Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Notice of Data Breach

content.myfitnesspal.com

Post reply on HN
Print view View original

141–150 of 160 posts

Re: Notice of Data Breach

#141

Post by Mister_Snuggles »

corpMaverick wrote: post #140
JimDabell wrote: post #115

The MyFitnessPal database has been compromised for years . I register with a unique email address for every website and app that I use so that I can tell when somebody's database gets compromised or they sell my data. I started getting an influx of spam to my MyFitnessPal email years ago. I told them about it at the time but they didn't care.

How do you do this ?

With some email providers you can add something after your email address like this:

  realemailaddress+myfitnesspal@example.com
Or:

  realemailaddress+0f3eda@example.com
The assumption here is that you have something to keep track of what code you've assigned to what service.

Of course, some services don't allow a + in the email address so this only goes so far.

If you want to get slightly fancier, you could use your own domain and a catchall alias that sends everything to your real mailbox. That lets you use an address that doesn't have any obvious relationship to your real email address, apart from the domain name.

If you want to get ultra fancy, you could run your own mail server and set up a process to generate unique email addresses on the fly and keep track of which service was given which address. This is really just attaching some automation to the previous example, possibly using 'real' mailboxes for the incoming email.

Re: Notice of Data Breach

#142

Post by JimDabell »

corpMaverick wrote: post #140
JimDabell wrote: post #115

The MyFitnessPal database has been compromised for years . I register with a unique email address for every website and app that I use so that I can tell when somebody's database gets compromised or they sell my data. I started getting an influx of spam to my MyFitnessPal email years ago. I told them about it at the time but they didn't care.

How do you do this ?

The way most people do this is with plus addressing. If your mail provider supports it (e.g. Gmail does), you can send email to someuser+somewebsite@example.com and it will be delivered to someuser@example.com. There are a minority of websites and apps that reject emails like that, but they are quite rare and the vast majority don't have any issue with it.

If you have your own domain name, you can set up a catch-all address, so if you own example.com, then you can register on websites and in apps with somewebsite@example.com instead. This works everywhere.

You can then look at what email address an email was addressed to to see how the sender got hold of your email address, and you can filter and block future emails based on that address as well. So if, for instance, you've registered with MyFitnessPal with myfitnesspal@example.com, then you can cut off everybody who's got hold of your email address via the MyFitnessPal breach with 100% effectiveness using one spam rule.

Re: Notice of Data Breach

#143

Post by kaybe »

corpMaverick wrote: post #140
JimDabell wrote: post #115

The MyFitnessPal database has been compromised for years . I register with a unique email address for every website and app that I use so that I can tell when somebody's database gets compromised or they sell my data. I started getting an influx of spam to my MyFitnessPal email years ago. I told them about it at the time but they didn't care.

How do you do this ?

Get an account at mailhero.io. Works well for me so far.

Re: Notice of Data Breach

#144

Post by icebraining »

Dzidas wrote: post #105

I wonder, can I get a dump of the data collected on me based on the European Law? Similar, that Facebook provides to everyone.

Presumably yes. The site of the guy who sued FB has a template you might be able to reuse[1], although it mentions the Irish implementation of the Data Protection directive, whereas Under Armour Europe B.V. is Dutch, so you should probably change that.

[1] http://europe-v-facebook.org/EN/Get_your_Data_/get_your_data...

Re: Notice of Data Breach

#145

Post by taborj »

WA wrote: post #117
komali2 wrote: post #45

Somebody is about to come across 250 pictures of me in my boxers standing in front of a dirty mirror with my belly popping out. I only hope they don't judge me for the size of my belly not really changing over those 250 days...

They won't judge you, but your health insurance rate might go up for unspecific reasons . See, most comments here are a bit on the side of So what? Who cares? , but fitness data is health data and health data is considered extra sensitive. And I guess rightly so, because of this: http://www.tearsheet.co/data/allstate-is-watching-you-how-th... My prediction is that most health-related apps will be regulated in the nea…

Most EMR (electronic medical records) software isn't even regulated, though about 8-10 years ago there was a big todo about it coming down the line. Still hasn't happened. I would expect the EMRs to be regulated long before consumer apps.

Re: Notice of Data Breach

#146

Post by nradov »

WA wrote: post #117
komali2 wrote: post #45

Somebody is about to come across 250 pictures of me in my boxers standing in front of a dirty mirror with my belly popping out. I only hope they don't judge me for the size of my belly not really changing over those 250 days...

They won't judge you, but your health insurance rate might go up for unspecific reasons . See, most comments here are a bit on the side of So what? Who cares? , but fitness data is health data and health data is considered extra sensitive. And I guess rightly so, because of this: http://www.tearsheet.co/data/allstate-is-watching-you-how-th... My prediction is that most health-related apps will be regulated in the nea…

Insurance companies are tightly regulated by state and federal authorities. There is zero chance they would break the law by using illegal data to change pricing for a tiny fraction of their members. And even if they could legally use the data, their actuaries would have a tough time actually using it considering the lack of research about how fitness activities impact claims expenses.

Re: Notice of Data Breach

#147

Post by nradov »

taborj wrote: post #145
WA wrote: post #117

Earlier quoted context omitted.

They won't judge you, but your health insurance rate might go up for unspecific reasons . See, most comments here are a bit on the side of So what? Who cares? , but fitness data is health data and health data is considered extra sensitive. And I guess rightly so, because of this: http://www.tearsheet.co/data/allstate-is-watching-you-how-th... My prediction is that most health-related apps will be regulated in the nea…

Most EMR (electronic medical records) software isn't even regulated, though about 8-10 years ago there was a big todo about it coming down the line. Still hasn't happened. I would expect the EMRs to be regulated long before consumer apps.

Most EMR vendors specifically design their products to not be medical devices. They simply store, display, and transmit patient charts. If the FDA was to regulate EMRs as medical devices then logically they would also have to apply the same rules to filing cabinets and fax machines.

Re: Notice of Data Breach

#148

Post by heavenlyblue »

tzs wrote: post #96
Someone1234 wrote: post #34

That's unfortunate. At least we didn't get the stereotypical "your passwords are hashed, so nothing to worry about" one liner I've been reading from a lot of companies during disclosures. All they said here is that the passwords are hashed and with a reasonably secure method -- bcrypt (although without knowing work-factor and percentage of passwords, it is hard to know just how strongly). It has become pretty difficu…

> All they said here is that the passwords are hashed and with a reasonably secure method -- bcrypt (although without knowing work-factor and percentage of passwords, it is hard to know just how strongly) Speaking of proper password hashing--are there any methods similar to bcrypt but where you can increase the work factor on the currently stored passwords without having to have access to the plain password? E.g., su…

I think at least Django stores passwords with an additional field that defines the algorithm used to generate the hash of the password. One could think of a case where instead of algorithm selection you could properly define a simplistic DSL that actually defines how the hash is generated:

  algo | hash
  bcrypt(hardness=2,input=INPUT + 23423526) | 938240
  bcrypt(hardness=3,input=INPUT + 342352643) | 239223
Now the only thing that one needs to do is convert this table to:

  algo | hash
  bcrypt(hardness=3,bcrypt(hardness=2,input=INPUT + 23423526)) | 23423423
  bcrypt(hardness=3,bcrypt(hardness=3,input=INPUT + 342352643)) | 90192902
Where

  bcrypt(hardness=3,938240) = 23423423
  bcrypt(hardness=3,239223) = 90192902

Re: Notice of Data Breach

#149

Post by mygo »

nradov wrote: post #147
taborj wrote: post #145

Earlier quoted context omitted.

Most EMR (electronic medical records) software isn't even regulated, though about 8-10 years ago there was a big todo about it coming down the line. Still hasn't happened. I would expect the EMRs to be regulated long before consumer apps.

Most EMR vendors specifically design their products to not be medical devices. They simply store, display, and transmit patient charts. If the FDA was to regulate EMRs as medical devices then logically they would also have to apply the same rules to filing cabinets and fax machines.

If they are used to store protected health information it’s the practice’s duty to make sure they comply with HIPAA regulations. So for example can’t leave that file cabinet unlocked out in the front lobby.

When I was looking to make an app for a clinic they had to do a security review of the app. If the data wasn’t encrypted at rest it was a no-go. There are entire data companies sprouting out to address this issue. I think TrueVault is a Y-Combinator alum.

Re: Notice of Data Breach

#150

Post by tsumnia »

wingkongex wrote: post #83
borne0 wrote: post #70

Earlier quoted context omitted.

Hi, even if a data breach hadn't happened, did you have any concerns about people within the company having access to those photos? I also use myfitnesspal and strava but I have a strong aversion to sharing that kind of info with anyone, period. I'm 36, is this a generational thing?

Did you used to care that some dude at CVS would have possession of your photographs for hours at a time when you went to get them developed?

Well, the Polaroid camera was also a popular product during that same era. So I'd say, yes, people did care.
Post reply on HN