Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DoorDash confirms data breach affected 4.9M customers, workers and merchants

techcrunch.com

Post reply on HN
Print view View original

121–130 of 224 posts

Re: DoorDash confirms data breach affected 4.9M customers, workers and merchants

#121

Post by sterlind »

njarboe wrote: post #46
hombre_fatal wrote: post #28

Earlier quoted context omitted.

Hell, imagine how many scans of people’s passports and driver’s licenses are sitting in databases waiting to be leaked, yet images of those documents let you authenticate with all sorts of financial institutions online from banks to Coinbase to Paypal. We really need to rethink all this. Until then, it feels like mere luck that today wasn’t the day someone decided to social engineer their way into your life. Everythi…

If militaries have any imagination, they already have this data for their adversaries' populations and have cyber weapons ready to do this quickly at massive scale.

I'd assumed that was the motivation for the OPM hack. Helps root out agents and handlers since they have SF-86 forms and biometrics, but also a massive database for identity fraud. Also helps with money laundering, which even richer states can benefit from.

Re: DoorDash confirms data breach affected 4.9M customers, workers and merchants

#123

Post by ajhurliman »

cj wrote: post #13

> The information accessed is not sufficient to make fraudulent charges on your payment card. In other words... "We leaked a bunch of your personal information, but at least it's not enough data to steal your money!" All of these leaks have the cumulative effect of making ineffective very commonly used security verification questions: "Can I verify that last 4 of your social? And the last 4 of your credit card?" How…

Alternative, when do we start using proxy services that give minimal, fake information that forwards to our real identity? Apple sign-in was an understated release, but it will be one of the company's flagship products in years to come.

Re: DoorDash confirms data breach affected 4.9M customers, workers and merchants

#124

Post by munk-a »

basicplus2 wrote: post #80
jacquesm wrote: post #42

There is a silver lining in all these data breaches. At some point in time all our data will have been leaked at least once and probably more than once and subsequent leaks will not do any more damage. The safe assumption would then be to not trust any accounts created online without some good old KYC processes in place requiring live verification of identity.

A government created physical token for every person could be the direction we are headed

Alternatively, we might be headed for sane data breach and privacy laws. Something like... if you want to store personal data then pay for an external audit or have your domain confiscated - done.

Re: DoorDash confirms data breach affected 4.9M customers, workers and merchants

#125

Post by dylan604 »

anigbrowl wrote: post #92
dmix wrote: post #86

Earlier quoted context omitted.

What websites are storing your mother’s maiden name? Besides maybe the bank

Anyone that asks a security question, eBay for one.

Only if you provided that information as answer. kwPP2ET6cJMFXVD7BXKJ is an acceptable answer to the maiden name question.

Re: DoorDash confirms data breach affected 4.9M customers, workers and merchants

#126

Post by munk-a »

novok wrote: post #101
greenail wrote: post #87

Earlier quoted context omitted.

So how would you handle this breach with your fastmail alias?

If I start noticing annoying spam being sent to doordash@a.domain.com then I make an email rule to delete it and change my doordash account email to doordash_again@a.domain.com along with a password change with my password manager?

It'd be nice if there was a way to way that pile of emails at some authority and say "Here, this is the crap that's come of that data breach." Ditto for any authorized (but shady) third party data sharing.

Sadly we currently lack a consumer protection bureau.

Re: DoorDash confirms data breach affected 4.9M customers, workers and merchants

#127

Post by dmix »

anigbrowl wrote: post #92
dmix wrote: post #86

Earlier quoted context omitted.

What websites are storing your mother’s maiden name? Besides maybe the bank

Anyone that asks a security question, eBay for one.

Oh yeah I have some memorable made up names I put in those. Never thought to use my real one.

Re: DoorDash confirms data breach affected 4.9M customers, workers and merchants

#129

Post by dylan604 »

munk-a wrote: post #72
hnruss wrote: post #69

Wonder if I'll get another $25-50 from a class action lawsuit over this.

Nah, you'll be offered 25-50$ but then they'll swap it out for 25-50$ in credit monitoring and/or applebee's coupons at the last minute.

I think I take the credit monitoring in this instance?

Re: DoorDash confirms data breach affected 4.9M customers, workers and merchants

#130

Post by throwaway867295 »

(Throwaway account)

I used to work for a third-party service provider that merchants send this sort of data to for lots of users. Considering there weren't lots of customers using this provider making similar posts, and Doordash didn't call out the provider, it wouldn't surprise me if a Doordash employee account with that provider got compromised. The blog post was carefully worded to not throw the provider under the bus, but also avoid taking blame, themselves.

The telling bit is that the last four digits of credit card numbers were sent. There are only a few types of vendors you'd send that data to.

Post reply on HN