Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Inside the Largest US Voter Data Leak

upguard.com

Post reply on HN
Print view View original

311–320 of 351 posts

Re: Inside the Largest US Voter Data Leak

#311

Post by creepydata »

unityByFreedom wrote: post #307
creepydata wrote: post #303

Earlier quoted context omitted.

How do you know if your birthday isn't in some publicly accessible government database somewhere? Did you try to find it? Did you hire a private investigator (who has quick access to all those databases) and ask them if they can find your birthday?

If it were, I would let the government know that's not okay. Hackers would be one step closer to being able to sign up for a credit card under my name. If it's true that that information is out in the wild now, then I expect government to tighten their tech security procedures.

"I would let the government know that's not okay" - lol, yeah good luck with that.

How do you think the RNC got birthdays for 200 million Americans in the first place? Public records. 200 million Americans are NOT affiliated with the RNC.

Re: Inside the Largest US Voter Data Leak

#312

Post by bluejekyll »

BinaryIdiot wrote: post #237
bluejekyll wrote: post #183

Earlier quoted context omitted.

> Security is a major problem in tech. It's very difficult, it's nuanced and its vast. Security covers so so much that it would be difficult to one or maybe even a handful of security experts to fully over all aspects of an app depending on your scope. Which is why it's so important to hold companies that screw it up accountable. That's the only way to get it to change. Forget about everything else, accountability wi…

> Which is why it's so important to hold companies that screw it up accountable. That's the only way to get it to change. Forget about everything else, accountability will force new rules for data storage and protection. Without accountability, nothing will change. Sure but everyone on HN suggests accountability but never defines what they mean by it except for the few who think someone should just be thrown in jail.…

I'm not sure it means jail time. It does need to be substantive. Holding the CEO, CTO and CSO directly accountable is a start. But I think it needs to be company wide. It needs to be punitive damage to the company and its shareholders. The risk of mishandling PII and similar data needs to outway the benefit (that may differ per type of PII).

At that point it would be my theory that consolidation around best practices, software, security audits... would become the norm. It would raise the cost of a company taking on the responsibility itself, that they'd rely on others to reduce the cost through volume. It would probably start looking a lot like PCI and credit card co. Requirements. The big difference here being that there isn't an industry body responsible, but the government, which would always be political and probably not have enough teeth.

Re: Inside the Largest US Voter Data Leak

#313

Post by creepydata »

unityByFreedom wrote: post #299
creepydata wrote: post #296

Earlier quoted context omitted.

I think you are confused about what "private" means. I've never "consented" to "releasing" my address publicly, but real estate records are public information thus the real estate I own is easily queried from my town's website and the real estate transaction was published in all the local newspapers. You can even look up my property tax bills from the towns website and my payment history of said taxes. If you're feel…

You're trying to redefine private. Is the list of doctors you visit private? I could probably discover such information, but it is considered private. Your address is usually public unless you go to lengths to obfuscate it. You can go to Hollywood and get a map of where all the movie stars live. And, the white pages list your phone number unless you opt out. Birthday has never been publicly available until this voter…

>Is the list of doctors you visit private?

Yes, this is explicitly protected by law.

>I could probably discover such information

No you can't get this information, and certainly not legally.

>Your address is usually public

Exactly but I never "gave my consent to release my address," it just is.

>Birthday has never been publicly available until this voter data leak.

Open up a newspaper or open up yourlocalpaper.com There's a whole birth announcements section!

How do you think the RNC got this information in the first place? Public records. The RNC is NOT the government.

Re: Inside the Largest US Voter Data Leak

#314

Post by abawany »

falcolas wrote: post #157
nostrademons wrote: post #128

Earlier quoted context omitted.

I don't really disagree that this is a shitty data breach, but on the consequences, I'll point out that the 5% of society who tends to sociopathy already have much lower-effort means to target minorities: Hate women? Look for boobs. Hate muslims? Look for brown skin. Hate Republicans? Look for MAGA hats. That these are inaccurate signals is irrelevant: haters gonna hate, and I really don't think they care whether the…

> lower-effort means to target minorities It doesn't get much lower effort than downloading a list, popping it into Excel, and sorting on a column (I'm willing to bet that some hate groups are already doing this and will release very specific lists to their membership). And with phone numbers and a couple of bucks, you don't even have to leave your house to send them hate messages by the thousands. Haters gonna hate…

Certainly, it makes it easier to call SWAT on the home of a person in Georgia while being in Alabama; this is much lower effort than shouting hate slogans at some random group of people in the street. This is scary nasty.

Re: Inside the Largest US Voter Data Leak

#315

Post by unityByFreedom »

creepydata wrote: post #313
unityByFreedom wrote: post #299

Earlier quoted context omitted.

You're trying to redefine private. Is the list of doctors you visit private? I could probably discover such information, but it is considered private. Your address is usually public unless you go to lengths to obfuscate it. You can go to Hollywood and get a map of where all the movie stars live. And, the white pages list your phone number unless you opt out. Birthday has never been publicly available until this voter…

>Is the list of doctors you visit private? Yes, this is explicitly protected by law. >I could probably discover such information No you can't get this information, and certainly not legally. >Your address is usually public Exactly but I never "gave my consent to release my address," it just is. >Birthday has never been publicly available until this voter data leak. Open up a newspaper or open up yourlocalpaper.com Th…

> How do you think the RNC got this information in the first place?

I imagine they used campaign dollars to buy the information from private companies with whom you've done business. Maybe legally, maybe not.

The RNC certainly isn't offering up such information as to where they sourced the data they leaked.

Re: Inside the Largest US Voter Data Leak

#316

Post by unityByFreedom »

creepydata wrote: post #311
unityByFreedom wrote: post #307

Earlier quoted context omitted.

If it were, I would let the government know that's not okay. Hackers would be one step closer to being able to sign up for a credit card under my name. If it's true that that information is out in the wild now, then I expect government to tighten their tech security procedures.

"I would let the government know that's not okay" - lol, yeah good luck with that. How do you think the RNC got birthdays for 200 million Americans in the first place? Public records. 200 million Americans are NOT affiliated with the RNC.

> How do you think the RNC got birthdays for 200 million Americans in the first place?

As I replied elsewhere, there is a market for reselling your information on the internet. In some cases that is legal, and in many it's probably not. As a tech person you should know this.

Re: Inside the Largest US Voter Data Leak

#317

Post by creepydata »

unityByFreedom wrote: post #305
idbehold wrote: post #293

Earlier quoted context omitted.

That would disclose way more information than just my name and age. You would then be able to associate that information with my HN username and all the data associated with it.

I don't follow.

idbehold can't post his or her name and birthday without revealing he or she is the owner of the idbehold hacker news account. Which is more information than name+birthday, it's name+birthday+hacked news posting history.

http://www.dc.state.fl.us/activeinmates/detail.asp?Bookmark=...

This is a random guy. His named ERNEST BELL JR and his birthdate is 10/05/1959.

Re: Inside the Largest US Voter Data Leak

#318

Post by rattray »

specialist wrote: post #287
rattray wrote: post #145

I don't typically don hats with this much tin foil, and I don't think this is likely , but... The real danger of data like this, in my opinion, illegal usage for voter fraud. Find people who are likely to vote against you and likely to have poor voter registration documents, and remove them from the polls so they can't vote. Find people who aren't likely to vote at all and vote on their behalf. In-person, the only ve…

Please learn how election administration is conducted before continuing to speculate, criticize. An easy way is to see it first hand, by working as a poll judge or inspector. Happy hunting.

Every county is different so some of my statements may not apply everywhere (I live in San Francisco).

I've yet to work a poll (next election) but have gotten to know the system here pretty well through the SF elections commission.

Our system is very far from perfect. Many counties do not even audit ballots after every election (let alone use only paper ballots). Epollbook software can be all over the place. Voter verification at polling places is often quite minimal. The penalty for forging a signature on a mail in ballot in CA is only $1000 (I was in the room when the state assembly committee voted not to raise the fine to keep up with inflation).

I don't mean to be alarmist - like I said, I don't think these things took place, at least en masse - but it'd be quite naive to suggest there aren't vulnerabilities.

Re: Inside the Largest US Voter Data Leak

#319

Post by unityByFreedom »

creepydata wrote: post #317
unityByFreedom wrote: post #305

Earlier quoted context omitted.

I don't follow.

idbehold can't post his or her name and birthday without revealing he or she is the owner of the idbehold hacker news account. Which is more information than name+birthday, it's name+birthday+hacked news posting history. http://www.dc.state.fl.us/activeinmates/detail.asp?Bookmark=... This is a random guy. His named ERNEST BELL JR and his birthdate is 10/05/1959.

> dbehold can't post his or her name and birthday..

Not sure why you're replying for someone else..

> This is a random guy. His named ERNEST BELL JR and his birthdate is 10/05/1959. Inmates obviously lose some rights when convicted. Data security is minor compared to losing the freedom of movement.

Also doesn't surprise me that Florida would make all information on its inmates public.

Re: Inside the Largest US Voter Data Leak

#320

Post by phil21 »

stale2002 wrote: post #202
criley2 wrote: post #176

Earlier quoted context omitted.

>?A careless programmer makes a bad choice and the CEO has to go to jail? Come on An institutional failure of review, testing and security that will lead to tens of billions of dollars of identity theft goes unpunished completely? Come on. A CEO is responsible for his organization. If you ruin lives, you have to pay the price. Can't handle the heat? Don't take the job. I hate how CEO's get hundred million dollar para…

This isn't social security numbers. This is all publicly available data scrapping stuff. Like your public Facebook profile. If you don't want that stuff to be leaked, then don't put your info publicly on Facebook.

I'm starting to kind of hope there is just a giant "leak" of every single US citizen's basic public information including SSN, etc. Get it all out there so we can stop having the debate over what is private information vs. public.

Then we can stop having this conversation constantly. None of this information is secret, I would put SSN into "quasi-secret" land since it takes such minimal effort to get at it.

We've been relying on security through obscurity for far too long. If the only thing stopping mass identity theft is someone compiling a list of otherwise public information, it's far beyond time we re-evaluate where the true problem lies.

So yeah, I agree. At some point society is going to actually have to confront this in a useful manner vs. hysterics and patching over an obviously failed system.

Post reply on HN