| ▲ | DOGE might be storing every American's SSN on an insecure cloud server(theverge.com) |
| 48 points by text0404 8 hours ago | 21 comments |
| |
|
| ▲ | gdbsjjdn 7 hours ago | parent | next [-] |
| For people who don't read TFA: > In addition to SSNs, the database reportedly includes Americans’ place and date of birth, work permit status, and parents’ names This is quite a bit more information than just a number. |
| |
|
| ▲ | JdeBP 6 hours ago | parent | prev | next [-] |
| That 65% figure in the press release has an interesting origin. It seemed oddly specific to me, so I had a look. In the actual report main text, it says that the risk is between 35% and 65%, but does not explain the calculation, if any, that results in those numbers. It's not until one reaches Appendix A that one finds that this really means that it has been assigned a value of 3 on a scale of 1 to 5, meaning "medium risk", and the value 3 is arbitrarily assigned that percentage range, originating with the U.S.A. FDA's Office of Information Security, where "low risk" (2) is similarly 10% to 35% and "very low risk" (1) is less than 10%. |
|
| ▲ | ChrisArchitect 6 hours ago | parent | prev | next [-] |
| Actual article: https://www.hsgac.senate.gov/media/dems/peters-report-finds-... |
| |
|
| ▲ | amanaplanacanal 7 hours ago | parent | prev | next [-] |
| I assume everybody's SSN has been leaked at one time or another by now. |
| |
|
| ▲ | kats 7 hours ago | parent | prev | next [-] |
| rage bait |
| |
| ▲ | another_twist 7 hours ago | parent [-] | | Right. And why is that ? | | |
| ▲ | monkeyelite 7 hours ago | parent [-] | | Might be. Did it happen or not? | | |
| ▲ | text0404 6 hours ago | parent [-] | | > As outlined in the report, DOGE staffers moved a live copy of Americans’ personal information to a cloud server despite an internal risk assessment from the Social Security Administration (SSA), which determined the impact could be “catastrophic” without the proper safeguards. Paraphrasing the article, the issue is that they operate without oversight or accountability so there's no way of knowing (this is arguably the story, not that PII may be leaked). The SSA's own security team is not allowed to review their work. | | |
| ▲ | monkeyelite 6 hours ago | parent [-] | | That sounds like a separate concern than the one implied by the headline. | | |
| ▲ | text0404 6 hours ago | parent [-] | | The headline of a news article is a way to draw the reader in. The subhead in this case was "A report from Senate Democrats says DOGE moved sensitive information to a cloud server despite the risk of 'catastrophic' impacts," with the lede (the first paragraph of the article) mentioning the lack of oversight. I can change the title if you'd prefer, but I believe that goes against HN guidelines. | | |
| ▲ | monkeyelite 4 hours ago | parent [-] | | > The headline of a news article is a way to draw the reader in. Yes, I think that’s where the “bait” characterization comes from. | | |
| ▲ | text0404 an hour ago | parent [-] | | Sure. Crappy headline. I was going to post the NYT one ("Democratic Report Says Disorder at DOGE Jeopardized Americans’ Data: Members of a Senate panel described a haphazard working and living environment that involved transferring sensitive information to servers 'without any verified security controls'") but it was paywalled. Less bait I suppose but it's still pretty damning. |
|
|
|
|
|
|
|
|
| ▲ | calvinmorrison 7 hours ago | parent | prev [-] |
| I have stored every americans ssn in a text file, you can too! seq -w 0 999999999 | sed -E 's/^([0-9]{3})([0-9]{2})([0-9]{4})$/\1 \2 \3/' | awk '{
area=$1+0; group=$2; serial=$3
if (area==0 || area==666 || area>=900) next
if (group=="00" || serial=="0000") next
printf "%03d-%02s-%04s\n", area, group, serial
}' |
| |
| ▲ | collingreen an hour ago | parent | next [-] | | What is the point of this kind of reply? To try to diminish the impression of the severity? To distract? To just make reading the contents slightly worse for everyone? It's so clearly not the point of the db in the article that there is no chance anyone reads this and thinks it is the same thing the article is referencing. Is this just really low quality trolling? | |
| ▲ | DoNotMindMe 7 hours ago | parent | prev [-] | | I'm sure they are talking about a database that only contains the numbers and no other identifying information directly linked to those numbers. |
|