Personal and social information of 1.2B people discovered in data leak • Hacker News Board

Re: Personal and social information of 1.2B people discovered in data leak

#111

Post by karlding » Fri, Nov 22, 2019, 5:48 PM UTC

narrator wrote: post #94

This is why I lie about my birthdate by a couple of days on anything where it's not something like a medical record or where I am required to tell the truth for whatever reason. I also never provide my social security number unless it is required by law.

One of my coworkers generates a fake middle name for every service they sign up with. According to him, this serves as a unique identifier allowing them to determine when a service is selling their data to a third party (or data is being leaked).

Re: Personal and social information of 1.2B people discovered in data leak

#112

Post by asdfman123 » Fri, Nov 22, 2019, 5:49 PM UTC

anilshanbhag wrote: post #31

People data labs's data is pretty accurate. Here is mine: https://api.peopledatalabs.com/v4/person?api_key=9c6a1382204... You can try it for yourself by changing the email. All of the information is public, so I don't mind. They are basically doing data integration.

Wait, so is this mostly just Linkedin data in JSON form?

Re: Personal and social information of 1.2B people discovered in data leak

#113

Post by arbuge » Fri, Nov 22, 2019, 5:49 PM UTC

> 400 million+ phone numbers. 200 million+ US-based valid cell phone numbers.

Sounds like a nightmare in the making for those cell phone users and their carriers when those begin to get SIM jacked.

Re: Personal and social information of 1.2B people discovered in data leak

#114

Post by soylentcola » Fri, Nov 22, 2019, 5:50 PM UTC

BoorishBears wrote: post #52

anilshanbhag wrote: post #31

People data labs's data is pretty accurate. Here is mine: https://api.peopledatalabs.com/v4/person?api_key=9c6a1382204... You can try it for yourself by changing the email. All of the information is public, so I don't mind. They are basically doing data integration.

Haha, when I was a kid and scared to use my real name for things, for some reason I used my email... which had my real name in it, to open a Github account with a fake name So the api knows me as the famous architect, Art Vandelay

Reminds me of when I used to get free magazine subscriptions (and the subsequent junk mail/robocalls) addressed to Santos L. Halper.

Re: Personal and social information of 1.2B people discovered in data leak

#115

Post by jonathankoren » Fri, Nov 22, 2019, 5:50 PM UTC

simonlc wrote: post #96

john-radio wrote: post #64

Earlier quoted context omitted.

I reported an issue to the LinkedIn competitor https://about.me two years ago where signing in with my Google credentials gives me access to some the account of some random other person with a similar name to me. I think that during registration, I attempted to register about.me/johnradio (except it's not "johnradio"), but he was already using it, and then the bug occurred that gave me this access. I randomly check e…

I actually had a similar thing happen with facebook, though we didnt share names.

For a while, our Comcast billing account accessed some other person’s account. Comcast didn’t take it seriously, and just told us to create a new account and not use the old one. (!!!)

We had full access. I could have signed this person up for the most expensive package, or even canceled their service.

Re: Personal and social information of 1.2B people discovered in data leak

#116

Post by auiya » Fri, Nov 22, 2019, 5:52 PM UTC

Ididntdothis wrote: post #24

Havoc wrote: post #17

Out of curiosity how do you guys think they managed to scrape LinkedIn on such a large scale? I've been wanting to do some social graph experimentation on it (small scale - say 1000 people near me) but concluded I probably couldn't scrape enough via raw scraping without freaking out their anti-scraping. (And API is a non-starter since that basically says everything is verboten).

You probably have to be highly distributed. At least that’s what I did when I tried to scrape a large site some years ago. I had around 100 machines in different countries and gave each of them random pages to scrape.

Username checks out

Re: Personal and social information of 1.2B people discovered in data leak

#117

Post by troebr » Fri, Nov 22, 2019, 5:53 PM UTC

ThrustVectoring wrote: post #97

troebr wrote: post #90

Earlier quoted context omitted.

It would be really surprised if this were compliant with the GDPR. I live in the US but I tried email accounts of relatives in Europe and they had data in there.

It looks like it's a US-based company without enough of a European presence to fall under their jurisdiction.

https://gdpr.eu/companies-outside-of-europe/ it looks like it would? I'm no expert though.

Re: Personal and social information of 1.2B people discovered in data leak

#118

Post by stopadvertising » Fri, Nov 22, 2019, 5:54 PM UTC

sparkywolf wrote: post #48

I found a vulnerability in linkedIn a few years back that allowed anyone to access a private profile (because client side validation was enough for them I guess..?) They didn't take my report seriously (still not completely patched) and I feel like that told me all I needed to know about their security practices.

I deleted my linkedin a few years back when they had some bug where I would randomly get page views as some other person, with all their connections and account details and whatnot. It would only last a few minutes then switch me back to my account, but they aggressively ignored my attempts to reach out to them about this bug so I just gave up.

Re: Personal and social information of 1.2B people discovered in data leak

#119

Post by stfwn » Fri, Nov 22, 2019, 5:56 PM UTC

troebr wrote: post #90

anilshanbhag wrote: post #31

People data labs's data is pretty accurate. Here is mine: https://api.peopledatalabs.com/v4/person?api_key=9c6a1382204... You can try it for yourself by changing the email. All of the information is public, so I don't mind. They are basically doing data integration.

It would be really surprised if this were compliant with the GDPR. I live in the US but I tried email accounts of relatives in Europe and they had data in there.

Oh yes, I'm going to try and see if they have data on me and send a number of GDPR requests if they do. For others from the EU, it's very easy to do using: https://www.mydatadoneright.eu/request

Re: Personal and social information of 1.2B people discovered in data leak

#120

Post by input_sh » Fri, Nov 22, 2019, 5:57 PM UTC

korethr wrote: post #74

rohan1024 wrote: post #18

Firefox monitor can tell you if your information was leaked in data breaches. I don't think they have this data set though. https://monitor.firefox.com/

This looks like a wrapper around Have I Been Pwned.

That's precisely what it is. From[0]:

> Through our partnership with Troy Hunt’s “Have I Been Pwned,” your email address will be scanned against a database that serves as a library of data breaches. We’ll let you know if your email address and/or personal info was involved in a publicly known past data breach.

https://blog.mozilla.org/blog/2018/09/25/introducing-firefox...