Hacker News Reader

Comment by turar | Hacker News Reader

If you own a home in the U.S., anybody already can get your address legally and easily from your county or district property appraiser's/assessor's website. Along with how much you paid for it, and when you bought it. So calling Amazon CS rep is a hard way to go about it. :)

View on HN

Ah... if you're a resident of Sweden, anybody can get your full name, address, date of birth, civil status, list of company engagements (e.g., board member, owner of a firm, etc.) and the make and year of any cars registered by going to one of several websites - http://www.ratsit.se/ being one of the most popular ones. No login needed. This information is public data straight from the government. (Exceptions: people < 16-18 years old (afaik), and people with protected identity (about 15K out of 9.8M)).

Call or visit the Swedish Tax Agency if you want further info, such as personal identity number ("personnummer" - think Social Security Number but used for absolutely everything), taxed income, identity and full info of parents (including mother's maiden name - so much for that), etc. You don't have to tell them who you are or why you want this information.

Enter a street address on a site like ratsit.se and you'll find all the people registered on that particular address. I could go on. When I talk about this with friends in countries like Germany and France they're often flabbergasted; in Sweden we're so used to it that we think it's natural. We're basically doxxed by our own government by default. A stalker or identity thief's paradise. It's messed up.

Though, I would wager that very few Swedish companies consider any of that information as a "password", as seen in the article...

Overseas companies would though

I believe that such openness from the govnerment is actually helping you implement a more sound security procedure. If all of that information is well known to be publicly available, there is much more awareness that it is unless as authorisation.

Having someone's personal identity nummer (personnummer) is in itself enough to do a lot of damage.

Many Swedish online shops will happily send you goods along with an invoice that you pay later. The invoice option is often only available if you provide your personnummer - which as I mentioned is public information, a phone call away - and have the goods sent to the address tied to that number. If you live in a house with a mailbox outdoors, a thief could order stuff to your address and empty the mailbox before you. "Stuff" could also be things like mobile phone subscriptions and whatnot.

Or, having your personnummer, someone could send a form to the tax agency to have your official address changed! I believe they do send a letter to the old address saying the address has been changed to <new address>. But there's time to do bad stuff in between the time of the change and your discovery of it. (If, indeed, you do discover it. You might be traveling somewhere, a fact that might've been gleaned from your social media activity.)

And, as breakingcups points out above, even if it were the case that sound security procedures were implemented in Sweden, that wouldn't matter much for the numerous non-Swedish services most Swedes use every day.

Anyway -- people being able to do stuff in your name is just one thing. I don't want the whole world to know my address, or marital status, or date of birth, etc - period. It's about privacy.

Although they probably can't get this information if all they know is your domain name.

If you are the officer of a company you own in the U.S., anybody can get your address from the annual corp. report.

It's the same in most countries. Opencorporates.com is the first place to look. Some countries, like New Zealand, have images of corporate documents online for free, which gives you a copy of the signature as well.

Like domain names, privacy when you have a company is hard.

Hawaii county removed the ability to search by name several years ago. You can still get name and mailing address for any property, but you have to search based on the physical address or otherwise query the correct property record. You can't just do a "let's see what John Smith owns" type of search.

You MIGHT still be able to search by name in the old fashioned way, by going into the office, but I am uncertain about that.

Buying the property through a Revocable Living Trust can make this harder (providing the name of your living trust doesn't contain your name, like most do!). Can cost only a couple of dollars to record the living trust, plus it helps with estate planning. Make sure the utilities are in the name of the trust as well, so they don't share your name+address.

The amount of available data varies by state. In TX, for example, sale prices are not disclosed.

But the deed of trust the buyer signed is in the public record (every Texas county of medium-to-large population has scanned land records online) and has the amount of the mortgage issued on its front page so that gets you close. That goes double if the form has an FHA case number at the top because it usually means the deed of trust is within 5% of the purchase price.

No, not all of the time, but very often enough to make it useful for social engineering.

Reply on news.ycombinator.com