Hacker News Reader

Comment by sverhagen | Hacker News Reader

Don't all sorts of person-related details come in handy to stage a social engineering hack? Maybe a caller could demonstrate legitimacy by coughing up a passport number. At this point, it may impress me more than someone having found my SSN (_love you for that, Equifax_). Yet, SSN is still by many institutions considered something that should be stored in the vault.

View on HN

>Don't all sorts of person-related details come in handy to stage a social engineering hack?

Maybe? But also maybe not really?

Passport numbers change very frequently, nobody uses them to identify people.

I don't know if you are joking or I need to break it to you that in most cases passports are the de facto identification for foreigners and passport S/Ns are being used as part of identification procedures.

> I don't know if you are joking or I need to break it to you that in most cases passports are the de facto identification for foreigners

As a perpetual foreigner I've never had to use my passport number for identification.

>passport S/Ns are being used as part of identification procedures.

Where?

In the US there are basically 2 forms of ID cards currently, one says “Federal Limits Apply”, the other does not. The one that says “Federal Limits Apply” requires a backup identity document to verify in some cases like buying a gun, or flying. Passports are often used, and while the TSA is going to verify the info on the passport, others likely will just verify if it looks real enough or check that the number actually exists and go no further.

They change frequently? My passport is the longest-lifetime form of ID I'm offered, the absurdity of using Social Security Number as an ID aside. Most passports last for 5-10 years in my experience, and I'm not sure the number changes when you renew it.

> I'm not sure the number changes when you renew it.

Of course it does. Numbers used to identify people generally don't. Passport number identifies the individual document, mostly so it can be checked against INTERPOL's SLTD database.

Reply on news.ycombinator.com