Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

120M American Households Exposed In 'Massive' ConsumerView Database Leak

forbes.com

Post reply on HN
Print view View original

61–70 of 163 posts

Re: 120M American Households Exposed In 'Massive' ConsumerView Database Leak

#61

Post by mannykannot »

pmc1 wrote: post #59
mannykannot wrote: post #51

Earlier quoted context omitted.

> You do know it is impossible thwart all data breaches right? As RcouF1uZ4gsC's proposal contains measures to be taken when it happens, I strongly suspect that he does, in fact, know that. > Zero-day attacks are still bound to occur... Geniuses are on the offensive side. Most of the breaches have required neither of these. The goal is to improve the practice of security to the point where the only successful attacks…

> I strongly suspect that he does, in fact, know that. His proposals imply that he does not in fact realize that zero-day attacks occur. Negligence is one thing, but having state of the art security systems and still being punished for a breach is another thing. A state sponsored group with enough time and money can repeatedly infiltrate a system. A tax certainly wont solve the problem

You are using rare, worst-case events to, in effect, excuse the currently abysmal state of security. When we have reached the point where zero-days account for almost all the remaining successful attacks, we can revisit the question.

Re: 120M American Households Exposed In 'Massive' ConsumerView Database Leak

#64

Post by extrapickles »

RevHaze wrote: post #54
JumpCrisscross wrote: post #40

Earlier quoted context omitted.

> I like the idea of mandatory data insurance Why not just liability for lost data? Companies could then choose to hold the risk themselves or field it out to insurers.

If it doesn't need to be insured, you could just spin off a smaller entity responsible for holding the data for you, and shut the company down if the data leaks. You can do the same if insurance is required of course, but any brand new 'personal data holding' company would likely have very high insurance premiums to offset the risk.

Its fairly common in the temp employee industry that if a temp worker gets injured the temp agency folds and restarts to avoid the penalties.

It would be nice to require insurance or a bond to hold personal data so a company can't just disappear when data is lost.

[0]: http://projects.thestar.com/temp-employment-agencies/

Re: 120M American Households Exposed In 'Massive' ConsumerView Database Leak

#65

Post by emidln »

pmc1 wrote: post #38
RcouF1uZ4gsC wrote: post #6

Personal data right now is considered an asset. It needs to be seen as a liability. Maybe the solution is a data tax. You pay a set amount every year for every piece of personal data you have. If you buy personal data from another company, you still have to pay the tax for the data you acquired. If you have a breach of data, your tax goes up for a period of 10 years. In addition, every piece of personal data needs to…

> If you have a breach of data, your tax goes up for a period of 10 years. You do know it is impossible thwart all data breaches right? You can have the most sophisticated security system created and Zero-day attacks are still bound to occur. Data breaches occur without the companies themselves even knowing they took place... Geniuses are on the offensive side, if they want in, they will get in. No company in the rig…

> You do know it is impossible thwart all data breaches right?

False. No system, no breach. No data stored, no possibility to lose it. Accept the liability for having the data or don't have it.

Re: 120M American Households Exposed In 'Massive' ConsumerView Database Leak

#66

Post by EGreg »

RcouF1uZ4gsC wrote: post #6

Personal data right now is considered an asset. It needs to be seen as a liability. Maybe the solution is a data tax. You pay a set amount every year for every piece of personal data you have. If you buy personal data from another company, you still have to pay the tax for the data you acquired. If you have a breach of data, your tax goes up for a period of 10 years. In addition, every piece of personal data needs to…

Instead of a tax, how about extending the cumbersome PCI Compliance regulations to all personal data? How many of you would store credit card numbers willy nilly today even if asked by a client? :-)

Re: 120M American Households Exposed In 'Massive' ConsumerView Database Leak

#67

Post by bogomipz »

AnimalMuppet wrote: post #41
bogomipz wrote: post #26

Earlier quoted context omitted.

How would we go about making the data worthless?

As others have said on other comments on this article, everyone has to stop using that data ( all of it) for purposes of verifying that you are who you claim to be. My initial thought was "good luck with that", but maybe, in an ironic sort of way, these breaches are going to force that to happen. "You say someone opened a credit card in my name, and you want me to pay for what they charged? What data did they use to…

>"Yeah, good luck collecting, suckers."

They don't have to collect, they just ruin your credit and make your life difficult. That's what they do now.

Re: 120M American Households Exposed In 'Massive' ConsumerView Database Leak

#68

Post by mikehollinger »

RcouF1uZ4gsC wrote: post #6

Personal data right now is considered an asset. It needs to be seen as a liability. Maybe the solution is a data tax. You pay a set amount every year for every piece of personal data you have. If you buy personal data from another company, you still have to pay the tax for the data you acquired. If you have a breach of data, your tax goes up for a period of 10 years. In addition, every piece of personal data needs to…

Personal data is already a liability in the medical space. How’s HIPAA made that any different? Are those databases breached just as often, but of little interest?

Re: 120M American Households Exposed In 'Massive' ConsumerView Database Leak

#70

Post by JumpCrisscross »

RevHaze wrote: post #54
JumpCrisscross wrote: post #40

Earlier quoted context omitted.

> I like the idea of mandatory data insurance Why not just liability for lost data? Companies could then choose to hold the risk themselves or field it out to insurers.

If it doesn't need to be insured, you could just spin off a smaller entity responsible for holding the data for you, and shut the company down if the data leaks. You can do the same if insurance is required of course, but any brand new 'personal data holding' company would likely have very high insurance premiums to offset the risk.

> If it doesn't need to be insured, you could just spin off a smaller entity responsible for holding the data for you, and shut the company down if the data leaks

If this is possible without insurance then it’s possible with, and every insurance company will mandate the structure to limit payouts. Mandating insurance simple entrenches the insurers. Why, for instance, would you want to require Apple purchase insurance against its users’ data?

Side note: beneficial ownership [1] and affiliate definitions [2] are useful for such cases.

[1] https://www.investopedia.com/terms/b/beneficialowner.asp

[2] http://rule144opinion.blogspot.com/2014/02/rule-144-are-you-...

Post reply on HN