Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Did anybody go through the verification process when ordering the device? After I input some basic info (like my birthday and last 4 digits of my SSN), I was asked to answer questions I have no idea how they even came up with.

One example is, "What hospital did you live near when you were on RandomName St.?"

How did they immediately know what street I lived on some years back, and also that it was near a major hospital?

The authentication was all pretty impressive, but kind of creepy too.



They must be using KBA (knowledge based authentication) service for identity checks. There are data aggregator companies (big ones are the credit bureaus but there are others as well) who compile all sorts of orthogonal data points about you (like the color of your first car, your mortgage amount) and in theory generate identity check questions that only the real you can answer all of them correctly. Some more info: http://www.rsa.com/press_release.aspx?id=9459


That doesn't seem like a useful security question at all. Anyone can trivially find out the answer via online maps, and meanwhile the actual person who lived at that location might not necessarily know the answer themselves without looking it up. At most, if you use it as a trick question ("Hah, caught you, the person you wanted to authenticate as never lived on RandomName St!"), you get one bit of information, which you could get much more straightforwardly by asking "Have you ever lived on RandomName St?".


Street names are quite common though, knowing the street name is unlikely to give you enough information to answer the question. The real person however, would know the location of the street and be able to use this to look up the right answer if they didn't already know.


I suspect they request your credit report with your personal info (if you are a business requesting the report on someone else, you don't need the full SSN) and pull the information from there. Finding a hospital near your address just requires knowing where hospitals are, and those are in public directories.


What I found weird was how out of all the landmarks around where I lived, it picked up on the biggest, the particular hospital in question.

Maybe the question is a standard one, and I happened to add more meaning to it by dumb luck of where I lived.




Consider applying for YC's Fall 2026 batch! Applications are open till July 27.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: