Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

120M American Households Exposed In 'Massive' ConsumerView Database Leak

forbes.com

Post reply on HN
Print view View original

21–30 of 163 posts

Re: 120M American Households Exposed In 'Massive' ConsumerView Database Leak

#21

Post by eric_h »

mandazi wrote: post #13

>At issue is once again an Amazon Web Services S3 cloud storage bucket that was misconfigured and inadvertently left open to the public internet, where anyone with a connection online could have found it. I use S3 and I have noticed that by default it's locked down and secure and in order for it to be open you have to open it for the public. Maybe AWS could improve the way it can secure the S3 buckets by making it ea…

It is just _so_ easy to make the whole thing public vs what it takes for more granular privileges (though I do agree that it's pretty straight forward if you understand how to set bucket policies, etc.). It's really just a couple of clicks in the console - it's a classic usability vs. security problem.

Re: 120M American Households Exposed In 'Massive' ConsumerView Database Leak

#22

Post by mcheshier »

mandazi wrote: post #13

>At issue is once again an Amazon Web Services S3 cloud storage bucket that was misconfigured and inadvertently left open to the public internet, where anyone with a connection online could have found it. I use S3 and I have noticed that by default it's locked down and secure and in order for it to be open you have to open it for the public. Maybe AWS could improve the way it can secure the S3 buckets by making it ea…

My biggest problem with S3 is the old multi-layered security model with bucket policies and ACLs. They need to update it to just use IAM like everything else.

Re: 120M American Households Exposed In 'Massive' ConsumerView Database Leak

#23

Post by joshuaheard »

RcouF1uZ4gsC wrote: post #6

Personal data right now is considered an asset. It needs to be seen as a liability. Maybe the solution is a data tax. You pay a set amount every year for every piece of personal data you have. If you buy personal data from another company, you still have to pay the tax for the data you acquired. If you have a breach of data, your tax goes up for a period of 10 years. In addition, every piece of personal data needs to…

It's my data, why should they pay a tax to the government for it? How about a data royalty. You use my data, you must pay me a royalty.

Re: 120M American Households Exposed In 'Massive' ConsumerView Database Leak

#24

Post by us0r »

mandazi wrote: post #13

>At issue is once again an Amazon Web Services S3 cloud storage bucket that was misconfigured and inadvertently left open to the public internet, where anyone with a connection online could have found it. I use S3 and I have noticed that by default it's locked down and secure and in order for it to be open you have to open it for the public. Maybe AWS could improve the way it can secure the S3 buckets by making it ea…

> Maybe AWS could improve the way it can secure the S3 buckets

Maybe we can start holding companies accountable?

This isn't someone hacked into their system. This is just being negligent.

Re: 120M American Households Exposed In 'Massive' ConsumerView Database Leak

#25

Post by rdiddly »

jordonwii wrote: post #8

The linked article is not very good imo. It goes into almost no detail, despite including two directly contradictory statements: "Yet another cloud storage misconfiguration has exposed personally identifiable information (PII)" and "the data in question contained no names of any individuals or any other personal identifying information" Can we change this to link to the Forbes article referenced in the linked one? It…

Thanks for the link, this is the one for grown-ups.

Re: 120M American Households Exposed In 'Massive' ConsumerView Database Leak

#26

Post by bogomipz »

ams6110 wrote: post #4
maxxxxx wrote: post #2

The data is just way too spread between too many companies. Someone will screw up somewhen for sure. Not sure how to solve this. Make it illegal to store data and instead only allow access with permission for specific purposes?

The horse is out of the barn. We need to make the data itself worthless. There's no getting it back.

How would we go about making the data worthless?

Re: 120M American Households Exposed In 'Massive' ConsumerView Database Leak

#27

Post by stephengillie »

jordonwii wrote: post #8

The linked article is not very good imo. It goes into almost no detail, despite including two directly contradictory statements: "Yet another cloud storage misconfiguration has exposed personally identifiable information (PII)" and "the data in question contained no names of any individuals or any other personal identifying information" Can we change this to link to the Forbes article referenced in the linked one? It…

The Forbes article also points out that the DB is now secured. I have 2 take-aways:

1. This isn't an announcement that our details have been leaked, so much as a reminder that our details are now and will perpetually be leaked, in one form or another by an externalized party.

2. Databases mapping all American households exist.

Re: 120M American Households Exposed In 'Massive' ConsumerView Database Leak

#29

Post by sctb »

jordonwii wrote: post #8

The linked article is not very good imo. It goes into almost no detail, despite including two directly contradictory statements: "Yet another cloud storage misconfiguration has exposed personally identifiable information (PII)" and "the data in question contained no names of any individuals or any other personal identifying information" Can we change this to link to the Forbes article referenced in the linked one? It…

Sure thing, we've updated the link from https://www.infosecurity-magazine.com/news/every-single-amer....

Re: 120M American Households Exposed In 'Massive' ConsumerView Database Leak

#30

Post by bb88 »

RcouF1uZ4gsC wrote: post #6

Personal data right now is considered an asset. It needs to be seen as a liability. Maybe the solution is a data tax. You pay a set amount every year for every piece of personal data you have. If you buy personal data from another company, you still have to pay the tax for the data you acquired. If you have a breach of data, your tax goes up for a period of 10 years. In addition, every piece of personal data needs to…

> Maybe the solution is a data tax

Credit reporting and debt is a dumpster fire that needs to be rebuilt from scratch.

We need a new system where knowing the right pieces of information does not allow you to buy a car in someone else's name.

Post reply on HN