Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Yahoo Triples Estimate of Breached Accounts to 3B

wsj.com

Post reply on HN
Print view View original

141–150 of 311 posts

Re: Yahoo Triples Estimate of Breached Accounts to 3B

#141

Post by dpark »

specialist wrote: post #135
dpark wrote: post #125

Earlier quoted context omitted.

> My personal data is an asset. And it belongs to me. > Anyone who has my data for any purpose owes me my cut. It's well established in the US that you do not in fact own your data. You don't own your school records or employment records. You don't own your medical records or your credit records. In general the best you have is a right to view those records and that's only in certain cases.

Because Freedom Markets™?

Pretty sure it's the same across the world, really. Try getting your medical records expunged in Cuba or your search records expunged in China. I bet you have the same success as in the US.

Re: Yahoo Triples Estimate of Breached Accounts to 3B

#142

Post by dpark »

ctab wrote: post #139
dpark wrote: post #121

Earlier quoted context omitted.

So Yahoo would have been insured for somewhere between $30 Billion and $3 Trillion in this scheme? That seems untenable. Good luck collecting from the bankrupt insurer.

Good point, although the report states 3 billion user accounts were breached but this doesn't mean 3 billion people. I am guessing the vast majority of accounts did not contain any sensitive information. And maybe insurance isn't the right word; the risk should probably fall to the company holding the data, not a third party who would never be able to audit every single step to ensure there is no weak link.

True, it wouldn't be 3 billion individuals claiming the benefit. Still the scale is so large that it would utterly bankrupt most companies to pay out for a single breach.

Re: Yahoo Triples Estimate of Breached Accounts to 3B

#143

Post by craftyguy »

tclancy wrote: post #136
craftyguy wrote: post #23

Earlier quoted context omitted.

If that's the case, I think the bigger news then is that yahoo actually had 3B users!

How much of a rounding error can there be when they say "3 billion" instead of "y'know what, it was all of them"?

My Fermi estimation puts it at 10bn users

Re: Yahoo Triples Estimate of Breached Accounts to 3B

#144

Post by soared »

manigandham wrote: post #113
soared wrote: post #95

Earlier quoted context omitted.

Value is derived from user data when its used to target ads. Black market data is never used for that purpose, so its value is much lower. (A company would never take the risk of using black market data)

Value is derived from the potential application of data. Ads as an application isn't worth much since you can still be shown ads just fine without any personal data targeting. Black market data is worth way more because it's often more personal than just demographic markers and interests, and can potentially lead to large sums of money.

Well no that's incorrect. A targeted ad is worth significantly more than one without targeting. I buy ads at a $0.25 cpm and a $40 cpm, the only difference is targeting data.

Re: Yahoo Triples Estimate of Breached Accounts to 3B

#145

Post by gigatexal »

avivo wrote: post #43
RcouF1uZ4gsC wrote: post #19

I think the issue right now is that private user information is viewed as an asset, not a liability. If we could find a way to make it more of a liability, companies would be less likely to collect it just for the sake of having it, and they would be more proactive in securing it.

Alternatively, if it's truly an asset, can it be taxed as an asset? If I give a company a car, that is taxed. If I give a company my data which is worth more than a car, it isn't. Is it possible that current accounting/tax law can be interpreted so that these are viewed similarly?

That’s a fascinating premise. Revenues generated from the use of ones data is taxed like anything else (unless routed through Ireland ;-) ) but I don’t think assets are taxed at rest. I could be wrong.

Re: Yahoo Triples Estimate of Breached Accounts to 3B

#146

Post by runesoerensen »

bogomipz wrote: post #133
runesoerensen wrote: post #103

Earlier quoted context omitted.

To be fair Equifax's adjustment was relatively minor, and they did disclose that they were still investigating the matter.

2.5 million people is minor?

> 2.5 million people is minor?

It's relatively minor. Equifax's preliminary estimate was off by less than 2%, Yahoo's ~300%.

Re: Yahoo Triples Estimate of Breached Accounts to 3B

#147

Post by late2part »

iamthepieman wrote: post #101
avivo wrote: post #43

Earlier quoted context omitted.

Alternatively, if it's truly an asset, can it be taxed as an asset? If I give a company a car, that is taxed. If I give a company my data which is worth more than a car, it isn't. Is it possible that current accounting/tax law can be interpreted so that these are viewed similarly?

Does that mean that your ID number (social security for U.S. readers) is taxable upon receipt (birth or immigration)? Also we will need a birthday tax as your age (a key demographic data point) changes then. A marriage tax, moving (address change) tax, employment change tax etc. Tax law will have a concept of taxable data event much like a liquidity event. Obviously this is a silly thought exercise but it is fun to t…

Careful there tiger. You're starting to sound like a Sovereign man with your corporate federal account.

Re: Yahoo Triples Estimate of Breached Accounts to 3B

#148

Post by lifeisstillgood »

manigandham wrote: post #113
soared wrote: post #95

Earlier quoted context omitted.

Value is derived from user data when its used to target ads. Black market data is never used for that purpose, so its value is much lower. (A company would never take the risk of using black market data)

Value is derived from the potential application of data. Ads as an application isn't worth much since you can still be shown ads just fine without any personal data targeting. Black market data is worth way more because it's often more personal than just demographic markers and interests, and can potentially lead to large sums of money.

Personal information is less valuable on the black market due to the difficulty in monetising and extracting the cash. If I have your bank account login details I can move cash out of your bank, but almost no hope of sending cash from a U.K. Domestic savings account to my friendly philapines bank over the web UI. That's why Nigerian Princes still send out emails - the find the one idiot willing to walk into his bank and move the 5million that just arrived in his account

Alternatively you need real criminal gangs - dozens of people willing to walk up and down a London street withdrawing 5k at a time from a 1000 Pre-prepared cards and put the money in their rucksacks. They don't come cheap. And its still cash and still in the U.K.

Get Amazon to send you two dozen laptops to the same address with two dozen cards. All as "gifts". Yeah right. Now you gotta sell them - fences run at 10% if you are lucky.

The lowest effort are simple impersonation for loans, but still you have to take the money and move it somewhere. Into cash? Into the phillipines? See above problems. Open a credit card account? How to intercept it and the PIN number sent by post?

All in all, it's actually pretty darn hard to take personal details and monetise at the "real money" level. These things stop being scalable. You could probably fund a student lifestyle off any combination of the above but millions - not really.

Cf interesting Microsoft paper on this a few years back

Re: Yahoo Triples Estimate of Breached Accounts to 3B

#150

Post by mkempe »

dpark wrote: post #141
specialist wrote: post #135

Earlier quoted context omitted.

Because Freedom Markets™?

Pretty sure it's the same across the world, really. Try getting your medical records expunged in Cuba or your search records expunged in China. I bet you have the same success as in the US.

Maybe you should look at free people in mostly free countries, instead of dictatorships.

For instance, the EU and Switzerland.

Post reply on HN