Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Personal and social information of 1.2B people discovered in data leak

dataviper.io

Post reply on HN
Print view View original

321–330 of 440 posts

Re: Personal and social information of 1.2B people discovered in data leak

#321

Post by mrkstu »

williamscales wrote: post #238
skissane wrote: post #207

Earlier quoted context omitted.

My gmail is my first initial followed by my last name. There are other people on this planet with same first initial and last name, some of whom seem to think that must be their email too, because I keep on getting emails where they used it to sign up for things.

Even more baffling are the ones who use it to fill out job applications.

I get bank statements, job offers, party invitations, and lately a bunch of lets say very questionable email verifications from euro 'dating' sites- I've identified the guy in the UK but its too much (and getting embarrassing now) to keep forwarding his stuff to him.

Downside of getting in early on popular email services.

Re: Personal and social information of 1.2B people discovered in data leak

#322

Post by achillean »

throwaway5752 wrote: post #260
jillesvangurp wrote: post #155

I was at an Elasticsearch meetup yesterday where we had a good laugh about several similar scandals in Germany recently involving completely unprotected Elasticsearch running on a public IP address without a firewall (e.g. https://www.golem.de/news/elasticsearch-datenleak-bei-conrad... , in German). This beats any of that. Out of the box it does not even bind to a public internet address. Somebody configured this to…

Wasn't this exact same thing a huge scandal just a few years ago for Mongo on Shodan? I can't believe anyone shipping a datastore could let it happen after that. Doesn't postgresql still limit the default listen_address to local connections only? Seems like the best approach. On a distribute store consistency operations between nodes should go on a different channel than queries and should be allowed on a node by nod…

Yes, and similar issues still exist with public MongoDB instances even though the defaults are secure.

Re: Personal and social information of 1.2B people discovered in data leak

#323

Post by vermilingua »

toxicFork wrote: post #317
vermilingua wrote: post #312

Earlier quoted context omitted.

https://gist.github.com/joepie91/5a9909939e6ce7d09e29

Ah... but that is very inconvenient :( I guess comfort comes at a cost. Is there at least a less shady provider if I would like to compromise myself but a bit less than nordvpn? How far do we go in assuming all are bad?

All the way. It isn’t as if all VPN providers are part of a shadowy cabal to steal your data from an otherwise valuable service; the very premise of commercial VPNs is flawed. Any VPN service is inherently harmful.

Re: Personal and social information of 1.2B people discovered in data leak

#324

Post by jwandborg »

cobookman wrote: post #222
jillesvangurp wrote: post #187

Earlier quoted context omitted.

It has to exist on a private network behind a firewall with ports open to application servers and other es nodes only. Running things on a public ip address is a choice that should not be taken lightly. Clustering over the public internet is not a thing with Elasticsearch (or similar products). If you are running mysql or postgres on a public ip address it would be equally stupid and irresponsible regardless of the u…

There's something called defense in depth. Even with ES deployed in an environment with proper network firewall rules...etc, I'd still want some sort of authentication/RBAC

"Defense in depth" sounds, to me, like a phrase to justify multiple layers of imperfect security.

A single layer of cloth might not hold water, adding more layers of cloth may hold water for longer, but it's probably more cost effective to start with the right material.

Re: Personal and social information of 1.2B people discovered in data leak

#325

Post by staticassertion »

jillesvangurp wrote: post #155

I was at an Elasticsearch meetup yesterday where we had a good laugh about several similar scandals in Germany recently involving completely unprotected Elasticsearch running on a public IP address without a firewall (e.g. https://www.golem.de/news/elasticsearch-datenleak-bei-conrad... , in German). This beats any of that. Out of the box it does not even bind to a public internet address. Somebody configured this to…

Other databases learned that not requiring a user/password upon install is completely irresponsible. ES and other dbs need to catch up ASAP, it's ridiculous.

Documentation is not security. If you need to "RTFM" to not be in an ownable state it's ES's fault.

Re: Personal and social information of 1.2B people discovered in data leak

#326

Post by ThrustVectoring »

troebr wrote: post #117
ThrustVectoring wrote: post #97

Earlier quoted context omitted.

It looks like it's a US-based company without enough of a European presence to fall under their jurisdiction.

https://gdpr.eu/companies-outside-of-europe/ it looks like it would? I'm no expert though.

Legal jurisdiction is a separate matter than the specific text of laws. The "this applies to non-European companies" things just means that if you fall under the jurisdiction of European courts, you can't absolve yourself of responsibility of complying with this law simply by being a foreign-registered company.

On the other hand, if you never fall under European jurisdiction in the first place, you're free to ignore them, just as you can ignore Thai laws against insulting their king. One very important thing to note is that setting foot in European soil will expose you to their jurisdiction, so you've significantly limited your freedom of movement, but if GDPR compliance is a bigger deal than that then "just never go to Europe" can be a viable strategy.

Re: Personal and social information of 1.2B people discovered in data leak

#327

Post by lazyasciiart »

mrkstu wrote: post #321
williamscales wrote: post #238

Earlier quoted context omitted.

Even more baffling are the ones who use it to fill out job applications.

I get bank statements, job offers, party invitations, and lately a bunch of lets say very questionable email verifications from euro 'dating' sites- I've identified the guy in the UK but its too much (and getting embarrassing now) to keep forwarding his stuff to him. Downside of getting in early on popular email services.

I went through several rounds of conversation with somebody's wedding planner over email.

Re: Personal and social information of 1.2B people discovered in data leak

#328

Post by skissane »

mrkstu wrote: post #321
williamscales wrote: post #238

Earlier quoted context omitted.

Even more baffling are the ones who use it to fill out job applications.

I get bank statements, job offers, party invitations, and lately a bunch of lets say very questionable email verifications from euro 'dating' sites- I've identified the guy in the UK but its too much (and getting embarrassing now) to keep forwarding his stuff to him. Downside of getting in early on popular email services.

> but its too much (and getting embarrassing now) to keep forwarding his stuff to him

What amazes me is when I get misaddressed email, and I reply to say its misaddressed (and I'm not talking about automated services, I'm talking about obviously manually sent stuff), and my reply just gets ignored and the misaddressed email just keeps on coming.

Re: Personal and social information of 1.2B people discovered in data leak

#329

Post by acangiano »

skissane wrote: post #207
john-radio wrote: post #64

Earlier quoted context omitted.

I reported an issue to the LinkedIn competitor https://about.me two years ago where signing in with my Google credentials gives me access to some the account of some random other person with a similar name to me. I think that during registration, I attempted to register about.me/johnradio (except it's not "johnradio"), but he was already using it, and then the bug occurred that gave me this access. I randomly check e…

My gmail is my first initial followed by my last name. There are other people on this planet with same first initial and last name, some of whom seem to think that must be their email too, because I keep on getting emails where they used it to sign up for things.

I get several on a weekly basis. It's amazing how many services do not verify emails and just trust their users to own the email they claim to own.

Re: Personal and social information of 1.2B people discovered in data leak

#330

Post by jwandborg »

staticassertion wrote: post #325
jillesvangurp wrote: post #155

I was at an Elasticsearch meetup yesterday where we had a good laugh about several similar scandals in Germany recently involving completely unprotected Elasticsearch running on a public IP address without a firewall (e.g. https://www.golem.de/news/elasticsearch-datenleak-bei-conrad... , in German). This beats any of that. Out of the box it does not even bind to a public internet address. Somebody configured this to…

Other databases learned that not requiring a user/password upon install is completely irresponsible. ES and other dbs need to catch up ASAP, it's ridiculous. Documentation is not security. If you need to "RTFM" to not be in an ownable state it's ES's fault.

Trusting software you install to be secure is ridiculous and completely irresponsible, especially if you did not pay for someone else to take the blame.

The only thing you can do to secure your software is to restrict its communication channels. Once you've secured the communication channels, the software auth is decorative at best.

Post reply on HN