Hacker News Reader

Comment by yegle | Hacker News Reader

Chinese Netizens are very familiar with Xi Jinping's national ID number precisely for this reason :-)

ID verification is enforced on all Chinese websites. People figured out they can just use Xi's ID number.

This is not true. A) personal ID numbers are not publicly available (you could certainly get your hands on some, but I doubt a lot would know Xi's ID), and B) more importantly, nowadays ID verification in China uses more sophisticated methods, e.g. in order to not be restricted when playing games, users need to prove they are over 18. The user would permit the game to verify through a payment provider such as Alipay (I don't think one would even need to give their ID to the game, as it is handled by Alipay which has done KYC already).

Although I suspect such ... "innovations" ... would soon get to the western world including UK.

> ID verification is enforced on all Chinese websites.

Is that really true? So search engines? News sites? Pseudo-anonymous discussion forums?

Yes. You need an ID to use the internet.

What about visitors?

You don't need an ID just to use the internet in China...

Roaming is VPN. And if you want fast one outside firewall you can grab HK esim like soSIM. And this one only needs any passport photo w/o face verification.

Stop talking nonsense.

Don't listen to the sibling commenter who doesn't know what they're talking about.

No, you don't need ID verification to use search engine or read news in China.

However, sites that depend on user-generated content (like forums) would ask for at least your phone number.

How easily can a burner be used?

Are sim cards easily swapped?

Not sure about now. It was before the covid. Keep in mind everything is done via weechat anyway now days.

Anyone from behind the great wall care to comment? Is HN event reachable from behind the great wall with out Tor?

> Are sim cards easily swapped?

Very easily. Apple even specifically introduced dual-sim iPhone for China.

> How easily can a burner be used?

You need to bring your ID to a telecom to get a phone number legally. But I don't know if there is a black market for burner sims.

(Last time I've been there was a few years ago so take it with a grain of salt.)

> Very easily. Apple even specifically introduced dual-sim iPhone for China.

Because they don't support eSIMs there.

Burner sims have been a thing of the past in China for quite some time. The official rationale I believe is to curb telecom fraud, which in turn left China and started doing their business in southeast Asia.

There is no such thing as "burner". Phone number is very hard to get and requires ID verification and sorts

It's very easy to get. As a visitor, I got one in the airport for $20. "ID verification" is stretching it, but like so many things in China it requires the vendor to take a photo of your ID, and unusually also to take a photo of you and submit it to the telecom website.

Have you tried to use it to register for any website? It likely won't work.

This kind of SIM card worked fine for me to register for several online services in China earlier this year, including a Chinese ride sharing service and online shopping.

No, but some features are locked until you do. For example, you can join voice chat rooms on Xiaohongshu, but can’t turn on your camera until you verify ID. You can join others’ broadcasts but you can’t create your own, etc

You can have "read" access anonymously (with a big asterisk, see the end), but as soon as you need "write" access, the service provider (the website etc) is legally required to verify your ID. It's why there's no pseudo-anonymous discussion forum in China, at least legally.

Source: https://www.gov.cn/xinwen/2016-11/07/content_5129723.htm

> Cybersecurity Law of the People's Republic of China, Article 24: When network operators provide users with network access, domain name registration services, fixed-line and mobile phone network access procedures, or provide users with information publishing, instant messaging and other services, they shall require users to provide real identity information when signing an agreement with the user or confirming the provision of services. If the user does not provide real identity information, the network operator shall not provide the relevant services to the user.

The big asterisk: there's no anonymous internet service in China, you have to ID yourself to get access to the internet (article 24), and the service provider are required to keep record of you (IP and everything) (article 21), and they are also required to cooperate with the authority (no surprise here) (article 28). And using VPN or Tor is likely illegal (article 27).

lol on a much lighter note, for many years I used to use 111-111-1111 as a general phone number for CVS card discounts. It stopped working several years ago though.

I used 888-888-8888 at Target yesterday. Shhh.

As a Canadian I was lost and confused when visiting the States (in the before time) and a gas pump asked for my zip code. So I put in the one and only zip code I know. I bet you can guess.

Glad you could come visit from Beverly Hills ;)

EDIT: actually, depending on your age and what you watched on TV, maybe you were visiting from Boston?

Did it work?

It probably did. I was in the us this summer and was similarly confused that the pump wanted a us zip code for a foreign card. I input the zip for the address i was staying at and it worked...

Huh. I'd always assumed the zip code was validated against the card's billing address but maybe it's actually for some kind of market research. I'll have to try myself.

Following up: I tried a valid but incorrect zip code recently and the transaction was declined. Presumably this is because there is a valid one associated with my account?

Yeah. Random numbers wouldn’t but it did. I assumed it had to be a valid zip code.

Ubow Tubu Wobun Thrube Fubor?

https://www.youtube.com/watch?v=WHjMEwZt5OE

Close!

https://youtu.be/XanjZw5hPvE?si=Og-5iyLzjxebT6EF

I was inputting for ages.

I used to use that one too, but you're supposed to put the 3 numerical digits of your postal code followed by 00. (I have no idea how you're supposed to know that though.)

Really? Or does that just work because it's numbers? I can't imagine how that's useful because without the letters the same 12300 could be in Vancouver or Montreal couldn't it?

I don't know much about credit card validation, but I have the impression that the zipcode is just one more correlation that tells them you're more likely to be the real owner of the card.

If the 3 numbers I type match the 3 digits of the owner's postal code, it's probably a reasonable signal that I'm the owner (even without the letters).

XXX-867-5309 still works everywhere I try it, where "XXX" is the local area code.

I have also used XXX-555-1212, and it has worked everywhere.

This reminds me: I've noticed that Starbucks now requires a few pieces of information to use their WiFi network. One is email and they are doing some sort of validation which will reject emails like whoopsileanedonxxxxxxxx@aol.com but will accept other, legit AOL emails. How are they deciding what is/not a valid email? Are they using a compiled list of emails that have been seen in the wild? What if it's a brand new address, though? Presumably AOL isn't exposing a service for them to use in realtime. I haven't tested this extensively or with other providers.

It's obvious that they care (to some extent) that they're getting valid emails, so why not use a basic regex on the FE and an OTP which gets sent to the provided address?

> why not use a basic regex on the FE and an OTP which gets sent to the provided address?

I can't prove I control an email in order to use your wifi, if I can't use your wifi.

That's a great point. I guess I'm so conditioned to various 2FA methods that I take some amount of access (i.e. mobile) for granted.

Some wifi networks give you a limited number of minutes online during which you need to click a verification link they've emailed you in order to not get cut off.

They can connect to a mail server and pretend that they are going to send a message and the server would reject the invalid recipient email.

I had no idea this was possible. This sounds almost like an HTTP OPTION request. I'd love to find an example of client code which does this.

You're looking for the SMTP VRFY and EXPN commands. However implementation is very hit-or-miss. In the good ole' days of the internet, VRFY was widely implemented. Then spammers realized they could connect to a mailserver and do a form of a VRFY dictionary attack to find valid addresses, so it stopped being supported.

Use *@example.com, it usually works.

Lookup the stores phone number of maps. That usually works.

Reply on news.ycombinator.com