[dead]
Ask HN: Found a leak of US citizens personal data. Should I report it?
51–60 of 85 posts
Re: Ask HN: Found a leak of US citizens personal data. Should I report it?
#52Look for a www.domain-of-the-company.com/security.txt file. That's where you might find a responsible disclosure contact if the company has one (high chance they don't)
https://www.netflix.com/security.txt exits, but Apple, Google, Microsoft, and Meta don't have one.
That would be because I typed the url wrong, it's actually /.well-known/security.txt:
https://www.facebook.com/.well-known/security.txt
https://www.apple.com/.well-known/security.txt
Re: Ask HN: Found a leak of US citizens personal data. Should I report it?
#53Look for a www.domain-of-the-company.com/security.txt file. That's where you might find a responsible disclosure contact if the company has one (high chance they don't)
Doesn't seem like a widely used convention.
That would be because I typed the url wrong, it's actually /.well-known/security.txt:
https://www.facebook.com/.well-known/security.txt
https://www.apple.com/.well-known/security.txt
Re: Ask HN: Found a leak of US citizens personal data. Should I report it?
#54The replies to this post are almost universally depressing. Really? Reporting to the company is so obviously bad for the reporter in the USA? There is no protection from malicious prosecution just for 'reporting' a data breach. That's crazy.
it's because the patients are running the sanitarium here.
the typical cost of legal actions pursuant to a data breach are so low, it doesn't make dollars or sense to give a shit about customer infosec.
It's not like we don't have perfectly capable people, or that the companies in question don't care about information security in general. For example, it's exceedingly rare to see a data leak that makes individuals or institutions look bad from a PR standpoint (like Snowden).
But customer data? why bother? what, are they gonna slap us with a million dollar class action? I'm quaking so hard in my boots my multibillion market cap is gonna fall off.
Re: Ask HN: Found a leak of US citizens personal data. Should I report it?
#55I'm asking myself if you have freedom anymore in US/Canada if many here suggest to not reporting data leak because of consequences that it could have. It sounds like dissident behaviour from China.
Re: Ask HN: Found a leak of US citizens personal data. Should I report it?
#56Earlier quoted context omitted.
https://www.netflix.com/security.txt exits, but Apple, Google, Microsoft, and Meta don't have one.
That would be because I typed the url wrong, it's actually /.well-known/security.txt: https://www.facebook.com/.well-known/security.txt https://www.apple.com/.well-known/security.txt https://www.amazon.com/.well-known/security.txt https://www.google.com/.well-known/security.txt
TIL! That's great!
The RFC for it came out April 22 and has backing by quite a few organizations.
Re: Ask HN: Found a leak of US citizens personal data. Should I report it?
#57If you want to do the right thing and help fix it use a burner phone to send proof and let someone else break the news who actually has something to gain from it. Like a news agency local to the company perhaps. You have nothing to gain and a lot to lose.
Burner phone? Those only exist in the movies, like pew-pew silencers. In real life, mobile telecommunication systems are some of the most easily traced systems of all.
Anonymous email like ProtonMail, sent from a free VPN using a downtown Starbucks free WiFi would be far, far more opsec-friendly.
Re: Ask HN: Found a leak of US citizens personal data. Should I report it?
#58I'm asking myself if you have freedom anymore in US/Canada if many here suggest to not reporting data leak because of consequences that it could have. It sounds like dissident behaviour from China.
This is so weird to read...
"In the US/Canada things are like this. It sounds like it's China."
It's literally not China, but the US/Canada. It sounds like the US/Canada. Because it is.
Re: Ask HN: Found a leak of US citizens personal data. Should I report it?
#59I'm asking myself if you have freedom anymore in US/Canada if many here suggest to not reporting data leak because of consequences that it could have. It sounds like dissident behaviour from China.
This is so weird to read... "In the US/Canada things are like this. It sounds like it's China." It's literally not China, but the US/Canada. It sounds like the US/Canada. Because it is.
Then why fear from authorities/state?
Re: Ask HN: Found a leak of US citizens personal data. Should I report it?
#60Earlier quoted context omitted.
This is so weird to read... "In the US/Canada things are like this. It sounds like it's China." It's literally not China, but the US/Canada. It sounds like the US/Canada. Because it is.
Then why fear from authorities/state?
I don't understand your question. Care to elaborate?