Inside the "3 billion people" national public data breach • Hacker News Board

Re: Inside the "3 billion people" national public data breach

#41

Post by digging » Wed, Aug 14, 2024, 7:05 PM UTC

shadowgovt wrote: post #25

JohnMakin wrote: post #7

Earlier quoted context omitted.

> Anyone have experience with these sort of services? Quite a bit. Often if you request removal or opt-out, you'll reappear in a matter of a few months in their system, regardless of whether you use a professional service as a proxy or do it yourself. The data brokers usually go out of their way to be annoying about it and will claim they can't do anything about you showing up in their aggregated sources later on. Th…

It's hard to make collection, aggregation, and sharing of facts illegal. Not to minimize the harm that can be done by such collections, but the law is justifiably looking for a scalpel treatment here to address the specific problem without putting the quest to understand reality on the wrong side of the line.

> It's hard to make collection, aggregation, and sharing of facts illegal.

Sure, but the US has a precedent in HIPAA. Not saying it's copy-paste, but... maybe it should be.

I would prefer the law be more restrictive than less, because I don't believe this is true:

> law is justifiably looking for a scalpel treatment here to address the specific problem without putting the quest to understand reality on the wrong side of the line.

I believe the law may use that noble goal as cover for the actual goal: restrict the ability of capital holders to accumulate capital as little as possible. Data sharing isn't a public good in any way. It's mostly not even useful for the targeting purposes it claims. It's extremely reckless rent-seeking that knowingly allows innocent people to have their lives wrecked by identity theft.

Re: Inside the "3 billion people" national public data breach

#42

Post by bragr » Wed, Aug 14, 2024, 7:08 PM UTC

jmkni wrote: post #8

CrispyKerosene wrote: post #3

Troy mentions "data opt-out services. Every person who used some sort of data opt-out service was not present." Anyone have experience with these sort of services? A search brings up a lot of scammy looking results. But if services exist to reduce my profile id be interested.

If you're willing to tempt fait, the best way to 'opt-out' is to tell people, when they call asking to speak to 'your name', that 'your name' sadly passed away recently.

I knew someone falsely declared dead (probably a paperwork mixed up around pensions when his ex-spouse died). Without warning, he lost all of his pensions, social security, medicare, etc, along with most financial institutions freezing accounts and canceling credit cards. Many long phone calls, letters, and lawyers eventually resolve most, but that never fully purged the public and private death records so there would be random issue for the rest of his life (failing fraud checks, brief interruptions to pensions, trouble with the cable company).

Re: Inside the "3 billion people" national public data breach

#43

Post by shadowgovt » Wed, Aug 14, 2024, 7:09 PM UTC

digging wrote: post #41

shadowgovt wrote: post #25

Earlier quoted context omitted.

It's hard to make collection, aggregation, and sharing of facts illegal. Not to minimize the harm that can be done by such collections, but the law is justifiably looking for a scalpel treatment here to address the specific problem without putting the quest to understand reality on the wrong side of the line.

> It's hard to make collection, aggregation, and sharing of facts illegal. Sure, but the US has a precedent in HIPAA. Not saying it's copy-paste, but... maybe it should be. I would prefer the law be more restrictive than less, because I don't believe this is true: > law is justifiably looking for a scalpel treatment here to address the specific problem without putting the quest to understand reality on the wrong side…

As someone who helps care for elderly relatives with widely-dispersed out-of-state families, I can point to HIPAA as an excellent example of why crafting this kind of law is difficult.

I think we are going to discover, once people do the research, that HIPAA has done net harm by delaying flow of information for critical-care patients resulting in lack of patient compliance, confusion, and treatment error.

Yes, there is harm potential in insurance companies denying coverage or claims because they are privy to too much information about clients (a scenario that, I'd note, we could address directly by law via a national healthcare system or banning denial of coverage for various reasons) or by employers or hostile actors (including family) discovering medical facts about a patient. I have to weigh that harm potential against my day-to-day of having to fight uphill to get quality care because every specialist, every facility, and every department needs a properly-updated HIPAA directive for a patient (and the divisions between these categories aren't clear to the average non-medical observer).

Re: Inside the "3 billion people" national public data breach

#44

Post by cesarb » Wed, Aug 14, 2024, 7:09 PM UTC

quantumfissure wrote: post #31

wood_spirit wrote: post #19

Earlier quoted context omitted.

What can an attacker who knows your SSN still do with that information nowadays? Genuinely curious, as the SSN is just this strange in distinct password thingy the Europeans like me hear about on HN but have no actual parallels with.

If they have your address; birthday; and SSN a whole lot. Generally, they could apply for credit cards; loans; set something to bill to you; etc... Fortunately, it's getting harder without previous addresses or other verification methods. For non-Americans that don't know, our Social Security number is generally assigned at birth or when you become a citizen by the Social Security Administration. Social Security is a…

> It's the only number we all get, since not everyone gets a driver's license; ID; passport; or other identifier. Unfortunately, it's been used to identify us for everything, and until recently was typically in plaintext on most forms (medical; tax; student; etc...).

I fail to see the problem with that. As you said, it's an identifier, like an username or your full name. There should be no issue with everyone knowing your full name, or your username; why there should be an issue with everyone knowing your SSN, or it being in plaintext everywhere?

Re: Inside the "3 billion people" national public data breach

#45

Post by wodenokoto » Wed, Aug 14, 2024, 7:09 PM UTC

adelie wrote: post #35

JohnMakin wrote: post #7

Earlier quoted context omitted.

> Anyone have experience with these sort of services? Quite a bit. Often if you request removal or opt-out, you'll reappear in a matter of a few months in their system, regardless of whether you use a professional service as a proxy or do it yourself. The data brokers usually go out of their way to be annoying about it and will claim they can't do anything about you showing up in their aggregated sources later on. Th…

my understanding is that there's a bit of a catch-22 with data removal - if you request that a data broker remove ALL of your information, it's impossible for them to keep you from reappearing in their sources later on because that would require them to retain your information (so they can filter you out if you appear again).

They could store a hash.

Re: Inside the "3 billion people" national public data breach

#46

Post by acdha » Wed, Aug 14, 2024, 7:11 PM UTC

NoMoreNicksLeft wrote: post #23

Can't the SSA just issue 330 million new social security numbers, and tell people to be more careful with them from this point forward?

The SSA specifically told people not to misuse SSNs this way and it seems like a poor use of taxpayer funding to spend billions bailing out businesses’ bad decisions, even if that was legal (Congress would have to specifically authorize it), since we’d be back to the same problem with five years.

If we were going to do something, we’d make government ID include an NFC token for PKI purposes since public keys can’t be compromised in the same way, but nobody is jumping to pay for that, especially in a country where you have so many people prone to wild conspiracy theories (I am especially amazed by the guys who freak about a national ID as big brother but never say a word about the credit reporting industry) and the enduring “Mark of The Beast” religious fears.

Re: Inside the "3 billion people" national public data breach

#47

Post by jpcookie » Wed, Aug 14, 2024, 7:12 PM UTC

And where is this information that this random group supposedly has? I have yet to see proof of that being real

Re: Inside the "3 billion people" national public data breach

#48

Post by hedora » Wed, Aug 14, 2024, 7:13 PM UTC

adelie wrote: post #35

JohnMakin wrote: post #7

Earlier quoted context omitted.

> Anyone have experience with these sort of services? Quite a bit. Often if you request removal or opt-out, you'll reappear in a matter of a few months in their system, regardless of whether you use a professional service as a proxy or do it yourself. The data brokers usually go out of their way to be annoying about it and will claim they can't do anything about you showing up in their aggregated sources later on. Th…

my understanding is that there's a bit of a catch-22 with data removal - if you request that a data broker remove ALL of your information, it's impossible for them to keep you from reappearing in their sources later on because that would require them to retain your information (so they can filter you out if you appear again).

I’ve heard this claim, but they could use some sort of bloom filter pr cryptographic hashing to block profiles that contain previously-removed records.

There could also be a shared, trusted opt-out service that accepted information and returned a boolean saying “opt-out” or “opt-in”.

Ideally, it’d return “opt-out” in the no-information case.

Re: Inside the "3 billion people" national public data breach

#49

Post by rolph » Wed, Aug 14, 2024, 7:14 PM UTC

enlightens wrote: post #33

rolph wrote: post #24

Earlier quoted context omitted.

if you know place of birth, and place of ssn application, you can determine most of the ssn. the final 4 are supposed to be random, but are blurted out to rooms full of people and tech, during service. the integrity of SSN security, was lost a long time ago

as of 2011 they are fully random instead of being based on geographical region and groups https://www.ssa.gov/employer/randomization.html

yeah its too bad it took so long for that to happen.

Re: Inside the "3 billion people" national public data breach

#50

Post by fragmede » Wed, Aug 14, 2024, 7:15 PM UTC

quantumfissure wrote: post #39

For non-Americans (and Americans) that don't quite understand what SSN is and why it's a problem, CGP Grey [1] has a great (and short) video about the history and why it's not technically an identifier, but has become one. [1] https://www.youtube.com/watch?v=Erp8IAUouus

The video doesn't quite get into the problem of identity theft, which is when someone uses your stolen creds to claim they are you, and then go on a shopping spree which may include buying a car under your name. You shouldn't be liable for debts incurred after having your identity stolen but proving that is a lot of work.