Hacker News new | ask | show | jobs
by nulagrithom 4373 days ago
The fear of the SSN input in the comments is interesting. That was my knee-jerk reaction as well.

I'm not saying the fear is unwarranted, but do you know where your employer is inputting your SSN and where they keep it? How safe do you think your personal data is?

I built an employment application 'web app' for a job not too long ago. It was terrible, and against all my objections, we ended up asking for the applicants SSN. It certainly wasn't secure by any stretch of the imagination, and I cringe a little every time I see an application come in. I'm sure this sort of thing happens daily.

Anyway, I went ahead and put my SSN in to Checkr. It came up with an address I've never lived at, next to 3 addresses I actually have lived at. Not sure what that's about.

3 comments

I'm not saying the fear is unwarranted, but do you know where your employer is inputting your SSN and where they keep it? How safe do you think your personal data is?

Regardless of whether I think it's safe or not, the reality is that I can sue my employer if there is something malicious. My employer is also naturally incentivized to make sure nothing happens to my identity (because if they did I'd leave the company, and he/she would lose a resource).

I'm not saying your employer would do something intentionally malicious either. That's just silly. If something happened to your identity, the breach would likely never be tracked back to your employer.

The point I'm trying to make isn't that you should go ahead and put your SSN in to random websites, but you need to realize your SSN goes a lot of places. Within the last hour I happened to find my parents' names, signatures, DoB, address, and SSNs in public documents from a county website. Keep track of your credit and watch for identity theft. Knowing that you are careful won't help as much as you think. Who knows who will end up using Checkr?

if OP open sourced the code I would feel more comfortable about it. its weird that the first thought of hesitation was "that's weird they didn't do any customization to bootstrap" then this: http://builtwith.com/?https%3a%2f%2fcheckr.io%2f

I dont see any backend language or framework. what does this mean?

It simply means there's no obvious fingerprint that builtwith.com was able to detect.

For example, the default Express app contains `X-Powered-By: Express` in the response header. Ruby on Rails is usually sniffed by its predictable cookie signature.

You gain nothing from broadcasting your back-end stack to the world.

bultwith.com just scans web pages and guesses front-end libraries. We use Ruby/Sinatra/MySQL/MongoDB/IronMQ for the back-end.
I would have a _lot_ more trust in my employer than some random, anonymous web site on HN. Even if I might think my employer would screw it up.