Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

EasyJet admits a cyber-attack has affected approximately nine million customers

bbc.co.uk

Post reply on HN
Print view View original

131–140 of 164 posts

Re: EasyJet admits a cyber-attack has affected approximately nine million customers

#131

Post by x86_64Ubuntu »

ShinTakuya wrote: post #85
x86_64Ubuntu wrote: post #80

Earlier quoted context omitted.

Is there a technical reason to use a GET for authentication? I've always seen it as a POST. If you use GET, won't your parameters be plainly visible in well, everything, unless they put them in the body and that's a whole nother can of worms.

No, https encrypts the URL as well (although the domain itself can be leaked via DNS). But in most respects query params are no different to the body security wise. The main difference is that if you bookmark it, you may end up storing your sensitive data in your bookmarks.

I had no clue the URL was encrypted too. So how does DNS work? Or does it send through plaintext the name of the server, and the rest of the URL has to be encrypted by the endpoint.

Re: EasyJet admits a cyber-attack has affected approximately nine million customers

#132

Post by hammock »

nkrisc wrote: post #96
hammock wrote: post #61

Earlier quoted context omitted.

Someone could hack themselves constantly and get paid to do it

Yes, there are many criminal ways to make money. It would be nothing new. For example, burning your house or failing business down to make a claim is probably as old as insurance.

Insurance claims are not an entitlement provided by government.

Re: EasyJet admits a cyber-attack has affected approximately nine million customers

#133

Post by ozim »

Raed667 wrote: post #54

What I don't see in this article, is how can I (as an EasyJet customer) check if my data was breached?

These affected customers will be contacted in the next few days. If you are not contacted then your information has not been accessed.

Re: EasyJet admits a cyber-attack has affected approximately nine million customers

#134

Post by Balgair »

morsch wrote: post #19

Any customer data, and especially PII, needs to be toxic. The toxicity needs to increase super-linearly with the total amount of data, because the value of leak does, too, while the difficulty of the breach probably does not. It needs to be so expensive to store extensive data of millions of people that companies (or for that matter, the government) cannot wait to get rid of it. Currently, most online shops nudge me…

I think the saying is that : 'data is not the new oil, it's the new uranium'

Re: EasyJet admits a cyber-attack has affected approximately nine million customers

#135

Post by Nextgrid »

snowwolf wrote: post #75

> EasyJet said it first became aware of the attack in January. vs > The GDPR introduces a duty on all organisations to report certain types of personal data breach to the relevant supervisory authority. You must do this within 72 hours of becoming aware of the breach, where feasible. So either EasyJet was delayed in their reporting of the breach, or the ICO didn't feel it was urgent to notify 9 million people that th…

From my experience reporting various GDPR violations is it clear that the ICO does not actually want to enforce the regulation so this is not surprising.

Re: EasyJet admits a cyber-attack has affected approximately nine million customers

#136

Post by Nextgrid »

hammock wrote: post #61
jbverschoor wrote: post #39

Time for datapoint tax, which will reimburse victims of these crimes

Someone could hack themselves constantly and get paid to do it

If they can hack themselves then they can hack someone else so the payout would still be justified.

Re: EasyJet admits a cyber-attack has affected approximately nine million customers

#137

Post by Nextgrid »

mangatmodi wrote: post #41

Interesting. Were they storing/operating unsalted plaintext credit card info? I hope not.

Credit card information is needed as-is to be able to make transactions so hashing (and thus salting) doesn’t apply. Encryption is the best you can do.

Re: EasyJet admits a cyber-attack has affected approximately nine million customers

#138

Post by FearNotDaniel »

> Stolen credit card data included the three digital security code - known as the CVV number - on the back of the card itself.

I always thought that PCI-DSS standards mandate that the CVV must never be stored; I get that card number and expiry date may be stored for customer convenience purposes, speeding checkout when returning for a second purchase, but how on earth could they be compliant if they are stashing away CVVs somewhere?

Re: EasyJet admits a cyber-attack has affected approximately nine million customers

#139

Post by thephyber »

guptaneil wrote: post #118
morsch wrote: post #19

Any customer data, and especially PII, needs to be toxic. The toxicity needs to increase super-linearly with the total amount of data, because the value of leak does, too, while the difficulty of the breach probably does not. It needs to be so expensive to store extensive data of millions of people that companies (or for that matter, the government) cannot wait to get rid of it. Currently, most online shops nudge me…

This is how I’m building my startup[1]. All data stays with the customer and we actively don’t want it, because that’s how I wish all my products worked. I suspect you will see more startups who treat data more respectfully in the future, as the next wave of founders have experienced the consequences of unrestricted data collection. Having said that, I also think a large part of the problem is that treating data like…

> There are more established patterns for data collection than data destruction. How do you know when it’s safe to delete some piece of data?

I agree, but this is exactly analogous to the SDLC. Most coders only learn to hack together barely-working code. Those who spend the effort to learn the craft figure out how to {version control, unit test, static analysis, benchmark, integration test, upgrade library dependencies} and automate these processes.

Similarly, there needs to be a data lifecycle with defined retention lifetimes for different data, defined processes for actually disposing of data, and special handling cases for backup blobs (which may be retained longer than the retention lifetime of a subset of the data in the backups). This is effectively intended by the GDPR (not sure if it states explicitly) and similar laws.

Re: EasyJet admits a cyber-attack has affected approximately nine million customers

#140

Post by csharptwdec19 »

guptaneil wrote: post #118
morsch wrote: post #19

Any customer data, and especially PII, needs to be toxic. The toxicity needs to increase super-linearly with the total amount of data, because the value of leak does, too, while the difficulty of the breach probably does not. It needs to be so expensive to store extensive data of millions of people that companies (or for that matter, the government) cannot wait to get rid of it. Currently, most online shops nudge me…

This is how I’m building my startup[1]. All data stays with the customer and we actively don’t want it, because that’s how I wish all my products worked. I suspect you will see more startups who treat data more respectfully in the future, as the next wave of founders have experienced the consequences of unrestricted data collection. Having said that, I also think a large part of the problem is that treating data like…

Startups now have to think about things like GDPR and Cali's laws, so they have to think about this data more -anyway-.

> I also think a large part of the problem is that treating data like toxic waste is hard.

Yep. It's a -lot- of extra work to do. It's a balancing act between:

- Keeping data long enough to satisfy govt regulations, rulings, or existing contracts with your vendors (i.e. merchant account with a bank for CC processing.) You can't just order something from amazon, Send a GDPR request and expect all your data to be gone; They can't delete it until -after- those retention periods have expired.

- Following Regulations like GDPR/Cali Privacy law.

- Still doing meaningful things with the data.

Generally speaking, I'd say this is all stuff that makes a Data architect very handy in the modern climate.

Post reply on HN