Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Personal and social information of 1.2B people discovered in data leak

dataviper.io

Post reply on HN
Print view View original

311–320 of 440 posts

Re: Personal and social information of 1.2B people discovered in data leak

#311

Post by hnick »

skissane wrote: post #207
john-radio wrote: post #64

Earlier quoted context omitted.

I reported an issue to the LinkedIn competitor https://about.me two years ago where signing in with my Google credentials gives me access to some the account of some random other person with a similar name to me. I think that during registration, I attempted to register about.me/johnradio (except it's not "johnradio"), but he was already using it, and then the bug occurred that gave me this access. I randomly check e…

My gmail is my first initial followed by my last name. There are other people on this planet with same first initial and last name, some of whom seem to think that must be their email too, because I keep on getting emails where they used it to sign up for things.

Trust me, I used my full first name, it's not enough to stop these people. One is a UK doctor, one is a US teacher, and I think there are one or two more. Been sent a few baby pictures from their relatives too.

Re: Personal and social information of 1.2B people discovered in data leak

#312

Post by vermilingua »

toxicFork wrote: post #305
krn wrote: post #234

> Analysis of the “Oxy” database revealed an almost complete scrape of LinkedIn data, including recruiter information. "Oxy" most likely stands for Oxylabs[1], a data mining service by Tesonet[2], which is a parent company of NordVPN. It is probably safe to assume, that LinkedIn was scraped using a residential proxy network, since Oxylabs offers "32M+ 100% anonymous proxies from all around the globe with zero IP bloc…

I'm a nordvpn user. Practices like this scares me though. I guess it's time to switch to a new vpn?

https://gist.github.com/joepie91/5a9909939e6ce7d09e29

Re: Personal and social information of 1.2B people discovered in data leak

#313

Post by YawningAngel »

GhettoMaestro wrote: post #273
jillesvangurp wrote: post #187

Earlier quoted context omitted.

It has to exist on a private network behind a firewall with ports open to application servers and other es nodes only. Running things on a public ip address is a choice that should not be taken lightly. Clustering over the public internet is not a thing with Elasticsearch (or similar products). If you are running mysql or postgres on a public ip address it would be equally stupid and irresponsible regardless of the u…

> At some point you just have to call out people for being utter morons. The blame is on them, 100%. [...] Your attitude is a symptom of a broader issue that plagues this industry: Indifference to risk*probability. If you don't ship software with "secure defaults" (depending on the threat/attack model), you essentially are handing out loaded shotguns, then blaming the "dumb" user when they inevitably point it at thei…

Is it a secondary concern, though? As a startup, uptake is as vital as oxygen

Re: Personal and social information of 1.2B people discovered in data leak

#314

Post by blondin »

SirYandi wrote: post #80
netsharc wrote: post #35

Earlier quoted context omitted.

Ah, looks like everyone's using that API key, I got 2 queries for my addresses and got a "rate limit exceeded" message. Strangely it only says I work in real estate (no I don't) when I looked up the email address I use for LinkedIn...

You, and others can use my api key, just signed up. e75ac28b25480e60071b24d819d4692a0b315c037046b9ff6ec9dfb1e99a895c

yours gone too now. very curious about this API lol

Re: Personal and social information of 1.2B people discovered in data leak

#315

Post by thegeomaster »

outworlder wrote: post #282
thegeomaster wrote: post #221

Earlier quoted context omitted.

I don't see why, though. It's much safer to start with a secure setup and then have the user disable the security explicitly (hopefully knowing what they're doing). Yes, username/password auth is not that common, but isn't it better than having no auth at all?

Ok, let's say username/password is mandatory and enabled by default. I see to options. Option one, they generate an unique password for every installation – non trivial to do, because at which point do you do it? It can't be before a cluster is formed, as you'll have a split brain generating a bunch of credentials. If you do it afterwards, then there is a period of time when you cluster is not yet protected. Worse ye…

I'd say option two is the only one viable. You deny access to the service until credentials are set by the user. You print huge warning labels while the credentials are set by the user to remind them of the possible consequences of setting weak credentials.

Yes, lost credentials will be subject of many support calls. Then, it boils down to your priorities. If you care about minimizing support calls, then sure, leave everything open to everyone. It will surely result in fewer access problems.

On the other hand, if your motivation is actually preventing your end-users from doing stupid things, it makes sense to just do the most conservative thing as default. Let the user change to the more liberal option, but not before informing them of all dangers that might befall them in that case.

I refuse to believe in this narrative of the end-user just being a stupid automaton who does not have any agency, and that any default imposed upon them will just result in them overriding the default with their terrible practices and ideas. I think there is a possibility of education and risk reduction.

Re: Personal and social information of 1.2B people discovered in data leak

#317

Post by toxicFork »

vermilingua wrote: post #312
toxicFork wrote: post #305

Earlier quoted context omitted.

I'm a nordvpn user. Practices like this scares me though. I guess it's time to switch to a new vpn?

https://gist.github.com/joepie91/5a9909939e6ce7d09e29

Ah... but that is very inconvenient :( I guess comfort comes at a cost.

Is there at least a less shady provider if I would like to compromise myself but a bit less than nordvpn? How far do we go in assuming all are bad?

Re: Personal and social information of 1.2B people discovered in data leak

#319

Post by jschwartzi »

jillesvangurp wrote: post #155

I was at an Elasticsearch meetup yesterday where we had a good laugh about several similar scandals in Germany recently involving completely unprotected Elasticsearch running on a public IP address without a firewall (e.g. https://www.golem.de/news/elasticsearch-datenleak-bei-conrad... , in German). This beats any of that. Out of the box it does not even bind to a public internet address. Somebody configured this to…

This addresses entirely the wrong question. By looking at it as a technical problem you're completely missing the broader ethical problem. Why was anyone allowed by law to amass this amount of data? And why did PDS not take the security and privacy concerns of 1.2 billion people seriously enough to ensure the data was handled correctly? They obviously thought it was valuable enough to amass a huge database. Do they sell this to just anyone? If not, who can buy access to this data? How much does it cost, and what steps are involved in doing so?

This makes me want to talk to a lawyer.

Re: Personal and social information of 1.2B people discovered in data leak

#320

Post by filoleg »

gddvhy wrote: post #252
calibas wrote: post #86

Earlier quoted context omitted.

I've always been a little confused how this works. If I got all that info for free, it's a "data leak", but if I pay to get the same detailed personal information it's... In either case my personal data is given away without my consent, but there's this implication that it's only an issue when someone doesn't pay for it.

If you get drivers info by hacking a DMV database, it's prison. If you got the same details by paying a few millions for FOIA requests, you're a good citizen and a model tax payer.

Jokes aside, can you really file FOIA requests to get personal driver details from DMV? I thought FOIA would only apply for stuff that is meant to be public, but isn't due to difficulties of hosting, putting it up, etc.

Mind you, I didn't research the topic of what can or cannot be requested with FOIA, so I might be totally wrong.

Post reply on HN