Data leak contains 26B records from numerous previous breaches

Post by __MatrixMan__ » Wed, Jan 24, 2024, 5:03 AM UTC

ars wrote: post #83

oconnore wrote: post #29

Earlier quoted context omitted.

I think you misunderstand their suggestion. If you only gave service providers access to encrypted data (i.e. End-to-end encryption), then neither the service provider nor the leaker would be able to decrypt. Whether or not that is a generally viable or desirable suggestion is a different question, but it is possible as demonstrated by Signal, Apple, etc.

There's only a limited number of things that can be done that way. Basically point-to-point messaging. Most things aren't going to work with that model. Can Amazon ship you products without knowing what you ordered? Can you send and receive email on multiple devices without the provider having your email? Can you join public chat groups? Can you view your lab results without the lab having them? And don't say "the la…

Post by SlightlyLeftPad » Wed, Jan 24, 2024, 5:16 AM UTC

hdlothia wrote: post #4

I feel like the people who calculate that it's more cost effective to deal with the hit from a security breach vs spending money on good security have won. I have gone from feeling outraged to completely numb to these kind of disclosures and have pretty much just assumed that my information will inevitably be leaked somewhere by someone. Does anyone else feel this way? I just keep a close eye on my financial statemen…

Post by cryptoegorophy » Wed, Jan 24, 2024, 5:29 AM UTC

SlightlyLeftPad wrote: post #114

hdlothia wrote: post #4

I feel like the people who calculate that it's more cost effective to deal with the hit from a security breach vs spending money on good security have won. I have gone from feeling outraged to completely numb to these kind of disclosures and have pretty much just assumed that my information will inevitably be leaked somewhere by someone. Does anyone else feel this way? I just keep a close eye on my financial statemen…

Probably about 10-12 years ago I almost exclusively used +emails so I could determine with pretty high confidence who had breaches and failed to disclose OR identify companies that had sold my data without disclosure. One of the most recent examples was Robinhood Holdings. +emails only got me so far as 50% of sites don’t properly support the RFC5233 subaddressing standard and it ended up being a massive pain when a s…

Post by crotchfire » Wed, Jan 24, 2024, 6:17 AM UTC

kelseyfrog wrote: post #34

basch wrote: post #12

Earlier quoted context omitted.

It’s time for attorney generals to hold permanent identity monitoring pots and funds. The idea that someone can lose all your data and then pay for two years of identity monitoring is absurd. The people with the data can see that and can just wait two years to sell it. Social security numbers don’t reset after two years. If you lose data, you pay a data breach tax forever. Over time, your competitors will be able to…

It also incentivizes holding as little personal data as possible and increases the probability of coordinated adoption of systems[1][2][3][4][5] of identification/verification that minimize collateral damage. 1. https://sovrin.org/ 2. https://github.com/sertoID/ 3. https://www.hyperledger.org/projects/hyperledger-indy 4. https://identity.foundation/ion/ 5. https://www.civic.com/

Post by rz2k » Wed, Jan 24, 2024, 7:04 AM UTC

quesera wrote: post #110

ineptech wrote: post #50

Question that sounds idiotic but is quite serious: how do I make it illegal to lend money to me without confirmation via Keybase? (edit: or some similar cryptographic identity proof) The only reason to keep my name/address/SSN secret is that companies will lend money to a person who has that info, and then try to make me liable for it regardless of whether that person was me. That's a problem, but the solution isn't…

Minus all the complicated implementation details, this is possible. It's called a credit freeze: https://www.usa.gov/credit-freeze