Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Internet Archive: Security breach alert

theverge.com

Post reply on HN
Print view View original

531–540 of 648 posts

Re: Internet Archive: Security breach alert

#531

Post by DoctorDabadedoo »

jmb99 wrote: post #417
to-too-two wrote: post #334

Earlier quoted context omitted.

I'm also on HIBP over 10x. What are we supposed to do? Create a new email address for every service we sign up for? I don't know what the best practice is for keeping our personal data safe anymore.

Truly unique email addresses and passwords per service is the strongest approach, but there may be alternatives. For instance, Gmail allows address+tag@gmail.com, which will save you from the lowest hanging fruit (block the +tag when it’s compromised to prevent the laziest spam from reaching you). iCloud also allows automatically generating a new email address that forwards to your inbox for a new account when using…

Gmail's +tag (and the .) is nice in theory, but terrible in practice. It's super easy for malicious actors to just drop them and there are a few services out there that simply are not able to work with the +tag, potentially getting you locked you out of your own account. Not gmail's fault, but I would recommend against using it.

Re: Internet Archive: Security breach alert

#532

Post by indigo945 »

swarnie wrote: post #450
phplovesong wrote: post #446

Earlier quoted context omitted.

[flagged]

Alarm didn't go off - Russia. Missed the bus - Russia. Stubbed my toe - FFS why is it always Russia? Not excusing it, Russia, China and Iran do make my honeypot's top ten list every month. But then again so do the US, UK and France....

How do you know what countries' actors are attacking your honeypot in face of IP address obfuscation (VPNs, jumpservers rented in a different country, etc.)?

Re: Internet Archive: Security breach alert

#534

Post by figassis »

hunter2_ wrote: post #358
Springtime wrote: post #355

Just in terms of privacy, it's worth noting that anyone who has uploaded something on IA already has their email address publicly viewable. This isn't something that commonly known (even judging by comments here) but in the publicly viewable metadata of every upload it contains the uploader's IA account email address. So from a security perspective it's bad but from a privacy perspective a lot of users probably weren…

This raises an interesting question: should email addresses be private? Addresses of buildings aren't private, and they're somewhat analogous as with many computing concepts. (Aside: Before spam filters were quite good, it was typical to avoid scraping of addresses by mild obfuscation, but I think those days are gone, and this is distinct from privacy anyway.) If someone wants to upload and never be found out, then t…

It should, mainly because an email is not just an email, it's a channel to reach otu to you, your internet address. And we know how that is going in your inbox.

Re: Internet Archive: Security breach alert

#535

Post by exodust »

mdp2021 wrote: post #416
GeoAtreides wrote: post #415

Earlier quoted context omitted.

Phonebooks were a thing not so long ago...

And they contained data of which people allowed disclosure. When you did not want your information to be published, you informed the telephony provider and the phonebooks would not include it.

For a fee. In Australia at least it cost money not to be listed in the phone book.

Numbers were however tied to a property rather than individual personal phones in our pockets. When you think about it, mobile phone technology arrived quickly and caught everyone by surprise. Back in the 80s very few people thought we'd be carrying around "pocket TV phones" in such a short time.

Re: Internet Archive: Security breach alert

#536

Post by keybpo »

Springtime wrote: post #355

Just in terms of privacy, it's worth noting that anyone who has uploaded something on IA already has their email address publicly viewable. This isn't something that commonly known (even judging by comments here) but in the publicly viewable metadata of every upload it contains the uploader's IA account email address. So from a security perspective it's bad but from a privacy perspective a lot of users probably weren…

It's not just uploads but any item that uses the email address as a unique user identifier (I'm not technical enough to explain this clearer but [1]).

An email address will be part of the xml in his uploads but also in his profile, which anyone can access by simply changing the url from https://archive.org/details/@foobar to https://archive.org/download/foobar. So, in essence, one just needs to have a registered account, independeltly any uploads made.

[1] https://help.archive.org/help/accounts-a-basic-guide-2/

Re: Internet Archive: Security breach alert

#537

Post by sgc »

tourmalinetaco wrote: post #388
sgc wrote: post #380

Earlier quoted context omitted.

I never thought about UBI and copyright - but as soon as you say that, it is immediately obvious to me that when we have some kind of UBI, copyright should be dramatically reduced.

Copyright should be reduced in general. 20 years was already excessive for exclusive control over culture, 200 is just absurd.

I 100% agree. Just pointing out that UBI changes the discourse on this subject.

Re: Internet Archive: Security breach alert

#538

Post by gdevenyi »

exe34 wrote: post #504
gdevenyi wrote: post #488

Earlier quoted context omitted.

Aurora store gets around that

the search doesn't really work does it? you have to search on Google and then click on it to open with aurora. but you're right, it does help!

The search worked for me to find a single app I needed when I was setting up a single-use tablet recently, but I haven't used it hugely beyond that. YMMV

Re: Internet Archive: Security breach alert

#539

Post by mdaniel »

acaiblue44 wrote: post #307
codemac wrote: post #170

Earlier quoted context omitted.

> How long does an average hard drive last? This is a great question, and a state of the art kind of thing. HDDs are sold with a lifetime drive read/write amount and power cycle warranty, along with usually some environmental operating envelope. read/write relates to the quality/space of the platter, power cycle is usually the actuator & read/write head being reseated/wearing out. Environment is the same as all other…

I'm a new user, is this a good time to plug my project that hopes to put 200 GB on a piece of paper? https://sourceforge.net/u/acaiblue44/blog/2024/09/gigapaper0...

> I learned that I can't use file i/o in a function outside the main, which is an unspoken rule that no tutorial elucidated.

is for sure not true, that would be crazypants

Re: Internet Archive: Security breach alert

#540

Post by pixl97 »

benterix wrote: post #486
emidoots wrote: post #367

Earlier quoted context omitted.

There is software which is intended to e.g. locate the GitHub profiles of people working at companies, then scrape all public repositories they've contributed to for their email address and the emails of their coworkers - to enable targeted advertising to those individuals. Very common in enterprise sales. With ChatGPT, this can be extended to create emails that look very personal - as if someone has followed all of…

This was a problem already before the generative AI era, it just got less expensive. The only way to reduce it is to have two work addresses: one that you rarely check and is exposed to the public, listed on your profile etc., and the real internal one just to get the work done.

>it just got less expensive

Quantity is a quality. Add that the AI can profile you and do a decent job spear phishing and you're talking about a sea change.

>and the real internal one

“Three can keep a secret, if two of them are dead.”

There is no such thing as an 'internal' email you communicate to other people outside your company with. It's just an email address. Someone at some point will leak it by accident or malice.

Post reply on HN