Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Personal and social information of 1.2B people discovered in data leak

dataviper.io

Post reply on HN
Print view View original

161–170 of 440 posts

Re: Personal and social information of 1.2B people discovered in data leak

#161

Post by pc86 »

troebr wrote: post #117
ThrustVectoring wrote: post #97

Earlier quoted context omitted.

It looks like it's a US-based company without enough of a European presence to fall under their jurisdiction.

https://gdpr.eu/companies-outside-of-europe/ it looks like it would? I'm no expert though.

> The whole point of the GDPR is to protect data belonging to EU citizens and residents. The law, therefore, applies to organizations that handle such data whether they are EU-based organizations or not, known as "extra-territorial effect."

They can say this all they want, but if you have no presence in the EU, and your jurisdiction does not have any agreement to apply GDPR regulations to you, then this is at most a strongly worded request.

Barring explicit agreements to the contrary (treaties, extradition agreements, etc), by definition a country's laws are only enforceable there.

If PDL has no business in Europe, no plans to expand there, and there's no treaty or other agreement making the provisions enforceable against them, the EU can say whatever it wants but PDL has no legal obligation to do anything about it.

Re: Personal and social information of 1.2B people discovered in data leak

#162

Post by pc86 »

gbear605 wrote: post #147
troebr wrote: post #117

Earlier quoted context omitted.

https://gdpr.eu/companies-outside-of-europe/ it looks like it would? I'm no expert though.

I’m also not an expert, but my understanding is that it applies but would be hard for the EU to take action against them

A law isn't a law if you can't enforce it, so "applies" has kind of a strange meaning in this context then, doesn't it?

Re: Personal and social information of 1.2B people discovered in data leak

#163

Post by klyrs »

mythrowaway1124 wrote: post #125
jonathankoren wrote: post #115

Earlier quoted context omitted.

For a while, our Comcast billing account accessed some other person’s account. Comcast didn’t take it seriously, and just told us to create a new account and not use the old one. (!!!) We had full access. I could have signed this person up for the most expensive package, or even canceled their service.

Let's be realistic here. Everyone knows it's not possible to cancel Comcast service.

I managed to cancel my dad's after he died. They STILL tried to upsell me! One of my favorite phrases ever uttered: "He's dead, you asshole, he doesn't need more channels!" And that actually did it. Felt sorry for the salesperson, who didn't have much of a choice in the matter...

Re: Personal and social information of 1.2B people discovered in data leak

#164

Post by shadowgovt »

badrequest wrote: post #46

Genuinely hope somebody goes to prison for this, but not gonna hold my breath.

Depending on the countries the data is hosted in and the attacker lives in, it's unclear any law has been broken that would land a person in jail.

If PDL had a flaw in their implementation that allowed someone to scrape them (or they didn't and someone did the hard work of creating 1.2 million fake accounts to register for 1,000 free API calls), it might be an uphill battle to prove even "unauthorized access."

Re: Personal and social information of 1.2B people discovered in data leak

#165

Post by jerrac »

jillesvangurp wrote: post #155

I was at an Elasticsearch meetup yesterday where we had a good laugh about several similar scandals in Germany recently involving completely unprotected Elasticsearch running on a public IP address without a firewall (e.g. https://www.golem.de/news/elasticsearch-datenleak-bei-conrad... , in German). This beats any of that. Out of the box it does not even bind to a public internet address. Somebody configured this to…

I've been using ES off and on since before 1.0 came out. It has always baffled me that ES doesn't require a username and password by default.

ES is a database that has to exist on a network to be usable. Heck, it expects that you have multiple nodes, and will complain if you don't. So one of the first things you do is expose it to the network so you can use it.

Yes, it takes some serious incompetence to not realize you need to secure your network, but why in the world would you not add basic authentication into ES from the start? I'd never design a tool like a database without including authentication.

I am serious about my question. Could anyone clue me in?

Re: Personal and social information of 1.2B people discovered in data leak

#166

Post by padraigoleary »

ngneer wrote: post #148

Ugh. To whomever is currently wasting their time and effort on differential privacy, take a good long look.

Why? Interested in why you think differential privacy would make any difference... The fault here seems to be an open es server.

Re: Personal and social information of 1.2B people discovered in data leak

#167

Post by Izkata »

asdfman123 wrote: post #112
anilshanbhag wrote: post #31

People data labs's data is pretty accurate. Here is mine: https://api.peopledatalabs.com/v4/person?api_key=9c6a1382204... You can try it for yourself by changing the email. All of the information is public, so I don't mind. They are basically doing data integration.

Wait, so is this mostly just Linkedin data in JSON form?

My personal email seems to be based on Github and Gravatar, while my job search and work emails got linked together and appear to be based on LinkedIn.

Re: Personal and social information of 1.2B people discovered in data leak

#168

Post by briffle »

rohan1024 wrote: post #154
anilshanbhag wrote: post #31

People data labs's data is pretty accurate. Here is mine: https://api.peopledatalabs.com/v4/person?api_key=9c6a1382204... You can try it for yourself by changing the email. All of the information is public, so I don't mind. They are basically doing data integration.

Your api key is now permanently in public. After few days, people will still be able to use this for their own usage.

a few days? its already hit its limit :)

Re: Personal and social information of 1.2B people discovered in data leak

#169

Post by mixmastamyk »

nontoxyc wrote: post #106
ars wrote: post #79

I don't know about other people, but I have zero personal info with LinkedIn and Facebook. They only info they have about me is info I don't mind being public. If I want something to be private I don't tell it to them. It's as simple as that. Google on the other hand, knows lots of private things.

Facebook has a lot of personal information about you even if you have never had a Facebook account. For example: your GPS location data, approximate age, gender, ethnicity.... Welcome to the future komrade. Sadly, it's not a matter of just "not giving them" your location data. Your devices supply it.

And your friends too. I dutifully kept a new number out of FB until a friend messaged me with, is this your number right? Xxx-xxx-xxx. They can also tag you and auto tag you through face recognition.

Re: Personal and social information of 1.2B people discovered in data leak

#170

Post by Xylakant »

jillesvangurp wrote: post #155

I was at an Elasticsearch meetup yesterday where we had a good laugh about several similar scandals in Germany recently involving completely unprotected Elasticsearch running on a public IP address without a firewall (e.g. https://www.golem.de/news/elasticsearch-datenleak-bei-conrad... , in German). This beats any of that. Out of the box it does not even bind to a public internet address. Somebody configured this to…

> Out of the box it does not even bind to a public internet address.

Bind to all interfaces used to be the default in 1.x - it changed pretty much because people were footgunning themselves.

Coupled with lack of security in the base/free distribution, that made for a dangerous pitfall. At least now security is finally part of the free offering, but the OSS version still comes with no access control at all.

Post reply on HN