating an account. And if there isn't one, take a few seconds to think about good-enough alternatives. Your purpose in life is not to help boost online account count metrics.

PreInternet012• 2 years ago

Oh, yeah, my password manager is full of answers to 'security questions' like 'place of birth', 'name of first pet' and 'high school name'. Just about the only time that gets awkward, is when the same answers turn out to be required during certain phone conversations. Yes, I do in fact, happen to be born in Qjhdfoudvprx -- quaint little, very traditional village...

yohannparis• 2 years ago

I do the same, but I have been using random words. So for my gas bill, my pet name is `chlorine wastrel percept`. Easier than pure randomness, and strong enough for the purpose.

mdiesel• 2 years ago

I wonder how many people have pet names 'correct horse battery staple'

pushcx• 2 years ago

I used to give random strings like that. Next time you get asked one on a call, say "Oh I hate those intrusive questions so I just mashed the keyboard." Many support agents will accept that as a valid answer!

PreInternet012• 2 years ago

Yes, well, unless the poor CSR cannot actually see your answer, but has to enter it for a 'yes/no' response. Had a fun time with Rackspace support around the turn of the millennium, where I had used the output of 'openssl rand -base64 16' or somesuch, and that had to be entered verbatim, with the person on the other side apparently not understanding what a 'forward slash' was, and, yes, it was urgent...

Anyway, I don't find these questions intrusive as much as 'not fit for purpose', with a bit of (cultural) insensitivity mixed in. I once had to console a very-upset very-serious person from an African country with regards to the the 'name of pet' question they just had to answer as part of a mandatory signup for a US-based third-party service, and which they just couldn't find an answer to.

And whenever I'm asked about "name of high school" or (even worse) "high school mascot", I'm tempted to flip out with something like "yeah, which of the seven-or-so I attended, for no-fun-at-all reasons, and most of which I don't even remember, but I can assure you none of them had a mascot", but then I just take a chill pill and mash my keyboard...

hughesjj• 2 years ago

Which... Is kind of a bug given Mallory can just say that if they know you do that

Hizonner• 2 years ago

One of the more underappreciated negative effects of COPPA has been normalizing sites' asking for birth dates they do not need and should not have.

dredmorbius3• 2 years ago

Any DoB > 18 years should more than suffice.

The practice suggested of offering a DoB at the earliest date accepted by the system (a practice I've long since adopted ... amongst other things, 100+ y.o. individuals tend to have weak appeal to advertisers) will also suffice.

I've also felt that, as with several other online issues, the matter of age-gating is probably best handled at the ISP level. Most people have a fairly strong relationship with their ISP (whether willingly or happily is another matter), and a combination of site-specific self-ratings (which would also fall under consumer-protection/fraud regulation) and an ISP toggle to enable or disable +18 / NSFW / sexual content, or other categories on an account-wide basis would enable a household or business to set such filters with a minimum of hassle.

For instances where multi-level tiers of access would be required, the ISP should be able to provide that through two or more virtual service addresses (effectively VPNs which various devices are configured through). And a household or business should be able to define specific exceptions to any filtering rules to avoid the overclassification problem and put ultimate control in the subscriber's hands rather than the ISP's.

amarant2• 2 years ago

In theory this is a good idea, but in practice I'm not sure I trust my ISP to manage that system. I'm not worried that they'll leak my data, they already do that, but I think they'd probably lock me out of content they shouldn't because of bugs and/or poorly designed system.

franga2000• 2 years ago

Ok but households with underage people tend to also contain adults, who might want access to such content... Without incredibly invasive technical measures, proper filtering just isn't possible. And given how trivial it is to bypass basically any filtering even for someone with no tech knowledge, I don't see a reason to even try.

jmclnx• 2 years ago

Plus when you are asked things like:

Where where you born: make something up, I have used colors, planet names, star names... you get the idea :)

You first pet name: Some nonsense string

You get the point. Plus make different per WEB Site.

leipert• 2 years ago

Two things to keep in mind:

I have had interactions with support in the past where “wait-a-second-it’s-a-long-nonsense-string” was good enough for them and they did NOT ask me to read it out.

I also had the interaction with a bank that asked me to read it out, and I was glad that my nonsense string was a list of 8 hyphenated words rather than a barfed up random string.

8henna-Such-Brain-Civil0-Grown5-modified8 is better than gpqmxsc5utowduc8fhqvntsXsgvMDzs0rclsiwzt

1659447091• 2 years ago

I use something similar to the hyphenated words now, as well. I use to make up random things like "Error Invalid" answer or missing input until I had to get support on one and the guy started his "I just need to ask you a coup...wait a second....hold on sorry, I'm getting an error, I need to put you on hold" and put me on hold before I could say anything, I waited and jumped in the moment he came back because I felt bad (the support center didn't make the system). He found it funny at least.

kijin2• 2 years ago

If the support staff can compare what you said with what's on their screen, it's obviously stored in plaintext. And they probably won't even distinguish uppercase from lowercase letters, or 5 from S.

So it's a waste of time to insist on a large amount of entropy for these things. Battery horse staple is where it's at. :)

meowster• 2 years ago

Yes, always use a fake but plausible answer.

Q) What was your first pet's name?

A) Peachtree

DavideNL• 2 years ago

I always use 01-01-1970 :

https://en.wikipedia.org/wiki/Unix_time

dvh• 2 years ago

Years ago I used some leaked database to find if birth dates correlate with moon phase and there was no obvious correlation.

Someone• 2 years ago

This myth has been researched to death, and AFAIK, nobody has found such a correlation. Examples:

https://obgyn.onlinelibrary.wiley.com/doi/full/10.1080/00016...: “in this analysis no evidence was found to support the maintained popular belief that lunar cycle might affect birth”

https://pubmed.ncbi.nlm.nih.gov/15970864/: “Although there exists a popular belief that the phase of the lunar cycle and weather conditions affect birth rate, no such evidence was found in this study.”

⇒ If there is a correlation, it is a very, very, non-obvious one.

anArbitraryOne2• 2 years ago

Using the earliest possible date isn't a great idea because it's very easy to guess if necessary for security purposes. Same for whatever the default date is, 01/01/1970, or any other date that follows a similar pattern

kijin2• 2 years ago

Besides, lots of badly designed systems spit out the Unix epoch if they can't handle a date string for whatever reason. Then you can't tell whether you're looking at the date you actually selected or the default fallback date.

hislaziness• 2 years ago

I also use some email providers ability to have +xyz at the end of the username. So for a registration I would for user.name+sitea@domain.com. has helped me track spam and leaks in the past.

setopt2• 2 years ago

Same here! Both GMail and iCloud Mail support this, among others.

It works 95% of the time, but be aware that it sometimes doesn't:

- Some webpages refuse addresses with a + in it.

- I’ve had at least one instance where I lost an important email because I could register and receive emails from them, but one of their internal databases silently failed on my address. (I lost the proofs for a paper accepted in a journal, and it took some time to figure out what was going on…)

- There was at least one web page that was smart enough to just remove the +… from my address after I registered.

- Some webpages require you to be able to send emails to them from the exact address you sign up with (including the +…)

Overall I’ve been happy with the feature since it makes e-mail sorting easier, and you can just redirect a given subaddress to spam if they leak it, and it’s less effort than creating a “real” email alias per page. Just keep in mind that there are many ways it can fail, so you might not want to use it for anything that is actually important.

Z7YCx5ieof4Std• 2 years ago

When you can't use a + use a .

Name@email.com is n.ame@email.com is n.a.me@email.com is n.am.e@email.com etc

gloriousternary• 2 years ago

Since I run my own email server, I get around some of those issues by configuring Postfix's recipient_delimiter to use . rather than +. I've never had a site treat accounts.company@mydomain.com as anything other than a normal email address. It certainly doesn't justify the effort I've spent dealing with deliverability issues, but it's a nice perk.

anArbitraryOne2• 2 years ago

Why not use proxy email addresses to prevent scripts that strip everything from + to @?

setopt2• 2 years ago

The benefit of the + is that I don’t have to set up anything in advance. I can type an email address on any device, including devices I don’t own, and still have it work as an alias.

I do have a “real” email alias as well that I use for true spam (e.g. to get “customer club” discounts while everything they send me is autoredirected to spam by a mail filter). I reserve the + addresses for things I want in my inbox, but still want to be able to filter easily in my mail client.

Numerlor• 2 years ago

I have a mail with catch all address so o can avoid the + so sites can never be strip it as it just randommail@domain, just have to hope nobody else figures it out and spams me at random addresses

Rygian• 2 years ago

Sign the random with a hash of itself and a secret, all before the @ sign, then you can tell them apart.

sph• 2 years ago

Wasn't there a cheeky post by Valve saying that most of its users claim to be born on the 1st of January?

CUViper• 2 years ago

Whenever I hit the age gate in the Steam store, I just bump the year to continue, so January 1st it is!

Psssst! Your date of birth can be a random number!

Related Stories