Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dell Computers Has Been Hacked

10zenmonkeys.com

Post reply on HN
Print view View original

111–120 of 218 posts

Re: Dell Computers Has Been Hacked

#111

Post by [deleted] »

JupiterMoon wrote: post #79
tombrossman wrote: post #75

Earlier quoted context omitted.

Tracking server-side is fine, it is assumed the server logs contain a record of my visits and I have no problem with that. I think what most people object to is the third-party tracking that so many people use. Company A tracking my visits to Company A's website = OK Company A using Google Analytics to track my visits (while also enabling Google to track me across multiple sites) = Not OK EDIT: (replying here as we'v…

I agree with your position. However... You misunderstand. There have been several commentators here on HN saying that they are moving Google Analytics server side. They seem to think that people are only objecting to the cookie or the presence of the JS rather than objecting to the pervasive cross-site tracking.

[deleted]

Re: Dell Computers Has Been Hacked

#112

Post by damian2000 »

acomjean wrote: post #3

Am I the only one thinking that we've lost total control over the machines and data we've created. It seems like nothing is safe and or verifiable anymore. Add to this the backdrop of governments wanting backdoors. People calling you in the US pretending to be from the "IRS" and yet nothing is/ can be done about it? Maybe its really high time for C and its buffer overflows to go... And SQL injection. We're tech savy…

Because there's huge amounts of money at stake, I believe banks operate with a far higher level of security than average companies doing business online ... for them its an existential threat.

Re: Dell Computers Has Been Hacked

#113

Post by wuschel »

krick wrote: post #97
branchless wrote: post #96

Earlier quoted context omitted.

Banks are disgusting. They get a cut already from the purchase which ought to be more than enough to deliver this and make a profit. But no it's not enough. I don't use facebook but do use a credit card. Hard to opt out of that in the modern world. God these people are filth.

Well, I don't know how hard is it in the USA, but I use cash most of the time and know several people who do the same. Sure, sometimes you need to make wire transfer, or pay with credit card, or paypal for that matter. But at least shopping in the supermarket is possible with cash.

Then I do hope that you do not own a cashback etc bonus card, or your can be quite sure that your personal consumption related high resolution data will end up in some buyers pocket.

And all that for a cheaper (and cheap) bread-knife.

Re: Dell Computers Has Been Hacked

#114

Post by wuschel »

anc84 wrote: post #101
dcposch wrote: post #85

Earlier quoted context omitted.

I assumed that when I buy something on a card, it's more or less private. The transaction should be known only to: me, the merchant, our respective banks, Visa, and I guess the IRS if they come and ask for it. If I understand correctly, youre saying my entire purchase history is shared with random third party marketing companies. Full transaction data, PII included, no anonymization. How is that even remotely OK?

Now you know why some countries like Germany like cash. It's anonymous by design.

True. But there are already solutions in place to undermine this anonymity e.g. the bonus card system (see previous comment).

Re: Dell Computers Has Been Hacked

#115

Post by krick »

toyg wrote: post #110
krick wrote: post #91

Earlier quoted context omitted.

You mean GoogleAnalytics-tracking on the server side? Please expand on that, I'm not very versed in all that marketing spy-modules. Do you mean that some internet-shop (or blog or whatever) makes a request to GA or some similar service to share that I was at their website? If so, what information do they share? My IP, cookies or what? I always assumed that very point of GA was outsourcing tracking users to some other…

Even just your UA string is enough in most cases to make educated guesses. See here: https://www.eff.org/deeplinks/2010/01/tracking-by-user-agent... . The server will get that UA string, and it can make subsequent calls (or serve you content that will automatically make calls, like hidden tags...) to further restrict the search space. You can have middleware that does this transparently. I'm not in that particular ma…

But the question is if GA and others actually accept these kind of requests: remember that someone with such and such UA (or IP, or whatever) has visited that website? And if people actually use it? I still have my doubts that tracking someone by UA is possible — there will be collisions for the large part of the market — but that some analytics service is actually doing it? It's easy to track me if Google can "reach" to the client side when visiting some website: they can use cookies, all HTTP-request data, even flash-cookies maybe. It's a no brainer to track individual with information like this. But guessing who is who just by UA? This doesn't seem that trivial, so I wonder if they really do that.

Re: Dell Computers Has Been Hacked

#116

Post by manigandham »

dcposch wrote: post #85
nthitz wrote: post #11

Earlier quoted context omitted.

Axciom, Epsilon and similar companies track your credit card purchases and correlate them with a profile of who they think you are. If you work for a large corporation that is probably easier to identify than a small one. http://www.acxiom.com/ http://www.epsilon.com/

I assumed that when I buy something on a card, it's more or less private. The transaction should be known only to: me, the merchant, our respective banks, Visa, and I guess the IRS if they come and ask for it. If I understand correctly, youre saying my entire purchase history is shared with random third party marketing companies. Full transaction data, PII included, no anonymization. How is that even remotely OK?

Purchase and transaction histories provide very rich data profiles and are a big business. There are also several companies that match up this "offline" data with online profiles so you can be targeted online.

PII is not available, it is anonymized. There are laws around this. Purchase data itself is usually grouped into major purchase types, not amounts or actual goods purchased.

For that detail, it would be the CRM/ERP systems of the manufacturer that has that information tied to a serial number and this is why they ask you to register your product when you buy it. Some manufacturers might work with data providers to exchange this data (serial numbers in exchange for purchase histories) but it's rarely done at scale because of cost, complexity, legal/security risk and lack of options to benefit from it.

Re: Dell Computers Has Been Hacked

#117

Post by krick »

wuschel wrote: post #113
krick wrote: post #97

Earlier quoted context omitted.

Well, I don't know how hard is it in the USA, but I use cash most of the time and know several people who do the same. Sure, sometimes you need to make wire transfer, or pay with credit card, or paypal for that matter. But at least shopping in the supermarket is possible with cash.

Then I do hope that you do not own a cashback etc bonus card, or your can be quite sure that your personal consumption related high resolution data will end up in some buyers pocket. And all that for a cheaper (and cheap) bread-knife.

Sometimes I do use several bonus cards, when there's some significant benefit (say, sale-out only for bonus-card owners). Guilty that. But I do not use them often and of course I don't use my real name when signing up for it. Or if I do — only when I use my CC anyway, which is rare.

Re: Dell Computers Has Been Hacked

#118

Post by manigandham »

krick wrote: post #91
JupiterMoon wrote: post #63

Earlier quoted context omitted.

Unfortunately people have started putting the tracking server side.

You mean GoogleAnalytics-tracking on the server side? Please expand on that, I'm not very versed in all that marketing spy-modules. Do you mean that some internet-shop (or blog or whatever) makes a request to GA or some similar service to share that I was at their website? If so, what information do they share? My IP, cookies or what? I always assumed that very point of GA was outsourcing tracking users to some other…

Yes. It's all just data in the end. Javascript can handle collecting all the information outside of setting cookies. But cookies are outdated and just a fallback now so all you need is the javascript to run.

This can be as simple as hosting a copy of GA.js yourself but there are plenty of options like using the server-side API if you have GA enterprise or just using a reverse-proxy like Nginx with some rewriting logic.

3rd-party only means it's a different domain (with security usually implemented at the browser level) - it's not some magical wall of isolation.

Re: Dell Computers Has Been Hacked

#119

Post by manigandham »

tombrossman wrote: post #75
JupiterMoon wrote: post #63

Earlier quoted context omitted.

Unfortunately people have started putting the tracking server side.

Tracking server-side is fine, it is assumed the server logs contain a record of my visits and I have no problem with that. I think what most people object to is the third-party tracking that so many people use. Company A tracking my visits to Company A's website = OK Company A using Google Analytics to track my visits (while also enabling Google to track me across multiple sites) = Not OK EDIT: (replying here as we'v…

Yes. GA has server-side API's available to premium accounts.

You can also just host the ga.js file yourself. Or run a reverse proxy or any of a dozen other methods to collect data and pass it to GA. Using the standard 3rd party tag is just for convenience.

Re: Dell Computers Has Been Hacked

#120

Post by txutxu »

14:43 UTC+1, site not loading, DNS error (domain not resolved).

It seems DNS this was hosted on godaddy, but can't see the content now.

It was pointing to shared hosting on dreamhost.

The domain will expire in August, so that is not the problem.

The domain is in status clientUpdateProhibited, clientTransferProhibited, clientRenewProhibited, clientDeleteProhibited... the whois has been updated today.

Maybe this site was put down?

Post reply on HN