Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Data leak contains 26B records from numerous previous breaches

cybernews.com

Post reply on HN
Print view View original

91–100 of 150 posts

Re: Data leak contains 26B records from numerous previous breaches

#91

Post by fsflover »

ineptech wrote: post #58
bagels wrote: post #55

Earlier quoted context omitted.

You contribute to campaigns of politicians (aka bribe) and write legislation for them to pass.

I don't have enough time left on this Earth to explain the concept in a way that politicians could implement, I'm in my 40s. In my preferred alternate universe, Keybase was sold to a benevolent billionaire. Or more realistically, a normal billionaire who intended to run it at a loss until he could leverage it to effect world domination, but managed to mess it up somehow and get it nationalized. Or something. I can dr…

Support https://eff.org and similar organizations.

Re: Data leak contains 26B records from numerous previous breaches

#92

Post by akira2501 »

godelski wrote: post #48
basch wrote: post #12

Earlier quoted context omitted.

It’s time for attorney generals to hold permanent identity monitoring pots and funds. The idea that someone can lose all your data and then pay for two years of identity monitoring is absurd. The people with the data can see that and can just wait two years to sell it. Social security numbers don’t reset after two years. If you lose data, you pay a data breach tax forever. Over time, your competitors will be able to…

I'm very open to government solutions, but at the same time I'm not sure they have a good track record. Despite that, this service should come from the government because anyone else has misaligned incentives. I specifically would want a privacy and security maximalist approach. What we have right now is completely unacceptable, especially given our current technology level. Though of course, the downside is also tha…

The government is the problem.

They issue me a single identification number that can be used anywhere at anytime without any verification or notification that it has been used, and it's next to impossible to get a new one issued.

This is madness. A state funded "insurance" system to backstop this mistake is an unworkable hack that seeks to ignore the fundamental problem.

Re: Data leak contains 26B records from numerous previous breaches

#93

Post by harry8 »

hdlothia wrote: post #4

I feel like the people who calculate that it's more cost effective to deal with the hit from a security breach vs spending money on good security have won. I have gone from feeling outraged to completely numb to these kind of disclosures and have pretty much just assumed that my information will inevitably be leaked somewhere by someone. Does anyone else feel this way? I just keep a close eye on my financial statemen…

They win as long as deliberately making this decision, probably so, at a level way beyond what the reasonably competent person the field could do by accident never results in a conviction recorded and jail term against the ceo and board. The individuals need to be charged and have there day in court with consequences that go beyond “business expense” Conviction recorded is just that.

Who will lobby for it because /you/ don’t count? Too poor to matter to law makers.

Re: Data leak contains 26B records from numerous previous breaches

#94

Post by jjav »

hdlothia wrote: post #4

I feel like the people who calculate that it's more cost effective to deal with the hit from a security breach vs spending money on good security have won. I have gone from feeling outraged to completely numb to these kind of disclosures and have pretty much just assumed that my information will inevitably be leaked somewhere by someone. Does anyone else feel this way? I just keep a close eye on my financial statemen…

> I feel like the people who calculate that it's more cost effective to deal with the hit from a security breach vs spending money on good security have won.

They do win, unfortunately because they're right. Why spend much on designing security when the inevitable breach costs nothing other than bad press for a few days and then all is forgotten.

The only possible solution is to have significant fines for every data item breached.

Ideally I'd ratchet up the fines for each occurrence. First breach should hurt the company financially a bit but not be too disruptive, offering a learning opportunity.

Subsequent breaches the fines go up, by the fifth breach or so the fines would wipe away the company entirely, since they clearly didn't learn.

Anything short of something like this, companies will never care and leak all your data to the wind every year.

Re: Data leak contains 26B records from numerous previous breaches

#95

Post by queuebert »

jjav wrote: post #94
hdlothia wrote: post #4

I feel like the people who calculate that it's more cost effective to deal with the hit from a security breach vs spending money on good security have won. I have gone from feeling outraged to completely numb to these kind of disclosures and have pretty much just assumed that my information will inevitably be leaked somewhere by someone. Does anyone else feel this way? I just keep a close eye on my financial statemen…

> I feel like the people who calculate that it's more cost effective to deal with the hit from a security breach vs spending money on good security have won. They do win, unfortunately because they're right. Why spend much on designing security when the inevitable breach costs nothing other than bad press for a few days and then all is forgotten. The only possible solution is to have significant fines for every data…

This would be create an incentive to attack a competing company until you breach it 5x, causing its destruction. Competitors would be attacking each other nonstop.

Like 3 check chess, but in Delaware.

Re: Data leak contains 26B records from numerous previous breaches

#96

Post by droopyEyelids »

jjav wrote: post #94
hdlothia wrote: post #4

I feel like the people who calculate that it's more cost effective to deal with the hit from a security breach vs spending money on good security have won. I have gone from feeling outraged to completely numb to these kind of disclosures and have pretty much just assumed that my information will inevitably be leaked somewhere by someone. Does anyone else feel this way? I just keep a close eye on my financial statemen…

> I feel like the people who calculate that it's more cost effective to deal with the hit from a security breach vs spending money on good security have won. They do win, unfortunately because they're right. Why spend much on designing security when the inevitable breach costs nothing other than bad press for a few days and then all is forgotten. The only possible solution is to have significant fines for every data…

In my fantasy world a company gets nationalized after the nth breach and we have a well-run federal department of IT with competent and engaged staff

Re: Data leak contains 26B records from numerous previous breaches

#98

Post by queuebert »

dotancohen wrote: post #62
basch wrote: post #12

Earlier quoted context omitted.

It’s time for attorney generals to hold permanent identity monitoring pots and funds. The idea that someone can lose all your data and then pay for two years of identity monitoring is absurd. The people with the data can see that and can just wait two years to sell it. Social security numbers don’t reset after two years. If you lose data, you pay a data breach tax forever. Over time, your competitors will be able to…

> It’s time for attorney generals Attorneys general They are attorneys, so that is the word to pluralize. What type of attorney are they? General

I think its monomorphization: Attorneys::().

Re: Data leak contains 26B records from numerous previous breaches

#99

Post by jjav »

queuebert wrote: post #95
jjav wrote: post #94

Earlier quoted context omitted.

> I feel like the people who calculate that it's more cost effective to deal with the hit from a security breach vs spending money on good security have won. They do win, unfortunately because they're right. Why spend much on designing security when the inevitable breach costs nothing other than bad press for a few days and then all is forgotten. The only possible solution is to have significant fines for every data…

This would be create an incentive to attack a competing company until you breach it 5x, causing its destruction. Competitors would be attacking each other nonstop. Like 3 check chess, but in Delaware.

I don't have a huge problem with that to be honest. Maybe not fifth breach, but something along those lines.

Well-funded attackers and competing nations are already attacking these companies, so adding their competitors to the mix doesn't change a lot.

Re: Data leak contains 26B records from numerous previous breaches

#100

Post by mistrial9 »

throwway120385 wrote: post #86
godelski wrote: post #47

Earlier quoted context omitted.

I just went through a call with my credit card company. 4 transfers later the only verification I've been asked is the last 4 of my social, my name, and when I was at the "highest level" of security they took the amazing step to... call me back. All because my credit card, which is travel focused, got flagged because I bought a You are not alone. It is an __absolute joke__ that my github account is more secure than a…

USAA actually does push passcodes using their app. The banks' understanding of security is so poor that they push people to use voice or fingerprint authentication. My wife constantly fights Wells Fargo about it every time she calls them because they want to helpfully sign her up for their voiceprint service so she doesn't have to use her PIN anymore. She used to work in a retail cellphone store so has heard tons of…

they understand the security very well - what they ask you or your wife to do, is another matter
Post reply on HN