Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

120M American Households Exposed In 'Massive' ConsumerView Database Leak

forbes.com

Post reply on HN
Print view View original

51–60 of 163 posts

Re: 120M American Households Exposed In 'Massive' ConsumerView Database Leak

#51

Post by mannykannot »

pmc1 wrote: post #38
RcouF1uZ4gsC wrote: post #6

Personal data right now is considered an asset. It needs to be seen as a liability. Maybe the solution is a data tax. You pay a set amount every year for every piece of personal data you have. If you buy personal data from another company, you still have to pay the tax for the data you acquired. If you have a breach of data, your tax goes up for a period of 10 years. In addition, every piece of personal data needs to…

> If you have a breach of data, your tax goes up for a period of 10 years. You do know it is impossible thwart all data breaches right? You can have the most sophisticated security system created and Zero-day attacks are still bound to occur. Data breaches occur without the companies themselves even knowing they took place... Geniuses are on the offensive side, if they want in, they will get in. No company in the rig…

> You do know it is impossible thwart all data breaches right?

As RcouF1uZ4gsC's proposal contains measures to be taken when it happens, I strongly suspect that he does, in fact, know that.

> Zero-day attacks are still bound to occur... Geniuses are on the offensive side.

Most of the breaches have required neither of these. The goal is to improve the practice of security to the point where the only successful attacks would require both.

> No company in the right mind would agree to pay a tax when the inevitable happens.

You have a very unconventional idea of how companies generally operate.

Re: 120M American Households Exposed In 'Massive' ConsumerView Database Leak

#52

Post by sidlls »

JumpCrisscross wrote: post #40
drspacemonkey wrote: post #10

Earlier quoted context omitted.

Instead of a data tax, I like the idea of mandatory data insurance, with payouts to users whose data is leaked/stolen. If your company has shitty security, or a history of leaks, your data insurance provider will charge out the ass. The financial math has to clearly be on the side of it being more profitable to practice proactive security.

> I like the idea of mandatory data insurance Why not just liability for lost data? Companies could then choose to hold the risk themselves or field it out to insurers.

Seems to me substantial liability will create a market for insurance of this sort anyway.

Re: 120M American Households Exposed In 'Massive' ConsumerView Database Leak

#54

Post by RevHaze »

JumpCrisscross wrote: post #40
drspacemonkey wrote: post #10

Earlier quoted context omitted.

Instead of a data tax, I like the idea of mandatory data insurance, with payouts to users whose data is leaked/stolen. If your company has shitty security, or a history of leaks, your data insurance provider will charge out the ass. The financial math has to clearly be on the side of it being more profitable to practice proactive security.

> I like the idea of mandatory data insurance Why not just liability for lost data? Companies could then choose to hold the risk themselves or field it out to insurers.

If it doesn't need to be insured, you could just spin off a smaller entity responsible for holding the data for you, and shut the company down if the data leaks. You can do the same if insurance is required of course, but any brand new 'personal data holding' company would likely have very high insurance premiums to offset the risk.

Re: 120M American Households Exposed In 'Massive' ConsumerView Database Leak

#55

Post by jack9 »

TylerE wrote: post #50
rbcgerard wrote: post #45

Earlier quoted context omitted.

Yes! And if you “lose” my data you owe me big money. Also have the fine scale exponentially by data items.... data set of 100 people with 2 items (name and email = $400 total or ($2x$2=$4 per user x 100 users)). Data set with 1 million users and 10 fields per user would be $1B and $1,024 paid to each person... Then make companies bond their liability - with recourse against anyone up the chain of title if the data wa…

You've just shut down every personal blog and small (or medium or large...) forum on the Internet.

Anonymous data is not the same thing. There's no reason to jump to regulation of data without a legal trail.

Re: 120M American Households Exposed In 'Massive' ConsumerView Database Leak

#56

Post by kgilpin »

mcheshier wrote: post #22
mandazi wrote: post #13

>At issue is once again an Amazon Web Services S3 cloud storage bucket that was misconfigured and inadvertently left open to the public internet, where anyone with a connection online could have found it. I use S3 and I have noticed that by default it's locked down and secure and in order for it to be open you have to open it for the public. Maybe AWS could improve the way it can secure the S3 buckets by making it ea…

My biggest problem with S3 is the old multi-layered security model with bucket policies and ACLs. They need to update it to just use IAM like everything else.

IAM is also super hard to configure.

I would like to see more sense of responsibility from AWS for these leaks rather than blaming the users.

It’s bad usability.

Re: 120M American Households Exposed In 'Massive' ConsumerView Database Leak

#58

Post by rbcgerard »

kylehotchkiss wrote: post #36
joshuaheard wrote: post #23

Earlier quoted context omitted.

It's my data, why should they pay a tax to the government for it? How about a data royalty. You use my data, you must pay me a royalty.

The royalty is free access to Facebook, instagram, [insert free web service name here]

And for the services that I paid for that lost my data?

Re: 120M American Households Exposed In 'Massive' ConsumerView Database Leak

#59

Post by pmc1 »

mannykannot wrote: post #51
pmc1 wrote: post #38

Earlier quoted context omitted.

> If you have a breach of data, your tax goes up for a period of 10 years. You do know it is impossible thwart all data breaches right? You can have the most sophisticated security system created and Zero-day attacks are still bound to occur. Data breaches occur without the companies themselves even knowing they took place... Geniuses are on the offensive side, if they want in, they will get in. No company in the rig…

> You do know it is impossible thwart all data breaches right? As RcouF1uZ4gsC's proposal contains measures to be taken when it happens, I strongly suspect that he does, in fact, know that. > Zero-day attacks are still bound to occur... Geniuses are on the offensive side. Most of the breaches have required neither of these. The goal is to improve the practice of security to the point where the only successful attacks…

> I strongly suspect that he does, in fact, know that.

His proposals imply that he does not in fact realize that zero-day attacks occur. Negligence is one thing, but having state of the art security systems and still being punished for a breach is another thing. A state sponsored group with enough time and money can repeatedly infiltrate a system. A tax certainly wont solve the problem

Re: 120M American Households Exposed In 'Massive' ConsumerView Database Leak

#60

Post by ryandrake »

AnimalMuppet wrote: post #41
bogomipz wrote: post #26

Earlier quoted context omitted.

How would we go about making the data worthless?

As others have said on other comments on this article, everyone has to stop using that data ( all of it) for purposes of verifying that you are who you claim to be. My initial thought was "good luck with that", but maybe, in an ironic sort of way, these breaches are going to force that to happen. "You say someone opened a credit card in my name, and you want me to pay for what they charged? What data did they use to…

If you're a bank, if someone opens an account in my name, it should be your problem, not mine. If you're going to tie something to my identity, you need to require more proof of identity than information that is practically public knowledge (social security numbers, addresses, former addresses, etc.).
Post reply on HN