Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Inside the "3 billion people" national public data breach

troyhunt.com

Post reply on HN
Print view View original

161–170 of 472 posts

Re: Inside the "3 billion people" national public data breach

#161

Post by autoexec »

kbenson wrote: post #73
jandrese wrote: post #58

Earlier quoted context omitted.

The reason the Shaggy defense doesn't work is the default assumption of the courts is that you're a deadbeat trying to game the system. This assumption comes about because in the majority of cases it is the truth. The system would be a lot nicer if there weren't people trying to scam it every hour of every day of the week.

> a deadbeat trying to game the system. The problem with putting a value judgement on this is that it will precondition people to assume good faith or bad faith on the validity of the assessment based on how they interpret the fairness of the court system. Instead, we could just say that the majority of the cases are people trying to get out of legitimate debts. If we wanted to go farther, we could say that's because…

Instead, we could just say that the majority of the cases are people trying to get out of legitimate debts.

There's another discussion which could be had about just how legitimate even "legitimate debts" actually are in some cases but that's even more in the woods.

Re: Inside the "3 billion people" national public data breach

#162

Post by Mtinie »

lifeisstillgood wrote: post #152
ghm2180 wrote: post #120

I am just dreading the day when a near simultaneous cyberattack on a high number of(more vulnerable like middle-lower income individuals) start in a DDoS fashion: 1. Credit histories will be(unlocked) used to file multiple credit applications and tax credits will be applied for. 2. Multiple Cell phones will be hijacked through Sim Hijacking or other zeroday attacks to make it very difficult to get back in. 3. A perso…

I am wondering what the numbers are like for this to be realistic. I am not too sure of the end goal other than general chaos. Let’s say it’s 2 days of an attack, (that’s about how long any co-ordinated response would need at minimum). So attackers need to sow chaos across the USA. They apply for a million unsecured loans of say 20k each. That’s 20 billion. I honestly don’t know what the daily personal loan applicati…

You’d need to pick a day of importance to launch the chaos-sowing attack against information and social services. I’m sure there’s a useful one in early November.

Re: Inside the "3 billion people" national public data breach

#163

Post by BlueTemplar »

ygjb wrote: post #82
ljm wrote: post #78

Earlier quoted context omitted.

In many countries in Europe, your ID card contains a chip with a cryptographic key, much like chip&pin on a debit or credit card. Those bits of information are worthless when you need to create a cryptographic signature with your ID card to do almost anything important. If the card is lost or stolen they can just remove your old one from the keyserver. It's literally just public key crypto. Identity theft is rampant…

> all because British people think an ID card means you'll get stopped on the street to show your papers. That's probably because all of the anti-immigration and anti-foreigner people who are asking the government to stop people and ask them for their papers... this is not unique the the UK, Canada, or the United States either, and some of the countries plan to do more than just deport people. Strong identity is incr…

Yeah, id cards aren't mandatory in France either because the precedent when they were comes from literal Nazis. (At least theoretically, in practice you will face a lot of pressure...)

Re: Inside the "3 billion people" national public data breach

#164

Post by left-struck »

> The problem with verifying breaches sourced from data aggregators is that nobody willingly - knowingly - provides their data to them

This is a bit of a tangent but I feel like if we can prove this statement then these data aggregators should be made illegal. How can you consent to something that you don’t know you’re consenting to? Likewise why do these entities have the right to collect detailed personal information like SSN without your explicit, beyond reasonable doubt, consent? To me this is the most obvious failure of the legal system, it clearly goes against well established legal principles that a basic requirement of an agreement is that all parties know what they are agreeing to.

Obviously there is some leeway with agreements where it’s not possible to clarify every eventuality but lets say if you’re applying to rent a place through an online form and that form shares your SSN to a data aggregator, it should be extremely clear about that, and possible to out out while still allowing you to complete the rental application without discrimination.

It’s like, it should be possible to show that no one, with in reason, consented to sharing their data with this aggregator because no one is able to confirm that they did. Sure one person could forget, or lie, but 100s of millions of people? No. Clearly almost zero people knowingly consents.

Re: Inside the "3 billion people" national public data breach

#165

Post by bmelton »

bobthepanda wrote: post #148
autoexec wrote: post #138

Earlier quoted context omitted.

The "mark of the beast" types are pretty much fine with cards that have chips in them, but they really hate it when you threaten to implant those chips into people and they want cash to remain an option - same as the anti-government types. I don't share their apocalyptic or anti-government concerns, but I'm actually kind of grateful for their passionate opposition to both of those things anyway. I don't really want a…

Eh, depending on the flavor, the mark of the beast types don’t even really like barcodes. Allegedly Hobby Lobby does not use a barcode inventory system for this reason.

Hobby Lobby's CEO provided a handy list of reasons why they do not use bar codes, none of which have anything to do with them being marks of beasts

https://www.snopes.com/fact-check/hobby-lobby-mark-of-the-be...

Re: Inside the "3 billion people" national public data breach

#166

Post by lesuorac »

jandrese wrote: post #58
adamomada wrote: post #56

Earlier quoted context omitted.

I never really understood why the onus is on any person to prove they didn’t do something. Shouldn’t the shaggy defence be sufficient? e.g. You get hauled into court for a lawsuit demanding the loan repayment, for a loan someone else used your name to get? - It wasn’t me. https://en.wikipedia.org/wiki/Shaggy_defense

The reason the Shaggy defense doesn't work is the default assumption of the courts is that you're a deadbeat trying to game the system. This assumption comes about because in the majority of cases it is the truth. The system would be a lot nicer if there weren't people trying to scam it every hour of every day of the week.

> The reason the Shaggy defense doesn't work is the default assumption of the courts is that you're a deadbeat trying to game the system

Isn't that the opposite of innocent until proven guilty?

Re: Inside the "3 billion people" national public data breach

#167

Post by silisili »

CrispyKerosene wrote: post #3

Troy mentions "data opt-out services. Every person who used some sort of data opt-out service was not present." Anyone have experience with these sort of services? A search brings up a lot of scammy looking results. But if services exist to reduce my profile id be interested.

Many seem scammy, and I went through the search before and gave up.

Then, as fate would have it, a HNer(tjames7000) mentioned he made EasyOptOuts for this reason, so I signed up. Cheap, seems effective, absolutely no complaints.

Re: Inside the "3 billion people" national public data breach

#168

Post by 1_1xdev1 »

BadHumans wrote: post #160
no_wizard wrote: post #156

Earlier quoted context omitted.

In the US, the government could help alot if they simply moved to a national ID system and dismantled social security numbers. The national ID systems I've seen proposed have alot more security from the ground up, and could replace the passport system.

The US has done itself a disservice with their actions because few people trust the government. A national ID system means a database of all Americans that would very likely be used for surveillance and monitoring. I'm saying this as someone who has Global Entry so it's not like I'm afraid of being in a US database but I see the concerns.

Pretty sure the FBI and equivalent agencies already have access to every state’s DMV records so it’s sort of a distinction without a difference.

Re: Inside the "3 billion people" national public data breach

#169

Post by ericjmorey »

BadHumans wrote: post #160
no_wizard wrote: post #156

Earlier quoted context omitted.

In the US, the government could help alot if they simply moved to a national ID system and dismantled social security numbers. The national ID systems I've seen proposed have alot more security from the ground up, and could replace the passport system.

The US has done itself a disservice with their actions because few people trust the government. A national ID system means a database of all Americans that would very likely be used for surveillance and monitoring. I'm saying this as someone who has Global Entry so it's not like I'm afraid of being in a US database but I see the concerns.

That survail

Re: Inside the "3 billion people" national public data breach

#170

Post by troad »

fnord77 wrote: post #135

From the NPD website: > Please be advised that we will not collect, use, disclose, sell, or share the sensitive personal information or sensitive data of California, Virginia, Colorado, or Connecticut residents as those terms are defined by the CCPA/CPRA, VCDPA, CPA, or CTDPA, respectively.

We need more laws like this, then. Federal ones.
Post reply on HN