Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Capital One Says Breach Hit 100M Individuals in U.S

bloomberg.com

Post reply on HN
Print view View original

281–290 of 319 posts

Re: Capital One Says Breach Hit 100M Individuals in U.S

#281

Post by mattmar96 »

kyrra wrote: post #275
joekrill wrote: post #266

The way they are disclosing this is pretty disgusting, in my opinion. Go check out their info page about this[1]. In bold it says: > No bank account numbers or Social Security numbers were compromised, other than: Then below that, in non-bold, it basically says "oh, except for these 140,000 social security numbers and 80,000 bank account numbers" - which is the primary reason folks are worried about this! To me, the…

But the those 140k and 80k number are their own bullet points that I feel make them stand out more then the bold line. I feel like this is clear enough.

But directly below, on a non bullet-pointed line, they mention that one million Canadian social insurance numbers were compromised..

Re: Capital One Says Breach Hit 100M Individuals in U.S

#282

Post by cultus »

uxp100 wrote: post #278
notus wrote: post #105

Earlier quoted context omitted.

Oh cool I use the same LaTeX template as her for my resume. Mine is blue instead of pink though! https://github.com/posquit0/Awesome-CV

I feel modern CV is a little clumsy. Especially how it handles columns. You like this better? The example provided I don't love, but I'm not a designer, it looks good enough I think.

I use it too. I think it looks good enough, definitely better than my last horrible-looking resume. It seems to work well with a bit more text compared to many.

Re: Capital One Says Breach Hit 100M Individuals in U.S

#283

Post by grayed-down »

longcommonname wrote: post #188
grayed-down wrote: post #170

I'll be spec'ing a project soon where I think the organization's data should be self hosted. I'm going to show them this piece.

A news article is a terrible reason to make engineering decisions.

I single news article, certainly. A handful of news articles, probably. But news articles can be effectively used to support strategic decision making. It's done all the time.

In my case I believe that putting trade secrets on an AWS cloud instance just doesn't seem like a good idea.

Re: Capital One Says Breach Hit 100M Individuals in U.S

#284

Post by joekrill »

kyrra wrote: post #275
joekrill wrote: post #266

The way they are disclosing this is pretty disgusting, in my opinion. Go check out their info page about this[1]. In bold it says: > No bank account numbers or Social Security numbers were compromised, other than: Then below that, in non-bold, it basically says "oh, except for these 140,000 social security numbers and 80,000 bank account numbers" - which is the primary reason folks are worried about this! To me, the…

But the those 140k and 80k number are their own bullet points that I feel make them stand out more then the bold line. I feel like this is clear enough.

This is obviously anecdotal, but that was not my personal experience. I was getting ready to go to bed last night when I saw this and grabbed my tablet to see if I needed to worry. This bolded bit was the first thing I saw, and I immediately thought "hm, must have been over-exaggerated, no SSNs were exposed". Now I obviously read on and saw the bullet point, but for someone skimming this, it's not at all obvious.

But further, why even word it that way? It was clearly done intentionally. There's no need for this to be presented in this way other than to intentionally try to mislead. Why not just say, in bold letters "140,000 social security numbers and 80,000 bank account numbers were compromised". Or say it "The following were compromised".

Re: Capital One Says Breach Hit 100M Individuals in U.S

#285

Post by cultus »

JudgeWapner wrote: post #252
rasz wrote: post #247

Earlier quoted context omitted.

I wonder if it could be an effective legal defense for her, akin to plot of Soderbergh Side Effects (2013). "not guilty by reason of insanity" due to hormonal treatment, there are precedents https://www.charlotteobserver.com/news/local/crime/article64... https://ps.psychiatryonline.org/doi/full/10.1176/appi.ps.53.... https://www.mercurynews.com/2012/08/21/man-acquitted-after-a...

Maybe drs shouldn't prescribe meds in such doses if they have such harmful effects?

It's really tough, because not treating gender dysphoria properly can be much more dangerous. It's a severe disorder thats made much, much worse by discrimination.

It really seems like a lot of cases of gender dysphoria is more society driven. Younger trans or non-binary kids I know seem to be quite a bit happier than trans folks I know in their 30's. Gender is not inherently tied to sex, and variation in gender expression is normal and not unhealthy at all (societies all around the world recognize it). I think improving attitudes might really be having an effect of reducing the amount of gender dysphoria.

Re: Capital One Says Breach Hit 100M Individuals in U.S

#286

Post by ms512 »

bagels wrote: post #217
QuinnyPig wrote: post #112

Earlier quoted context omitted.

Unlikely. S3 was publicly rebuilt in the wake of the 2017 S3pocalypse.

What does this refer to?

Likely referring to the February 28th, 2017 S3 Service Disruption in the Northern Virginia (US-EAST-1) Region, for which Amazon published a postmortem at https://aws.amazon.com/message/41926/

Re: Capital One Says Breach Hit 100M Individuals in U.S

#287

Post by hvo »

dopylitty wrote: post #98
parzivalm wrote: post #84

Earlier quoted context omitted.

If you took ten seconds to look at the posted source note above, you would see Cloud Custodian has a policy to enforce bucket encryption.

Bucket encryption doesn't protect against anything except someone getting access to the hard drives underlying S3 and somehow recovering data. If you've somehow left access to a bucket open the odds are that you also have it configured to let anyone with access to the bucket decrypt the files. AWS calls this server side encryption, where S3 automatically encrypts and decrypts files for you. You can also do client sid…

"You can also do client side encryption, of course, but it's much more difficult to manage because you have to deal with keys in your application."

Well,SSE-KMS is not difficult to manage if you have sensitive customers data like Capital One does. I use it all the time. You can pretty much audit the buckets and see what is going on.

And if Capital One has used SSE-KMS on the buckets,we might not be talking about this data breach today.Incompetence? Complacency?

Re: Capital One Says Breach Hit 100M Individuals in U.S

#288

Post by Scoundreller »

ryanlol wrote: post #274
Scoundreller wrote: post #117

Earlier quoted context omitted.

Sometimes the best way to handle "bad" traffic is not to reject/block it, but to respond to it incredibly slowly, or divert to an uninteresting flaky phantom server, or reject every login attempt (even with correct credentials) to divert attacker's attention. The ingress was okay, but the egress flow was very very bad!

That seems like a great way to waste your own time accomplishing nothing.

I think it was a part of mailinator’s approach to running a disposable email server.

The operator’s approach to bad actors was to respond as slowly as possible instead of quickly rejecting.

Re: Capital One Says Breach Hit 100M Individuals in U.S

#290

Post by kayfox »

joekrill wrote: post #266

The way they are disclosing this is pretty disgusting, in my opinion. Go check out their info page about this[1]. In bold it says: > No bank account numbers or Social Security numbers were compromised, other than: Then below that, in non-bold, it basically says "oh, except for these 140,000 social security numbers and 80,000 bank account numbers" - which is the primary reason folks are worried about this! To me, the…

And in a non bulleted sentence below that it notes that 1 million Canadians social insurance numbers were also compromised.
Post reply on HN