Hacker News Reader

Comment by port3000 | Hacker News Reader

My name in Claude is Silly Bean. I did it at first because it made me chuckle every time I opened Claude and it said 'Back again, Silly Bean?'

But turns out I was playing 4D cybersecurity chess

View on HN

I’ve been recommending the use of consistent lies about name and date of birth to online systems since Eternal September began. Very few sites and systems justify accurate PII, and even for those I often still maintain dual accounts/profiles as necessary.

Completely agree. I use randomness for all of these now – plausible randomness if it’s possible I’ll have to give it over a phone.

strongphrase.net is good for this.

I like using a date of birth of 1 January. It's plausible but also hopefully suspicious how many people seem to be born that day if others do the same.

But if an attacker gets your fake birthday and uses that to successfully reset credentials on another site that uses the same fake birthday?

At some point it becomes your birthday of record as far as the internet is concerned. Doesn’t matter what the actual record says.

No service should use date of birth for password resets.

If an attacker can do that, they could also do that with my real birthday had I used that. My birthday isn't a secret against anyone who wants to look hard enough. Therefore this method doesn't provide any kind of security against attackers gated only on knowing my registered birthday. I never claimed that it did.

The purpose of the fake birthday is not to protect random website credentials. It's to prevent someone with that data from walking into my bank and impersonating me. I started giving a fake birthday after being shocked by how little info some organizations needed to authenticate me.

“My voice is my passport. Verify me.”

Same, my D.O.B. is 1/1/1970 for anything that doesn't justify having the real deal.

That's also great for integration testing their systems, if they have any code in a language where datetimes are a value type.

I heard from a number of Syrian refugees that this is actually very common in countries like theirs, where births may not be recorded, records are lost or destroyed. Some people don't even know their exact date of birth and they would typically enter January 1st on forms like this too.

I use the 1st of my birth month. Slightly less suspicious? It's at least a little easier to remember. Generate fake profiles and identities usually is easier when you have bits that are rooted in your actual reality. Like, you have the same zodiac sign either way in this case, so you don't have to remember two of everything. Or if you're talking about a birthday trip, or related birthday thing from the past, details about the weather would be consistent, etc.

That never works on Facebook though, because as soon as a ”friend” reports that ”I’m not me” then the account will be permanently banned. That also triggers for photos that’s not genuinely me, like a pet or drawing as portrait.

There is an easy solution: don't log into facebook. Anyone you want to talk to on there has a phone.

Are many folks on HN using Facebook? To me, most tech savvy folks I know left it a decade ago. All the FB users I know are 60+

Unfortunately, a lot of college-age people I know are getting accounts simply for access to Marketplace, which is still unmatched compared to other local platforms for buy and sell.

There are honestly some really good groups on there. Sadly, frustratingly, Facebook Groups has replaced the forums of olde in a lot of situations.

Marketplace has taken over literally all of the other reselling websites and apps.

Try finding a decent car on Craigslist today.

Never? Facebook is pretty overrun with what are basically fake profiles. Hell, I've been curating an alter ego on Facebook for over a decade. Built up a profile with several dozen "friends" that are all kind of interconnected and regional, but of course none of them have ever met "me" IRL, and the profile picture is a funny-ish celeb pic. Facebook has millions of legit users that are "friend collector" types, and won't think twice about engaging with an account that gently strokes their online ego with likes, "Happy Birthdays", etc.

... and nothing of value would be lost.

Jan 1st, 1984 every time

April 1st, 1984

even better

My first name can be shortened, and I go by either. When I first signed up to Claude, I thought we were entering the world of artificial “intelligence”, so I told it my name was “<long form> or <short form>”.

Well, it hardcodes that field rather than running it through the model, but I’ve kept it so I get an evil chuckle to myself (or perhaps pyrrhic reassurance) at its lack of smarts and a reminder that it’s still a somewhat subservient product experience that isn’t all that smart after all.

I set my name as Sir and I enjoy the obsequious responses this generates :-)

It worked well in my banking app too which greets me with " Good morning, Sir" which is the level of relationship I want with my bank!

I must have made a claude.ai account when they first launched and forgot about it. Last week I logged in (through google) to get a subscription and it greeted me as "Hello, Master". I thought it was quite edgy at this day and age. :)

My Claude name is dude. It has worked well.

Claude & ChatGPT can still see your name on your payment information I bet.

But now it will match Silly Bean to port3000 and every comment you've made.

Oh...well I am a Silly Bean!

No, I am also Silly Bean.

Reply on news.ycombinator.com