“The database DOES NOT contain information from individuals who use data opt-out services. Every person who used some sort of data opt-out service was not present.”
Like what?
Inside the "3 billion people" national public data breach
131–140 of 472 posts
Re: Inside the "3 billion people" national public data breach
#132Earlier quoted context omitted.
The SSA specifically told people not to misuse SSNs this way and it seems like a poor use of taxpayer funding to spend billions bailing out businesses’ bad decisions, even if that was legal (Congress would have to specifically authorize it), since we’d be back to the same problem with five years. If we were going to do something, we’d make government ID include an NFC token for PKI purposes since public keys can’t be…
Painting those of us concerned with privacy as "people prone to wild conspiracy theories" is a very bad faith take. Please do not give the government any more power over me than they already have, thanks.
> Painting those of us concerned with privacy as "people prone to wild conspiracy theories" is a very bad faith take.
Fortunately that’s not what I’m doing. I suggest reading more carefully and trying to come up with a scenario where the government having standard identifiers meaningfully harms your privacy but a mess of identifiers and a huge private industry linking them does not.
Re: Inside the "3 billion people" national public data breach
#133Earlier quoted context omitted.
See how credit cards work (at least where I have lived). Someone fraudulently cloned my card after a petrol station visit and I got it fixed as soon as I noticed the weird transactions. The bank or VISA footed that cost. UK has statutory law on this. Probably because of how CCs used to work with that carbon copy crap.
In the US merchants are the ones footing that cost, either in merchant fees (which they then pass on to the Customer in the form of higher prices) or directly (by the credit card company refusing to pay the merchant). It might be different now, but in the late 90s I sold some laptops to a buyer using a stolen credit card. The cardholders had no fraud liability but my company ended-up having to eat the cost of the sto…
[deleted]
Re: Inside the "3 billion people" national public data breach
#134Earlier quoted context omitted.
The video doesn't quite get into the problem of identity theft, which is when someone uses your stolen creds to claim they are you, and then go on a shopping spree which may include buying a car under your name. You shouldn't be liable for debts incurred after having your identity stolen but proving that is a lot of work.
"Identity theft" is just fraud, rephrased to make us the victims instead of the defrauded companies. That's why SSNs are still such a big deal. Why fix the problem when you can just make it someone else's problem?
As brilliantly satirized by the mitchell & web sketch https://www.youtube.com/watch?v=CS9ptA3Ya9E
Re: Inside the "3 billion people" national public data breach
#135From the NPD website:
> Please be advised that we will not collect, use, disclose, sell, or share the sensitive personal information or sensitive data of California, Virginia, Colorado, or Connecticut residents as those terms are defined by the CCPA/CPRA, VCDPA, CPA, or CTDPA, respectively.
Re: Inside the "3 billion people" national public data breach
#136For non-Americans (and Americans) that don't quite understand what SSN is and why it's a problem, CGP Grey [1] has a great (and short) video about the history and why it's not technically an identifier, but has become one. [1] https://www.youtube.com/watch?v=Erp8IAUouus
Not only an identifier, many places use it as a secret.
Which is dumb.
Re: Inside the "3 billion people" national public data breach
#137Ahh, cool, pour the corpus through GPTs and start tweeting Congressional rep personal info at them until they pass a law to outlaw data brokers (in keeping with historical precedent [1] [2]). [1] https://en.wikipedia.org/wiki/Video_Privacy_Protection_Act [2] https://jolt.law.harvard.edu/digest/dodging-the-thought-poli...
For argument sake, instead of outlawing data brokers wouldn’t it be better to design a better ID system that renders one’s name, dob, and SSN as harmless information? I don’t know what that would look like but if I had congresses attention I’d like them to fix the problem rather than playing whack-a-mole with banning data sources. I don’t think any actual solutions come from that.
It's politically a non-starter in the US. US states have a lot of power that is derived from their ability to maintain their own ID systems. The states have fought for almost 20 years on requirements as simple as REAL ID.
Re: Inside the "3 billion people" national public data breach
#138Earlier quoted context omitted.
In many countries in Europe, your ID card contains a chip with a cryptographic key, much like chip&pin on a debit or credit card. Those bits of information are worthless when you need to create a cryptographic signature with your ID card to do almost anything important. If the card is lost or stolen they can just remove your old one from the keyserver. It's literally just public key crypto. Identity theft is rampant…
The US has three dumb points pushing back on this. The first is religious nuts who think it would be a "mark of the beast" The second is anti-government types who are, well, anti-government anything. The third is many business owners, because it would become much harder/risky to hire illegal immigrants to work.
The "mark of the beast" types are pretty much fine with cards that have chips in them, but they really hate it when you threaten to implant those chips into people and they want cash to remain an option - same as the anti-government types. I don't share their apocalyptic or anti-government concerns, but I'm actually kind of grateful for their passionate opposition to both of those things anyway. I don't really want an implant and the option of using cash is a very good thing.
The anti-government types do hate the idea of a national ID, but they're already forced to carry a drivers license/state ID, and SS card so they've pretty much lost the battle already.
I'm afraid that it's the business owners who are our biggest hurdle.
Re: Inside the "3 billion people" national public data breach
#139> While the specifics of the data breach remain unclear, the trove of data was put up for sale on the dark web for $3.5 million in April, the complaint reads. I guess they failed to sell it because links to the leaked data on usdod.io have been available on Breachforum/Leakbase for over a week now. Someone created a magnet link yesterday and it's fully seeded so speeds are fast. The data in the breach is irreversibly…
> Someone created a magnet link yesterday Are you against simply sharing the infohash here? I'd like to download the leak to see what information it has on myself and my family, but I don't really relish the idea of signing up for a breachforums account and sifting though its posts if I can avoid it.
Here is a strongly encrypted base64 version to keep hackers out:
bWFnbmV0Oj94dD11cm46YnRpaDozY2FhNzFmM2VjOGNiY2NjNmZjYTRmZWI3MTg1ZGEyYmFiMTQ5YmE3JmRuPU5QRCZ0cj11ZHA6Ly90cmFja2VyLm9wZW5iaXR0b3JyZW50LmNvbTo4MCZ0cj11ZHA6Ly90cmFja2VyLm9wZW50cmFja3Iub3JnOjEzMzcvYW5ub3VuY2U=
Allegedly, the password (also base64 encrypted) is:
aHR0cHM6Ly91c2RvZC5pby8=
Re: Inside the "3 billion people" national public data breach
#140Earlier quoted context omitted.
In many countries in Europe, your ID card contains a chip with a cryptographic key, much like chip&pin on a debit or credit card. Those bits of information are worthless when you need to create a cryptographic signature with your ID card to do almost anything important. If the card is lost or stolen they can just remove your old one from the keyserver. It's literally just public key crypto. Identity theft is rampant…
> Those bits of information are worthless when you need to create a cryptographic signature with your ID card to do almost anything important. That depends on the type of attack you're protecting against. It might prevent an attacker from filing your taxes for you, but many companies are still going to use this kind of information as primary key. But it's not going to stop an attacker from pretending to be a bank emp…
That seems entirely like an implementation detail that doesn't have anything to do with the smart card interface itself.
It's not like it's rocket science to have the reader application detail what the request is used for, and encoding it in the request/response, verified when used, so that it can't be used for anything but the approved purpose.