Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Claimed AT&T hack of 70M customer records including SSN, name, address

9to5mac.com

Post reply on HN
Print view View original

141–150 of 167 posts

Re: Claimed AT&T hack of 70M customer records including SSN, name, address

#141

Post by vlovich123 »

I’ve been wanting the government to roll out a zero proof ID mechanism so that businesses don’t need any info. Just have a unique ID that’s a representation of that one unique representation. Visit a new Dr’s office? Instead of an SSN generate a new ID they can use to contact you with the government as the intermediary. The business never gets your PII and the government already has your PII and needs to keep it secure (and is politically culpable to breaches). Some care needs to be taken to ensure that the government is actually blinded to the identity of the entity you connect with so that they can’t connect the dots about activity, but I think this is tractable.

Same thing with medical records. The current design is abhorrent. Every medical provider has an independent copy of your records. You should be the only one with a copy (or with a storage provider you designate) with strict timely access controls (eg doctor gets the records for 30 days for review or something). That I have to fill out a form to get my own medical records is retarded.

This stuff isn’t hard, but it’s hard to make money on so there’s perverse incentives to keep the status quo.

Re: Claimed AT&T hack of 70M customer records including SSN, name, address

#142

Post by vlovich123 »

ikiris wrote: post #105
codegeek wrote: post #76

Earlier quoted context omitted.

SMS as 2FA is so stupid. So many banks and financial institutions are doing it in America and it amazes me. I mean what are they spending million of dollars in compliance/security/SOC etc on if they can't get a basic 2FA done correctly ? And don't get me started on stupid password requirements where a more secure password generated in keypass etc won't be valid. Who builds this stuff today ?

sms as 2fa raises the bar signifigantly for non organized attackers. You'd be amazed how much of the meth crowd that encompases.

The challenge I’ve found is that I end up with a lot of different MFA options which makes it hard to track where my exposure is. In some places I have two methods because I set up SMS when it was available and switched to an authenticator app and forgot to turn down SMS. It’s a shame there’s no SSO for personal accounts that established dominance so that I could just have 1 account I need to secure (although SSO solutions never put you in control of being able to minimize data leakage and let providers force you to disclose certain information for using their service).

Re: Claimed AT&T hack of 70M customer records including SSN, name, address

#143

Post by mulmen »

codegeek wrote: post #76
ve55 wrote: post #8

It would certainly be a nice time to stop using SSNs as keys, SMS as 2FA, and more importantly having next to zero consequences for this kind of stuff. At this point we just expect this to keep happening over and over again with nothing changing, it's a very strange thing to observe...

SMS as 2FA is so stupid. So many banks and financial institutions are doing it in America and it amazes me. I mean what are they spending million of dollars in compliance/security/SOC etc on if they can't get a basic 2FA done correctly ? And don't get me started on stupid password requirements where a more secure password generated in keypass etc won't be valid. Who builds this stuff today ?

Compliance is about liability, not security.

Re: Claimed AT&T hack of 70M customer records including SSN, name, address

#144

Post by PoignardAzur »

r-w wrote: post #132
PoignardAzur wrote: post #115

Earlier quoted context omitted.

There's still some identity theft issues, because "everyone asks your SSN for no reason" becomes "everyone asks for a scan of your id for no reason". For instance, when I was looking for an appartment, the State had a service to both authenticate and watermark some documents (id and proof of income, among others). The watermark was a bunch of big bars with "this is intended for rental search" written on them. Kinda l…

This is the problem with having the public and private key be the same. Anyone should be able to access your public key, and anyone you deal with should be able to ask you to use your private key to verify your identity. The problem is when that entire process is reduced to "give us the number the government uses to ensure you're you. Don't worry, we won't use it to convince anyone else we're you ;) Or leak it so any…

On the long run, they'll hopefully solve these problems with SSO.

Re: Claimed AT&T hack of 70M customer records including SSN, name, address

#146

Post by quesera »

rsync wrote: post #111
brewdad wrote: post #106

Earlier quoted context omitted.

I think OP is saying that they give a fake name to the vendor, not the CC card company. Walmart (maybe?) isn't checking that the billing name you give them matches the name on the card. I don't know how true this is across all vendors.

This is correct. I have the same, real-name relationship with my bank and card issuers that you or anyone else has. Rando-web-merchant, on the other hand, never gets my real name. "I don't know how true this is across all vendors." Almost 100%. There is a rarely used program called "verified by visa" that takes you through an additional verification step and encourages you to create some sort of account linked to you…

Slightly mitigating:

Merchants can request Address Verification (AVS) from the network, but the result is purely advisory: the merchant can ignore a mismatch if they choose. In my experience, most do ignore it.

This is also true of the CVV/CVV2/CSC/etc. Most web vendors require it, but it is not required to complete a transaction. Theoretically the provision of a correct CVV indicates that the consumer has the card in-hand. Chargeback appeals are somewhat more likely to succeed if the transaction included the CVV.

Re: Claimed AT&T hack of 70M customer records including SSN, name, address

#147

Post by EvanAnderson »

rsync wrote: post #86
EvanAnderson wrote: post #67

Earlier quoted context omitted.

Can you elaborate on "The enabling factor is that Visa/MC do not actually verify cardholder name"? Are you saying that you've got a credit card under an assumed name?

No, of course not. I am saying that merchants do not have the ability to verify card holder name. Your transaction will process properly with Mickey mouse as first last. Only amex verifies cardholder name. EDIT: relevant stackexchange is here: https://security.stackexchange.com/questions/220724/i-can-pa...

I appreciate the response and the link to the Stack Exchange question. I wasn't "getting" what you were saying, but now it makes sense. That's probably something I'll start doing too. Thanks for the idea.

Re: Claimed AT&T hack of 70M customer records including SSN, name, address

#148

Post by unanswered »

r-w wrote: post #132
PoignardAzur wrote: post #115

Earlier quoted context omitted.

There's still some identity theft issues, because "everyone asks your SSN for no reason" becomes "everyone asks for a scan of your id for no reason". For instance, when I was looking for an appartment, the State had a service to both authenticate and watermark some documents (id and proof of income, among others). The watermark was a bunch of big bars with "this is intended for rental search" written on them. Kinda l…

This is the problem with having the public and private key be the same. Anyone should be able to access your public key, and anyone you deal with should be able to ask you to use your private key to verify your identity. The problem is when that entire process is reduced to "give us the number the government uses to ensure you're you. Don't worry, we won't use it to convince anyone else we're you ;) Or leak it so any…

> Anyone should be able to access your public key, and anyone you deal with should be able to ask you to use your private key to verify your identity.

First, let's assume the identity would be backed by a somewhat decentralized system; e.g. the identity could be backed by any state/territory's existing ID cards.

The problem is making the request signing step secure and accessible to... well, anyone, tech-savvy folks included. Software for installation to a computer is an obvious no-go. A mobile app is probably a good idea but in any case I think we can assume a website will be a necessity. You've got to be able to give that website your private key. Guess what, you've already lost - as soon you tell people to type their key into this website, people will type their private key into any old website now. (I remember when my mom, with the best of intentions but without my prior knowledge, filled out my FAFSA info, SSN and all, on a scam .com site despite how many times we were told "fafsa.gov" or whatever.)

But let's pretend that's a solvable problem, just for the same of argument. Let's assume it's a federal government provided site which you can provide with your private key on demand to do signing on your behalf and it's relatively secure actually keeping the key in your browser. And there's a mobile app option which can store the key locally with better security and do signing in memory which can actually be wiped after. Fine. Now convince the public that this site/app do not constitute a Federal database of identities. You and I know it wouldn't, as described, but I would not blame anyone who objected on those grounds one bit, because without the necessary knowledge it absolutely would seem like a Federal ID, and folks are right to be wary of a single source of identity information. After all, all that does is take the SSN problem and add to it civil liberties problems. The distinction between SSNs and a [somewhat] decentralized PKI scheme with a centralized signing app for security/anti-phishing reasons is a distinction essentially impossible to convey to any but the most tech-savvy.

Re: Claimed AT&T hack of 70M customer records including SSN, name, address

#149

Post by ourmandave »

I wonder what the settlement for my data be stolen will be?

1. $10 off a new AT&T phone. When you sign a 5 year contract. Excludes all other offers.

2. A free month of AT&T limited service. When you sign a 5 year contract. Excludes all other offers.

3. Or absolutely nothing, like the last bazillion times.

The suspense is killing me. I hope it lasts.

Re: Claimed AT&T hack of 70M customer records including SSN, name, address

#150

Post by 55873445216111 »

Forbo wrote: post #63
55873445216111 wrote: post #35

Earlier quoted context omitted.

"How come no tattoo?!"

For those wondering, this is a reference to Idiocracy: https://www.youtube.com/watch?v=BdPmNM0IF7Y I believe the direct quote is "Why come you got no tattoo?"

I am Not Sure.
Post reply on HN