<story><title>Geico data breach exposed customers’ driver’s license numbers</title><url>https://www.theverge.com/2021/4/19/22392566/geico-data-breach-exposed-customer-drivers-license-numbers-security</url></story><parent_chain><item><author>ripply</author><text>Some states driver&amp;#x27;s license numbers are deterministically computed with your name, date of birth and gender.&lt;p&gt;If you live in one of those states and your data is already out there (through a previous breach) then your driver&amp;#x27;s license number is already public knowledge to hackers.&lt;p&gt;According to an online calculator this applies to these states:&lt;p&gt;Florida&lt;p&gt;Illinois&lt;p&gt;Maryland&lt;p&gt;Michigan&lt;p&gt;Minnesota (Prior to December 13, 2004 only)&lt;p&gt;Nevada (Prior to January 1998 only)&lt;p&gt;New Hampshire&lt;p&gt;New Jersey&lt;p&gt;New York (Prior to September 1992 only)&lt;p&gt;Washington&lt;p&gt;Wisconsin&lt;p&gt;&lt;a href=&quot;http:&amp;#x2F;&amp;#x2F;www.highprogrammer.com&amp;#x2F;alan&amp;#x2F;numbers&amp;#x2F;dl_us_shared.html&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;www.highprogrammer.com&amp;#x2F;alan&amp;#x2F;numbers&amp;#x2F;dl_us_shared.html&lt;/a&gt;</text></item></parent_chain><comment><author>andrewmunsell</author><text>Back in college in Washington, I had a presentation to give in a class about privacy. To illustrate how very little of it we really have, I essentially doxxed the professor in front of everyone (of course, with his permission-- he had final say on what was actually shown to the class in the presentation) and demonstrated how public most people have their social media settings set to and what information was actually in the public record.&lt;p&gt;Apart from things like public Facebook photos and things like public mortgage records and salary info for public school professors, I used the fact the DL number was deterministic to make a really good (and apparently correct) guess as to what the number really was.&lt;p&gt;The professor was a really good sport about it.</text></comment>
<story><title>Geico data breach exposed customers’ driver’s license numbers</title><url>https://www.theverge.com/2021/4/19/22392566/geico-data-breach-exposed-customer-drivers-license-numbers-security</url></story><parent_chain><item><author>ripply</author><text>Some states driver&amp;#x27;s license numbers are deterministically computed with your name, date of birth and gender.&lt;p&gt;If you live in one of those states and your data is already out there (through a previous breach) then your driver&amp;#x27;s license number is already public knowledge to hackers.&lt;p&gt;According to an online calculator this applies to these states:&lt;p&gt;Florida&lt;p&gt;Illinois&lt;p&gt;Maryland&lt;p&gt;Michigan&lt;p&gt;Minnesota (Prior to December 13, 2004 only)&lt;p&gt;Nevada (Prior to January 1998 only)&lt;p&gt;New Hampshire&lt;p&gt;New Jersey&lt;p&gt;New York (Prior to September 1992 only)&lt;p&gt;Washington&lt;p&gt;Wisconsin&lt;p&gt;&lt;a href=&quot;http:&amp;#x2F;&amp;#x2F;www.highprogrammer.com&amp;#x2F;alan&amp;#x2F;numbers&amp;#x2F;dl_us_shared.html&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;www.highprogrammer.com&amp;#x2F;alan&amp;#x2F;numbers&amp;#x2F;dl_us_shared.html&lt;/a&gt;</text></item></parent_chain><comment><author>SilasX</author><text>&amp;gt;Some states driver&amp;#x27;s license numbers are deterministically computed with your name, date of birth and gender.&lt;p&gt;Hm, I thought that couldn&amp;#x27;t be possible: if that were true, the system would be hosed the moment two people are born that match on all three. (Insert &amp;quot;falsehoods programmers believe about ...&amp;quot;)&lt;p&gt;Reading through to the link, it claims that some states do have issues with collisions like that (but doesn&amp;#x27;t provide enough to confirm independently):&lt;p&gt;&amp;gt;&amp;gt;Looking at this, may become clear that it is possible for two people with similar names to get the exact same driver&amp;#x27;s license number. ... This is solved with &amp;quot;overflow&amp;quot; numbers, a simple sequential number can be appended to each duplicate number to resolve the confusion.&lt;p&gt;&amp;gt;&amp;gt;...Illinois may have overflow digits, but if they do the information is not on your driver&amp;#x27;s license. This means that if Joshua William Smith is wanted by police and his driver&amp;#x27;s license number is flagged as such, Jack Wayne Snoddy may be briefly detained while the police check their records to sort out the shared number. I have been told that Illinois state databases actually include a two or three digit number to distinguish between different people with the same license. One correspondent told me that their friend was pulled over for a minor traffic violation and was arrested as someone else. He sat in the police car for a while while they sorted it out. He and the other person had the exact same number; the other guy was a wanted man, but my correspondent&amp;#x27;s friend did not.</text></comment>