Data leak contains 26B records from numerous previous breaches • Hacker News Board

Re: Data leak contains 26B records from numerous previous breaches

#31

Post by stvltvs » Tue, Jan 23, 2024, 6:55 PM UTC

basch wrote: post #12

hdlothia wrote: post #4

I feel like the people who calculate that it's more cost effective to deal with the hit from a security breach vs spending money on good security have won. I have gone from feeling outraged to completely numb to these kind of disclosures and have pretty much just assumed that my information will inevitably be leaked somewhere by someone. Does anyone else feel this way? I just keep a close eye on my financial statemen…

It’s time for attorney generals to hold permanent identity monitoring pots and funds. The idea that someone can lose all your data and then pay for two years of identity monitoring is absurd. The people with the data can see that and can just wait two years to sell it. Social security numbers don’t reset after two years. If you lose data, you pay a data breach tax forever. Over time, your competitors will be able to…

It should all be free, like getting credit reports is now. We need a robust and accessible way to manage our data personas, assuming that all of the supposed secrets are in fact public data.

Re: Data leak contains 26B records from numerous previous breaches

#32

Post by stvltvs » Tue, Jan 23, 2024, 6:57 PM UTC

autoexec wrote: post #9

hdlothia wrote: post #4

I feel like the people who calculate that it's more cost effective to deal with the hit from a security breach vs spending money on good security have won. I have gone from feeling outraged to completely numb to these kind of disclosures and have pretty much just assumed that my information will inevitably be leaked somewhere by someone. Does anyone else feel this way? I just keep a close eye on my financial statemen…

I still feel like this is why the penalties for allowing user's data to be leaked should be harsh enough to make it worthwhile for companies take even basic steps to protect other people's data, or even better, to avoid collecting it or keeping it in the first place. Since that hasn't happened yet, I try to avoid handing my data over when I can.

Agreed, perhaps requiring companies who handle sensitive data to carry insurance and licensing engineers who build those systems, something like the PE.

Re: Data leak contains 26B records from numerous previous breaches

#33

Post by chankstein38 » Tue, Jan 23, 2024, 7:01 PM UTC

hdlothia wrote: post #4

I feel like the people who calculate that it's more cost effective to deal with the hit from a security breach vs spending money on good security have won. I have gone from feeling outraged to completely numb to these kind of disclosures and have pretty much just assumed that my information will inevitably be leaked somewhere by someone. Does anyone else feel this way? I just keep a close eye on my financial statemen…

100% with you. At this point my data has been breached so many times I don't even know what the point of caring is. I don't have privacy anymore. Like you I just have credit monitoring and watch my financial statements and hope for the best. This world sucks.

Re: Data leak contains 26B records from numerous previous breaches

#34

Post by kelseyfrog » Tue, Jan 23, 2024, 7:01 PM UTC

basch wrote: post #12

hdlothia wrote: post #4

I feel like the people who calculate that it's more cost effective to deal with the hit from a security breach vs spending money on good security have won. I have gone from feeling outraged to completely numb to these kind of disclosures and have pretty much just assumed that my information will inevitably be leaked somewhere by someone. Does anyone else feel this way? I just keep a close eye on my financial statemen…

It’s time for attorney generals to hold permanent identity monitoring pots and funds. The idea that someone can lose all your data and then pay for two years of identity monitoring is absurd. The people with the data can see that and can just wait two years to sell it. Social security numbers don’t reset after two years. If you lose data, you pay a data breach tax forever. Over time, your competitors will be able to…

It also incentivizes holding as little personal data as possible and increases the probability of coordinated adoption of systems[1][2][3][4][5] of identification/verification that minimize collateral damage.

1. https://sovrin.org/

2. https://github.com/sertoID/

3. https://www.hyperledger.org/projects/hyperledger-indy

4. https://identity.foundation/ion/

5. https://www.civic.com/

Re: Data leak contains 26B records from numerous previous breaches

#35

Post by doubled112 » Tue, Jan 23, 2024, 7:02 PM UTC

stvltvs wrote: post #32

autoexec wrote: post #9

Earlier quoted context omitted.

I still feel like this is why the penalties for allowing user's data to be leaked should be harsh enough to make it worthwhile for companies take even basic steps to protect other people's data, or even better, to avoid collecting it or keeping it in the first place. Since that hasn't happened yet, I try to avoid handing my data over when I can.

Agreed, perhaps requiring companies who handle sensitive data to carry insurance and licensing engineers who build those systems, something like the PE.

> licensing engineers who build those systems

The IT and software industries would really change. Perhaps for the better, but perhaps not.

Re: Data leak contains 26B records from numerous previous breaches

#36

Post by mindslight » Tue, Jan 23, 2024, 7:05 PM UTC

basch wrote: post #12

hdlothia wrote: post #4

I feel like the people who calculate that it's more cost effective to deal with the hit from a security breach vs spending money on good security have won. I have gone from feeling outraged to completely numb to these kind of disclosures and have pretty much just assumed that my information will inevitably be leaked somewhere by someone. Does anyone else feel this way? I just keep a close eye on my financial statemen…

It’s time for attorney generals to hold permanent identity monitoring pots and funds. The idea that someone can lose all your data and then pay for two years of identity monitoring is absurd. The people with the data can see that and can just wait two years to sell it. Social security numbers don’t reset after two years. If you lose data, you pay a data breach tax forever. Over time, your competitors will be able to…

Further cementing this broken idea of "identity" as something that can be stolen is most certainly not what we need! Rather we need AG's to start going after companies that attempt to collect negligently verified and other fake debts for the outright brazen fraud that it is, and a law that allow victims to procedurally recover triple damages for time/money spent defending against these companies and helping the companies clean up their own messes. Separately, we need a law like the GDPR that lets individuals audit, control, and opt out of the surveillance records being kept on us.

Re: Data leak contains 26B records from numerous previous breaches

#37

Post by lencastre » Tue, Jan 23, 2024, 7:09 PM UTC

Aardwolf wrote: post #6

hdlothia wrote: post #4

I feel like the people who calculate that it's more cost effective to deal with the hit from a security breach vs spending money on good security have won. I have gone from feeling outraged to completely numb to these kind of disclosures and have pretty much just assumed that my information will inevitably be leaked somewhere by someone. Does anyone else feel this way? I just keep a close eye on my financial statemen…

With email addresses you can use multiple to not be too affected. But phone numbers are less replaceable than email addresses... And what's annoying is that more and more things now also require phone numbers (like, seriously, in the past an email address was enough but today the simplest thing you want to signup for uses some third party booking platform (which means yet one more party that gets to leak your data) t…

The simplest thing require full name, address, birthdate, age, yes age, mobile phone, fiscal number, last four digits of the credit card, expiration date of credit card, yomama’s maiden name, the middle 8 digits of your credit, your last used password, your pet’s name, the name of the high school you attended, favorite football team, a front and side pictures no smile no hats no glasses, hi resolution scan of government issued ID, and lastly the first four digits.

That’s about it.

Re: Data leak contains 26B records from numerous previous breaches

#38

Post by Aeolun » Tue, Jan 23, 2024, 7:09 PM UTC

hdlothia wrote: post #4

I feel like the people who calculate that it's more cost effective to deal with the hit from a security breach vs spending money on good security have won. I have gone from feeling outraged to completely numb to these kind of disclosures and have pretty much just assumed that my information will inevitably be leaked somewhere by someone. Does anyone else feel this way? I just keep a close eye on my financial statemen…

That’s honestly not very surprising when any company that does this has to suffer the consequences of… crickets?

No consequences at all. It’s no surprise that patching the holes costs them more.

It’s also that all these massive companies are absolutely allergic to any change. Unless legal gets wind of it everything can stay exposed if it means the status quo is maintained.

Re: Data leak contains 26B records from numerous previous breaches

#39

Post by SoftTalker » Tue, Jan 23, 2024, 7:10 PM UTC

stuff4ben wrote: post #27

Meh... keep your passwords in an offline password manager and generated for each site. Don't store payment info anywhere, but if you do, make sure it's a generated CC number. Never link your checking or savings account to anything. Sure you'll miss out on some convenience, but you'll have your money and sanity.

Until your bank itself leaks the data....

Re: Data leak contains 26B records from numerous previous breaches

#40

Post by derbOac » Tue, Jan 23, 2024, 7:11 PM UTC

Clearly better security is always better but sometimes I think there needs to be a different way of approaching identity validation etc.

Like, maybe we need to assume everyone's records are leaked somewhere all the time?

I'm not sure what that means in practice but I e.g., am not sure that "identity theft" should be a scary thing if the other side of the system is working optimally.