481–490 of 524 posts
Earlier quoted context omitted.
Thanks. I'm just getting a "Please open Telegram to view this post from @freedomf0x" message. Any way to access this without signing up for Telegram? The irony of giving my personal info to another 3rd party just to check if my personal info was leaked by a different party is too much...
the telegram has a text file with links to links by country, I've just stuck that at https://pastebin.com/3SvG1FJ0
Earlier quoted context omitted.
This. I don't trust in the government, but I think digital "personal data" should be only available for "confirmation" to companies that need it. Say, a government entity could have an API that allow you to send hashed personal data that they can verify is right. This way companies will ask the user for their data and hash it client-side. Then they can send the hashes (hashed with a custom provided salt to the entity…
Wouldn't this fall down as soon as someone enters your details with the wrong casing or uses a +country code rather than a localised phone number and so on? Humans will error and enter data incorrectly so the hash would be different every time potentially despite being "correct" to a human at a glance? You could standardise everything (lowercase etc) but I imagine there are country and regional edge cases such as cap…
This sounds like a good use case for short brief documentation.
Earlier quoted context omitted.
Telegram had this issue too and they made a setting "who can find me by my number" you set it to "my contacts" so only mutual contacts can find each other.
This is a genius fix because in order to enforce your own privacy you must betray the privacy of n+ friends. Awesome.
There is absolutely no need to upload your address book to make you number unsearchable.
Obviously it is bad if your personal data is compromised after you (or some else) upload it to an online service like Facebook. But in this case, it’s important to remember that phone companies used to regularly leak most of their customer’s phone numbers (and names) in the form of a telephone directory. So a question to consider is: suppose that the white pages were still commonly produced and contained most people’…
The "new" risk with phone numbers is the overreliance on them for login and 2fa and the relative easy of taking one over. I use security keys but still have accounts I can't remove the phone 2fa from despite having two keys tied in.
I mean, at this point I think everyone should just accept that at the very least their name, age, address(es), email(s), phone number(s) and screen name(s) have been fully leaked if you have ever had any kind of online presence. Not saying that's right or good, but at this point it's just a fact. So if that's the case, I think we should move beyond really even trying to think of this info as private or a marker of id…
The problem is completely the opposite. The flaw is the existence of social security numbers. Prohibit them from being used for anything but social security. Then there is no "your social security number" or "your identity" for someone to open a bank account against. You open a bank account and they give you a bank card and you set an address and phone number. The day you open it, they shouldn't need to know who you…
Now, there is absolutely no reason it could not be OTP'd (or uniquely derived for each account).
I mean, at this point I think everyone should just accept that at the very least their name, age, address(es), email(s), phone number(s) and screen name(s) have been fully leaked if you have ever had any kind of online presence. Not saying that's right or good, but at this point it's just a fact. So if that's the case, I think we should move beyond really even trying to think of this info as private or a marker of id…
The problem is completely the opposite. The flaw is the existence of social security numbers. Prohibit them from being used for anything but social security. Then there is no "your social security number" or "your identity" for someone to open a bank account against. You open a bank account and they give you a bank card and you set an address and phone number. The day you open it, they shouldn't need to know who you…
Any time someone attempts to use your SSN to identify themselves as you, you should be notified and your authorization should be required for that use to be allowed.
And the higher the value of the authorization, the more care should be required.
Companies are able to do this already with 2 factor authentication. And I think we SORT of have that for change of address, as the Post Office both requires ID and notifies you by mail. Maybe that's really just one factor.
Allow people to require as many additional factors as they want. Confirming my identity in 6 ways when I decide to sell my house sounds good. 4 ways when I buy a car. One or none is fine when I make a $10 purchase. Let me decide.
And let them CHOOSE what organization manages authentication. A private company might do the job a lot more effectively than the Post Office.
Add human methods too. A call from a sibling or child might be one people could set up. Require validation by a notary public.
Earlier quoted context omitted.
you're confusing security, privacy, and personal details
Please elaborate. If security is not a measurement to uphold and defend the right to privacy, then what is it?
Information security can be about trust, i.e. I trust that person A sent this message because of X, y, z. I also trust that the message hasn't been tampered with because of X, y, z.
Privacy is a sub/side topic of information security. E.g. keeping all network connection data about an individual obfuscated at all times i.e. All data is kept hidden in a way that cannot be made unhidden.
Privacy is part of information security, and serves to ensure certain systems could be considered secure in certain cases (depends on the threat model/requirements of the system).
Basically, you've got it the wrong way around. Privacy (as a purely technical idea) exists to keep some information secure in certain cases.
Recent Fawkes paper is a good example of privacy as a security consideration.
Now for a case where it doesn't matter...
Whenever you're asked to run an MD5 hash check of a file you've just downloaded, that's an example of authentication/verification.
Doesn't matter if someone has seen that you've downloaded the file, just that the downloaded file is correct (for you).
Good example is Linux OS distribution ISOs.
Privacy doesn't really matter in that case (depending on your threat model), what matters is that the file you've downloaded matches what you wanted to downloaded. No-one intercepted and tampered with the data in transit.
You can trust the data that you've downloaded.
It doesn't matter if Mr FBI saw that I downloaded it, because it's not illegal. So why waste energy and resources on solving a problem that's not a problem?!
Now on to protection of confidential data...
Facebook is actually a good example of this. Most people are not anonymous on there. You can search and find people (depending on settings). Privacy, in that sense, is not provided.
However, they do (or are supposed to) keep our data protected from external malicious adversaries, whilst not making it completely private to everyone.
I can see my friends information, it is not private. It is, however, supposed to be protected and kept safe e.g. a credit card number.
A credit card number can't be completely obfuscated because then it can't be used. Instead, that personal information should be protected.
https://en.m.wikipedia.org/wiki/Information_security
Now, in relation to the parent of the parent of the.....
The point of the comment, and I agreed with it, is that if personal information is leaked to the public -- that's not privacy, it is improper confidential data access -- really bad things can happen.
I can call that number every 2 minutes to perform a denial of service attack (eventually they'll turn their phone off, no more phone service!).
I could send horrific child porn to that number.
I could do X, y, z with a phone number.
I don't need passwords and encryption keys or zero day access to your hardened Linux box to fuck up your life.
I can do it with a phone number.
And here's the real kicker --- I don't even know who this person is! They're anonymous to me. Their privacy is mostly intact, but I've got access to confidential information which means I can fuck up their life regardless.
So your point of "well, why don't they just give out access to ALL the confidential information" was, actually, kind of on point!
That's exactly the kind of data we definitely do not want out in the wild. That's extremely sensitive data with which I could cause absolute havoc!
Where you fell down was the "leak all of it cos why not". One tiny piece of leaked confidential data can be massively dangerous. That was the point of the comment.
One tiny piece of data and I can ruin your life. I don't need everything, just one thing. One phone number.
Hopefully that was helpful. It's all a shade of grey depending on your threat model tbh.
Earlier quoted context omitted.
the telegram has a text file with links to links by country, I've just stuck that at https://pastebin.com/3SvG1FJ0
could you post it again? the pastebin page got deleted
The root of the problem is not the privacy policy or the system security. The root of the problem is the collection itself. All large businesses, health care providers, and governments maintain databases. Every one of them will eventually be leaked. All it takes is a corruptible trusted insider.
This. I don't trust in the government, but I think digital "personal data" should be only available for "confirmation" to companies that need it. Say, a government entity could have an API that allow you to send hashed personal data that they can verify is right. This way companies will ask the user for their data and hash it client-side. Then they can send the hashes (hashed with a custom provided salt to the entity…
For example Estonia has had famously and online identity stuff linked via a federal ID (in europe there are more republics then federations so it's easier to manage country-wise) [0] [1]
Or more familiar to me with a bigger sample is a movement in Poland which is gaining popularity - mojeID (myID) which is a Single Sign On system with major banks as providers (they really regligiously check the identities when you open a bank account) or the statebacked login.gov. The mojeID system allows other entities to use your actual identity as an authentication factor without having to keep that much data and pose risks - for example an online alcohol shop can verify the age. [2] [3]
[0]: https://en.wikipedia.org/wiki/Estonian_identity_card
[1]: https://e-estonia.com/solutions/e-identity/id-card/
I mean, at this point I think everyone should just accept that at the very least their name, age, address(es), email(s), phone number(s) and screen name(s) have been fully leaked if you have ever had any kind of online presence. Not saying that's right or good, but at this point it's just a fact. So if that's the case, I think we should move beyond really even trying to think of this info as private or a marker of id…
I am not from the US, but is this really all you need to "proof" your identity?
The most common thing I have seen in the EU when companies have a KYC requirement is that during the sign up process you will have a quick video call where you have show your ID card while they verify that your ID is legit.