Yahoo Triples Estimate of Breached Accounts to 3B

Post by rightos » Tue, Oct 03, 2017, 11:58 PM UTC

noway421 wrote: post #127

rightos wrote: post #124

Earlier quoted context omitted.

Sure, but you don't need first name, last name, phone number, birth date or gender. All of which are asked on the signup and of which only Gender is specified as optional: https://login.yahoo.com/account/create On my small business we ask only for an email address, password and confirm password. Everything else is excessive. Tax obligations can be another problem which may require an address, but often have a simpler…

First and last name at least needed for meet the email protocol. Emails shouldn't be addressed to handles/nicknames

Post by bogomipz » Wed, Oct 04, 2017, 12:08 AM UTC

runesoerensen wrote: post #103

bogomipz wrote: post #35

On a related note Equifax stated yesterday that they identified an additional 2.5 million accounts that were breached: https://www.nytimes.com/2017/10/02/business/equifax-breach.h... Is proper audit capability just not seen as important at these companies?

To be fair Equifax's adjustment was relatively minor, and they did disclose that they were still investigating the matter.

Post by specialist » Wed, Oct 04, 2017, 12:11 AM UTC

dpark wrote: post #125

specialist wrote: post #110

Earlier quoted context omitted.

My personal data is an asset. And it belongs to me. Anyone who has my data for any purpose owes me my cut. Making this a property rights issue solves all the privacy & identity issues.

> My personal data is an asset. And it belongs to me. > Anyone who has my data for any purpose owes me my cut. It's well established in the US that you do not in fact own your data. You don't own your school records or employment records. You don't own your medical records or your credit records. In general the best you have is a right to view those records and that's only in certain cases.

Post by specialist » Wed, Oct 04, 2017, 12:14 AM UTC

throwaway613834 wrote: post #118

specialist wrote: post #110

Earlier quoted context omitted.

My personal data is an asset. And it belongs to me. Anyone who has my data for any purpose owes me my cut. Making this a property rights issue solves all the privacy & identity issues.

> My personal data is an asset. And it belongs to me. Hm. How would this work for (say) a social security number? Does it belong to you? Does every number anyone chooses to identify you belong to you?

Post by ctab » Wed, Oct 04, 2017, 12:14 AM UTC

dpark wrote: post #121

ctab wrote: post #115

Earlier quoted context omitted.

This could be a voluntary insurance that companies purchase on behalf of their users. If the company suffers a breach, they will be bound to pay X amount to their users depending on the data lost. Dress it up with a fancy badge to slap on the front of their site. Maybe a silver badge means user data is insured up to $10 each; a gold badge is up to $100; platinum up to $1000.

So Yahoo would have been insured for somewhere between $30 Billion and $3 Trillion in this scheme? That seems untenable. Good luck collecting from the bankrupt insurer.