Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Inside the "3 billion people" national public data breach

troyhunt.com

Post reply on HN
Print view View original

111–120 of 472 posts

Re: Inside the "3 billion people" national public data breach

#111

Post by EvanAnderson »

kube-system wrote: post #102
EvanAnderson wrote: post #83

For years I've said the entire SSN database just needs to be published alongside legislation strictly assigning liability to any company who defrauded as a result of using the SSN as a "secret". That would fix the problem with SSN's and "identity theft" quickly. Part 1 has been accomplished. Let's get part 2 going! Aside: It amazes me how the American public has allowed defrauded companies to assign the company's los…

US law does generally make fraud the bank's problem. Identity theft isn't loophole in this, it is a situation in which there is a logical ambiguity in differentiating one fraud from another. If they just believed everyone who said "it wasn't me that spent that money!" that would just be opening another vulnerability.

I think we've got liability pretty well buttoned-up in the banking industry. I'm more concerned about the non-bank businesses. (I recently obtained utilities at a new house. All three utilities-- electrical, gas, and water/sewer-- use my SSN as an authenticator for my account. In 2024.)

Re: Inside the "3 billion people" national public data breach

#112

Post by lupire »

j-bos wrote: post #17
jmkni wrote: post #8

Earlier quoted context omitted.

If you're willing to tempt fait, the best way to 'opt-out' is to tell people, when they call asking to speak to 'your name', that 'your name' sadly passed away recently.

Could cause you to be listed as deceased in some database sending your life into a Kafka story.

"How do you know he's dead?"

"I called him on the phone and he told me!"

Re: Inside the "3 billion people" national public data breach

#113

Post by lupire »

shadowgovt wrote: post #25
JohnMakin wrote: post #7

Earlier quoted context omitted.

> Anyone have experience with these sort of services? Quite a bit. Often if you request removal or opt-out, you'll reappear in a matter of a few months in their system, regardless of whether you use a professional service as a proxy or do it yourself. The data brokers usually go out of their way to be annoying about it and will claim they can't do anything about you showing up in their aggregated sources later on. Th…

It's hard to make collection, aggregation, and sharing of facts illegal. Not to minimize the harm that can be done by such collections, but the law is justifiably looking for a scalpel treatment here to address the specific problem without putting the quest to understand reality on the wrong side of the line.

Europe figured it out.

Re: Inside the "3 billion people" national public data breach

#114

Post by haswell »

conductr wrote: post #71
toomuchtodo wrote: post #51

Ahh, cool, pour the corpus through GPTs and start tweeting Congressional rep personal info at them until they pass a law to outlaw data brokers (in keeping with historical precedent [1] [2]). [1] https://en.wikipedia.org/wiki/Video_Privacy_Protection_Act [2] https://jolt.law.harvard.edu/digest/dodging-the-thought-poli...

For argument sake, instead of outlawing data brokers wouldn’t it be better to design a better ID system that renders one’s name, dob, and SSN as harmless information? I don’t know what that would look like but if I had congresses attention I’d like them to fix the problem rather than playing whack-a-mole with banning data sources. I don’t think any actual solutions come from that.

I’d replace “instead of” with “in addition to”.

Going after data brokers seems like low hanging fruit, and necessary even if the ID system needs to be replaced. This is a top level issue that need to be addressed regardless.

While I think it’d be great to design a system where the information you mention is harmless (I’m curious how this would work without just shifting the problem to whatever new identifier is established), the reality is that this information is not harmless, and will continue to be dangerous to leak for the foreseeable future due to the myriad of systems that use this data in its current form. Any theoretical project to replace this would likely be a long and drawn out undertaking. Addressing the information environment in the meantime seems like a good idea.

Re: Inside the "3 billion people" national public data breach

#115

Post by coder543 »

Eji1700 wrote: post #96
janalsncm wrote: post #90

Earlier quoted context omitted.

Identity theft is a very clever term to shift blame from the company to the consumer. https://youtu.be/CS9ptA3Ya9E It’s a comedy bit but I take its point seriously: if the bank gives away money, it’s the bank’s job to make sure it is repaid. Not mine, unless I was actually a party to the agreement.

Well then you're up against the wall of digital verification. I know there's a fuck load of situations where the banks are 100% screwing the customer to their benefit, but there's a legit conversation about people who give out their passwords, or claim they did, when money gets wiped out. If you meet all the requirements to identify yourself to the bank, at what point does the bank have to say "this is that person, a…

The Google Authenticator app (just as a mainstream example) was released 14 years ago. When we're still waiting for a lot of banks to even support TOTP, consider me unimpressed with the level of effort banks are putting into securing my accounts.

Re: Inside the "3 billion people" national public data breach

#117

Post by autoexec »

Eji1700 wrote: post #96
janalsncm wrote: post #90

Earlier quoted context omitted.

Identity theft is a very clever term to shift blame from the company to the consumer. https://youtu.be/CS9ptA3Ya9E It’s a comedy bit but I take its point seriously: if the bank gives away money, it’s the bank’s job to make sure it is repaid. Not mine, unless I was actually a party to the agreement.

Well then you're up against the wall of digital verification. I know there's a fuck load of situations where the banks are 100% screwing the customer to their benefit, but there's a legit conversation about people who give out their passwords, or claim they did, when money gets wiped out. If you meet all the requirements to identify yourself to the bank, at what point does the bank have to say "this is that person, a…

> If you meet all the requirements to identify yourself to the bank, at what point does the bank have to say "this is that person, and that transaction is legal".

Our current system is entirely built on ridiculous levels of trust, mostly for convenience / cost saving reasons. I've made payments over the phone with nothing more than the information found on the bottom of every check I've ever sent. I routinely hand my credit card to waitstaff making 7.25 an hour and in that moment I'm handing every last one of them the ability to snap a photo of my card on their phones and go on a shopping spree at my expense.

As insane as our system is, it's mostly worked. Even though I've been made to pass around my account info countless times, I've never once had my accounts cleaned out. If a single mother with less than 1k in her account gets robbed, I have a hard time blaming her. She had zero say in the design of this system, and she's the person least able to deal with the cost of the consequences of it.

On the other hand, I have very little problem putting the blame on the banks which do control much of the system and who can more than afford to cover the costs of such incidents. This puts a small amount of financial pressure on them to improve the systems they've created and forced the rest of us to use in order to participate in society.

There are all kinds of things they could be doing to reduce fraud, but they don't. Mostly for convenience / cost saving reasons. I consider their refusal to take even simple steps to improve the security of their systems as their implied consent to continue accepting the responsibility for the still rare instances where criminals take advantage of their inaction.

Re: Inside the "3 billion people" national public data breach

#118

Post by CivBase »

fragmede wrote: post #50
quantumfissure wrote: post #39

For non-Americans (and Americans) that don't quite understand what SSN is and why it's a problem, CGP Grey [1] has a great (and short) video about the history and why it's not technically an identifier, but has become one. [1] https://www.youtube.com/watch?v=Erp8IAUouus

The video doesn't quite get into the problem of identity theft, which is when someone uses your stolen creds to claim they are you, and then go on a shopping spree which may include buying a car under your name. You shouldn't be liable for debts incurred after having your identity stolen but proving that is a lot of work.

"Identity theft" is just fraud, rephrased to make us the victims instead of the defrauded companies.

That's why SSNs are still such a big deal. Why fix the problem when you can just make it someone else's problem?

Re: Inside the "3 billion people" national public data breach

#119

Post by kube-system »

EvanAnderson wrote: post #111
kube-system wrote: post #102

Earlier quoted context omitted.

US law does generally make fraud the bank's problem. Identity theft isn't loophole in this, it is a situation in which there is a logical ambiguity in differentiating one fraud from another. If they just believed everyone who said "it wasn't me that spent that money!" that would just be opening another vulnerability.

I think we've got liability pretty well buttoned-up in the banking industry. I'm more concerned about the non-bank businesses. (I recently obtained utilities at a new house. All three utilities-- electrical, gas, and water/sewer-- use my SSN as an authenticator for my account. In 2024.)

It isn't great, but I don't think there's much risk there. There's not really much of a motivation for some random person to get into my utility account. The balance is never positive. Utilities are physically bolted to my house. They're pretty heavily regulated too. If someone wanted to steal electricity from my house, they can use the outlet on my patio that has zero authentication whatsoever.

Re: Inside the "3 billion people" national public data breach

#120

Post by ghm2180 »

I am just dreading the day when a near simultaneous cyberattack on a high number of(more vulnerable like middle-lower income individuals) start in a DDoS fashion:

1. Credit histories will be(unlocked) used to file multiple credit applications and tax credits will be applied for.

2. Multiple Cell phones will be hijacked through Sim Hijacking or other zeroday attacks to make it very difficult to get back in.

3. A person's profile will be used to attack the most vulnerable things: - Their families will get fake calls to create confusion. - Their financial services will be frozen or worst weak 2fac auth ones will be compromised.

4. Deep fake image and videos will be created from compromised accounts to sow further mayhem.

This already happens in targeted and one startegy of teh other fashion. Imagine what one could do with a bit more compute and completed profiles and orchestrate this kind of terrible vengeance.

Post reply on HN