120M American Households Exposed In 'Massive' ConsumerView Database Leak

Post by heartbreak » Wed, Dec 20, 2017, 1:27 AM UTC

JoeAltmaier wrote: post #79

dvtv75 wrote: post #74

Earlier quoted context omitted.

A relative of mine works in IT for a non-US hospital. (Avoiding naming it because of backlash potential, both for him and myself.) When he started there, as bottom level IT support, he had access to everything. Admin passwords, doctor's passwords, he could write prescriptions and put a doctor's name on it. He could order anything and everything, and send it anywhere. He could read your medical files, if you were a pa…

For the first 100 years, we just arrested folks who actually faked records or stole things. Now we do it if they don't make it impossible? I know, networks change everything. But inside a secure facility its often (always) the case that personal integrity (and maybe some audits) is used to ensure correctness most of the time. Somebody working in a hospital could steal prescriptions off of patient's tables, could lift…

Post by freeflight » Wed, Dec 20, 2017, 1:33 AM UTC

bllguo wrote: post #43

freeflight wrote: post #33

Earlier quoted context omitted.

One, rather drastic, approach would be making the data of everybody freely available to everybody, think post-privacy society. At least that's how I originally imagined this Internet thing to play out as, too bad it took the exact opposite direction.

I like drastic, because what else is going to spur the powers that be to revamp how we approach identification? Something dramatic like this is almost necessary at this point. Equifax was huge and yet what reforms have we seen? Is anything even in the pipeline?

Post by ghaff » Wed, Dec 20, 2017, 1:43 AM UTC

kgilpin wrote: post #56

mcheshier wrote: post #22

Earlier quoted context omitted.

My biggest problem with S3 is the old multi-layered security model with bucket policies and ACLs. They need to update it to just use IAM like everything else.

IAM is also super hard to configure. I would like to see more sense of responsibility from AWS for these leaks rather than blaming the users. It’s bad usability.

Post by yjftsjthsd-h » Wed, Dec 20, 2017, 1:50 AM UTC

CaptSpify wrote: post #46

ThrustVectoring wrote: post #39

Earlier quoted context omitted.

A big problem with this is that a lot of data about you isn't owned by you. The fact that you took out credit card X on Y date and have paid the balance on time since then is owned by the credit card company you do business with (well, it belongs to you too, but businesses are more willing to trust Chase than you). This information has real business value from being a leading indicator and costly signal of your futur…

At the risk of speaking for OP: The point is that the data should be owned by me. Yeah, I get that it has value to other people, but I'm the one that has to deal with the fallout, not them. Just because something is useful to a business doesn't mean that they have the right to it. If they want information about me, they should be asking me, not some third party.

Post by manigandham » Wed, Dec 20, 2017, 2:04 AM UTC

kgilpin wrote: post #56

mcheshier wrote: post #22

Earlier quoted context omitted.

My biggest problem with S3 is the old multi-layered security model with bucket policies and ACLs. They need to update it to just use IAM like everything else.

IAM is also super hard to configure. I would like to see more sense of responsibility from AWS for these leaks rather than blaming the users. It’s bad usability.