If you're that curious, go ahead and post all of your PII in this thread and find out what happens.
Something tells me you won't. The reason you won't, is the answer to your question.
Ask HN: So what if my personal information gets stolen?
21–30 of 77 posts
Re: Ask HN: So what if my personal information gets stolen?
#22It depends on what you mean by 'etc'. The problem might not be in a single leak, but with enough leaks people can get access to all kinds of PII (personally identifiable information). It's important to me that my physical address not leak, I don't want people or packages showing up that I didn't ask to show up. If your important numbers (in the US that's passport, social security, and driver license) get leaked, it b…
> It's important to me that my physical address not leak
How do you avoid the people-search sites coming up in Google? When I search my name, Google instantly provides several Whitepages-like sites with my full name and address. Some of them (actual Whitepages included) provide options for removal, but there are so many and they all pull from the same source that it's a losing battle.
Re: Ask HN: So what if my personal information gets stolen?
#23Earlier quoted context omitted.
> It's important to me that my physical address not leak, I don't want people or packages showing up that I didn't ask to show up. What is the likelihood of being a target of this? Are there people out there that you expect might want to mail you an unexpected package or stalk you at your home? I get that there are people who have stalkers and such, but for the average, random person, what is the likelihood a crimina…
>What is the likelihood of being a target of this? Are there people out there that you expect might want to mail you an unexpected package or stalk you at your home? As we see in the instances of so-called "revenge porn", you don't have to be famous to be the victim of these tactics. It just takes one person who becomes annoyed enough to use some of these tools and then you're left with an expensive and time consumin…
> Did you have a nasty break-up? Fire someone? Do you have a business rival who would like to see your reputation ruined?
If you were dating someone, worked at the same company, or even in the same industry and know the same people, they do not need a data leak from Marriott to get your address. That has nothing to do with data leaks.
Maybe, maybe, you could conceivably piss off some Mr. Robot Darknet-wizard on a forum who would then spend hours combing through leaked data to try to figure out who you are so they could mail you some anthrax, but I'm going to put that at "get hit by an asteroid" level of things to worry about.
As far as "take the risk seriously", what is there for an individual to do? I have zero control over the data security practices of Equifax, Marriott, or any other major corporation. I can just avoid their services, but that would basically entail living completely off the grid and being a hermit. If it were something as simple as locking a door, or putting your backpack in the trunk, yeah, people would do it. But all of this "the sky is falling, freak out now!" propaganda, comes with absolutely zero actionable items that the average person can do. I'm not going to waste my life being worried about things I have no control over.
Re: Ask HN: So what if my personal information gets stolen?
#24It depends on what you mean by 'etc'. The problem might not be in a single leak, but with enough leaks people can get access to all kinds of PII (personally identifiable information). It's important to me that my physical address not leak, I don't want people or packages showing up that I didn't ask to show up. If your important numbers (in the US that's passport, social security, and driver license) get leaked, it b…
> It's important to me that my physical address not leak, I don't want people or packages showing up that I didn't ask to show up.
Because you think your physical address doesn't otherwise exist? Or are you talking about packages personally addressed to you?
Re: Ask HN: So what if my personal information gets stolen?
#25As long as people will think that privacy is a normal thing to seek, we'll keep using personal information and secrets as authentication methods, and those whose data leaks will suffer the consequences.
What we should do is think about the post-privacy world, where all data is available to everyone. We won't be able to keep secrets and passwords anymore, but we won't have to secure them either, as we will have better authentication methods. No more paranoia, encryption, or fear of data leaks.
It blows my mind how few people are willing to concede the benefits of transparency, even if they're not willing to fully endorse it.
Re: Ask HN: So what if my personal information gets stolen?
#26It depends on what you mean by 'etc'. The problem might not be in a single leak, but with enough leaks people can get access to all kinds of PII (personally identifiable information). It's important to me that my physical address not leak, I don't want people or packages showing up that I didn't ask to show up. If your important numbers (in the US that's passport, social security, and driver license) get leaked, it b…
The relation between full name, telephone number, and physical address is not secret at all. Sometimes I feel like I'm the only person who grew up with a phone book.
The financial sector abuses some of the more obscure facts about people (SSN, DL/passport number, bank account number, address history, mother's maiden name) as authenticators. They aren't. In the short term, someone can create a lot of bureaucratic hassle for you by knowing these facts. In the long term, institutions will adapt to the reality that knowing them no longer proves anything.
The stuff you should really care about, IMO: Contents of private conversations. Interests and opinions expressed online that could harm real-world relationships. Habits and characteristics that could signal insurance, credit, or crime risk. Political activity far from mainstream. Relationships with controversial or high-risk people. Evidence of excessive wealth for your context.
The fact that person with your metadata exists and does normal life things like having a home, a job, a cell phone, and a bank account is always going to be well-known. This information is more or less neutral. The real secrets are those which might prompt some actor (friend, lover, ex-spouse, family member, boss, insurance underwriter, lender, police, secret police, conman, vigilante, person who is wrong on the internet, etc) to turn against you, or to do worse damage than they would otherwise.
Re: Ask HN: So what if my personal information gets stolen?
#27when and where the info comes from is important. someone could, over time assemble a dynamic probability schedule of your physical location, this is not good if you are physically meek, extremely rich or integral to government or industry, AKA kidknapping or worse
Unless you are in the 0.1% it is very unlikely that the effort required to do that and kidnap you is going to be worthwhile.
oh im sorry what i was suggesting is hard to do?
how about pervs and thier motivations.
Re: Ask HN: So what if my personal information gets stolen?
#28Possible target for spear phishing (easier to social engineer when more information about a target is public).
Account take-over if the password was used elsewhere (credential stuffing).
Become a target for Extortion or Blackmail: https://www.troyhunt.com/the-opportunistic-and-empty-threat-...
Edit: Some companies still use birth dates, security questions or social security numbers for identification. If the information is public, any one can identify as that person via a phone call. https://krebsonsecurity.com/?s=SMS&x=10&y=14 https://krebsonsecurity.com/2018/10/voice-phishing-scams-are... https://krebsonsecurity.com/2018/08/hanging-up-on-mobile-in-...
Re: Ask HN: So what if my personal information gets stolen?
#29Earlier quoted context omitted.
Unless you are in the 0.1% it is very unlikely that the effort required to do that and kidnap you is going to be worthwhile.
oh im sorry what i was suggesting is hard to do? how about pervs and thier motivations.
It's not only hard, it's completely unnecessary. Most people are assaulted by someone they know in real life. You don't need gigabytes of data and a "dynamic probability schedule" to figure out that someone is at work during the day and at home in the evening, and they probably take one of 2 or 3 convenient routes to move between the two. If they actually know their target, they might even know something more like "they have a yoga class on Wednesday evening".
For a second, pretend you're one of these "pervs" you're worried about. Are you going to randomly pick a name out of a data dump from Marriott's database, and try to correlate that with other leaked data to figure out the likelihood of this person you've never seen standing on a particular corner at 5:37pm on November 3rd?
Or are you going to say "Sharon from accounting smells nice, I'm going to follow her home after work"?
I think the latter is something more reasonable to worry about.
Re: Ask HN: So what if my personal information gets stolen?
#30As long as people will think that privacy is a normal thing to seek, we'll keep using personal information and secrets as authentication methods, and those whose data leaks will suffer the consequences. What we should do is think about the post-privacy world, where all data is available to everyone. We won't be able to keep secrets and passwords anymore, but we won't have to secure them either, as we will have better…
> What we should do is think about the post-privacy world, where all data is available to everyone.
Either I don't fully understand what you're suggesting, or you don't fully understand what you're suggesting. ;)
Right to privacy is part of the Universal Declaration of Human Rights for good reasons. Violations and abuses of privacy have done a lot of damage to a lot of people throughout history.
So what does authentication even mean to you if all data is available to everyone? Why would you still need to authenticate?
Do you think it's a good idea for me & everyone else to see your bank balance? Personal emails? Personnel reviews at work? Letters to your girlfriend? Late night browsing habits? Purchase history? All your photos along with the video feed from your phone?
I don't see privacy ever not being a normal and reasonable thing to seek, not to mention rather important for developing democracies and as some protection against government abuses.