TMG-L Archives

Archiver > TMG > 2005-07 > 1120447328


From: "Darrell A. Martin" <>
Subject: RE: [TMG] OT - Living privacy (was: Transgender Change)
Date: Mon, 04 Jul 2005 03:22:08 +0000
References: <6.2.1.2.0.20050701034113.03ff4170@pop.sprynet.com><LPBBJNIOBJEJOGJFMDGJGECLHDAB.ddburghart@cox.net>
In-Reply-To: <LPBBJNIOBJEJOGJFMDGJGECLHDAB.ddburghart@cox.net>


At 04:35 AM 7/1/2005, DeAnna Burghart wrote:
><grins> Splitting hairs, Darrell. I wasn't referring to anonymity, but
>privacy, which is why I chose those words in the first place. I'm not saying
>she shouldn't be necessarily included in reports to strangers, but that it's
>absolutely out of place to include any information about her sex change --
>that is not an *identity* but rather a *happening* -- and a very private one
>that isn't, frankly, anyone else's business unless she chooses to make it
>so.
>
>Of course, one *could* go so far as to say that living individuals shouldn't
>be published at all in genealogical reports, and though that wasn't what I
>was advocating in my post, I'm increasingly leaning toward that position. I
>was positively aghast to discover, for instance, that the personal and
>financial information of several close family members -- including my
>husband -- was recently stolen. One might say that wouldn't be a problem if
>one uses secure passwords anyway. I was much chastened, though, to find that
>simply typing their names into Google was enough to reveal mother's maiden
>names, father's maiden names, birthplaces, etc. ... all a result of my
>apparently naively overzealous documentation and trusting sharing of data as
>much as a decade ago. And the cat's out now. And if they're ripped off, I
>will be partially complicit, for making it so easy to obtain personal
>information that can be used to defraud or impersonate them. And there's not
>a damn thing I can do about it at this point.
>
>So, no, it may not be practical -- I used to get carded too. (I miss those
>days.) But given the unusually sensitive nature of the information that we
>accumulate, that doesn't mean it's not prudent. Safe, sorry, etc. ;)
>
>DeAnna

Hi, DeAnna:

I'm writing from Ellsworth, Maine, where we just left a campfire on Weymouth Point (actually in Surry) where you can actually see the STARS. And I don't mean the 14 brightest, which are about all that can be seen from the Chicago suburbs.

I think that the two of us, in terms of what we would actually reveal about a living person without that person's approval (I will not use the term "permission") is actually very close. But I do want to say a few things that are a bit technical, about the idea of a mother's maiden name being a threat to one's financial records.

1. There is not one single case of a mother's maiden name being a *significant* factor in an actual case of identity theft or identity forgery. The one case in which a maiden name was used, to defraud a San Diego credit union as I recall, involved a woman using her *own* maiden name. I don't think she downloaded that information [grin].

2. It is an axiom in all areas of security that no piece of static information, that is, a fact which cannot be changed, should *ever* be used to authenticate identity. One's mother's maiden name is a part of your identity, which is -- and *ought* to be -- quite public. Proving that one is the person so identified should never involve part of the identity itself. It is, both in theory and in practice, quite the same as someone saying, "OK, prove that you are Darrell A. Martin. I have two questions to ask you. First: what is your last name? Second: what is your first name?"

3. A lawyer for the Federal Trade Commission, the U.S. agency with the responsibility for protecting Americans from identity theft and identity fraud, said in a seminar on this topic, "Any organization that uses a mother's maiden name to establish identity is incompetent to the point of negligence." This was about six years ago, as I recall. One significant point he made is that for Latinos, for example, their mother's maiden names are often part of their legal names, and therefore appears on their drivers licenses and every other legal document they execute.

4. It is incredibly simple to defeat the "mother's maiden name" threat. Simply tell every institution with which you deal, that your mother's maiden name is "Superman" or "Mordor" or "Qwertyuiop". Anything you can remember, but that an evildoer can't find out about you because it is not a fact *about* you at all. *DO NOT* accept *ANY* argument that the "real" maiden name is needed; in fact, if your bank insists, get a different bank. It means their security policies are at least a decade out of date, and they are going to lose your money anyway. And I am neither joking nor exaggerating. The FTC does not go so far as to say to switch banks, but their recommendations on mother's maiden names agrees with what I have just told you.

Darrell

Darrell A. Martin

a native Vermonter currently in exile in Illinois
http://www.darrell-martin.net/genealogy/

This thread: