Schneier on Security

Clive Robinson • December 5, 2025 7:21 AM

@ Bruce, All,

First off I’m not saying that this is a bad idea, but that that there are “gottchers” with all such systems that people need to be not just aware of, but know how to mitigate to an acceptable level.

So… With regards to,

“… allows you to sign up with just a zip code.”

Thus the question,

“Just how anonymous is a zip code?”

The answer is unsurprisingly “not very”. It was something Prof Ross Anderson spent some time considering with the UK equivalent of “Post Codes”.

In both cases of zip and post codes they are set up as a convenience for a service provider and to act as a form of “checksum” on an address.

Like Social Security numbers they get used by others for purposes that they were not originally intended for thus they suffer from “organic growth” and the consequences of that equivalent to,

“A weed infested flower bed in a seriously over grown garden.”

From personal experience I know of a UK post code that only had one occupied property in it. Due in the main to turning the rest of it into a “brownfield site” by bulldozer,

https://en.wikipedia.org/wiki/Brownfield_land

Thus it falls to just how anonymous is the “official occupier” of the property?

The same sort of thing applies to all such “tagging and checksumming” schemes that “hash”. They don’t actually offer anonymity they are generally not “One Way Functions” so give just complication and complexity to reverse back thus de-anonymize. As we should know that is what “Rainbow Tables” were invented for,

https://en.wikipedia.org/wiki/Rainbow_table

Then if you move in and move out of a post / zip code the complicated question of “wire fraud” and “postal fraud” arises.

There are quite a number of other gotchers in both the US and UK that I’m aware of that would apply to similar schemes and very new legislation in the UK only makes this worse a lot worse,

The UK Public Authorities “Fraud, Error and Recovery”(FEAR) Act 2025 officially stated purpose is to enhance the government’s ability to tackle fraud and recover debts owed to the taxpayer, etc.

What should scare people is the “etc” that makes it a very nasty set of Privacy Invading and Surveillance legislation handed out to those with vested interests to claim faux debt etc, and criminalise without evidence.

Such legislation is becoming more and more popular as things turn increasingly authoritarian, and many countries world wide are putting similar legislation and regulation into place, that effects all levels of communications that people are increasingly forced to use in a “collected way”.

For instance “Online Finance” it’s got to the point where the only way you can communicate with your bank is via a fully registered “Smart Phone”, app, and Email, all of which are basically a backdoor access into your private life.