Quora User Data Compromised • Hacker News Board

Re: Quora User Data Compromised

#11

Post by stickfigure » Tue, Dec 04, 2018, 1:16 AM UTC

Wow. If this had happened a couple years ago, before they made all the anonymous entries truly anonymous, this would have been really ugly.

It's a valuable lesson in "don't keep data you don't need".

EDIT: A little backstory for non-Quorans. Until early 2017, anonymous Quora answers and comments were anonymous to the public but not actually anonymous in the database (they were still "your" entries). In early 2017 they (presciently) made all this content fully anonymous, even in the database.

Re: Quora User Data Compromised

#12

Post by Puer » Tue, Dec 04, 2018, 1:17 AM UTC

johnmc408 wrote: post #4

johnmc408 wrote: post #3

Who is getting fired? Oh that's right, no one...

Just got my email from Quroa...Who writes this drivel: Conclusion It is our responsibility to make sure things like this don’t happen, and we failed to meet that responsibility. We recognize that in order to maintain user trust, we need to work very hard to make sure this does not happen again. There’s little hope of sharing and growing the world’s knowledge if those doing so cannot feel safe and secure, and cannot t…

Some poor peon at the bottom of the ladder instead of the engineers/managers actually responsible for the mistake. The great thing about being at the top is being able to delegate away blame. After all, it's your job.

Re: Quora User Data Compromised

#13

Post by aviv » Tue, Dec 04, 2018, 1:18 AM UTC

stickfigure wrote: post #11

Wow. If this had happened a couple years ago, before they made all the anonymous entries truly anonymous, this would have been really ugly. It's a valuable lesson in "don't keep data you don't need". EDIT: A little backstory for non-Quorans. Until early 2017, anonymous Quora answers and comments were anonymous to the public but not actually anonymous in the database (they were still "your" entries). In early 2017 the…

No, the lesson is: "don't give companies data they don't need".

Re: Quora User Data Compromised

#14

Post by beefsack » Tue, Dec 04, 2018, 1:20 AM UTC

sharkweek wrote: post #6

At this point I am operating on the assumption that ALL businesses that have my data are going to inadvertently leak it at some point, and thus I am attemtping to provide individual companies with as little information about me as possible. The toughest ones here are my online banking and my online health portal, but other than that, I have gotten pretty picky about what information I give any company.

This is a healthy mindset to have.

I feel that for every company that self-reports a leak, there are multiple other companies that have leaked your data and either haven't discovered the breach, refuse to disclose it, or flat out sold your data to the highest bidder.

Re: Quora User Data Compromised

#15

Post by npunt » Tue, Dec 04, 2018, 1:20 AM UTC

stickfigure wrote: post #11

Wow. If this had happened a couple years ago, before they made all the anonymous entries truly anonymous, this would have been really ugly. It's a valuable lesson in "don't keep data you don't need". EDIT: A little backstory for non-Quorans. Until early 2017, anonymous Quora answers and comments were anonymous to the public but not actually anonymous in the database (they were still "your" entries). In early 2017 the…

Their doc says:

> Is content posted anonymously still secure?

> Yes. Anonymous content cannot be connected to user accounts, so content posted anonymously is still secure.

https://help.quora.com/hc/en-us/articles/360020212652

Re: Quora User Data Compromised

#16

Post by abbot2 » Tue, Dec 04, 2018, 1:22 AM UTC

1. Force everyone to register to get access to content. 2. Leak that data. 3. ... 4. Profit. Not sure how this part works though.

I hope lesson should be learned: don't force users to register just because you can

Re: Quora User Data Compromised

#17

Post by ramenmeal » Tue, Dec 04, 2018, 1:22 AM UTC

johnmc408 wrote: post #3

Who is getting fired? Oh that's right, no one...

Doesn't seem like every breach warrants someone to get fired. The Equifax breach makes sense, there was an obvious lack of due diligence to protect user's data. But we should wait to see the reason for the breach. Mistakes can happen even if the company was trying to protect user's data.

Re: Quora User Data Compromised

#18

Post by shawn » Tue, Dec 04, 2018, 1:22 AM UTC

johnmc408 wrote: post #3

Who is getting fired? Oh that's right, no one...

Hopefully no one, yes. You have likely written a security vuln. The smugness just doesn't go away till you realize it.

Re: Quora User Data Compromised

#19

Post by s3r3nity » Tue, Dec 04, 2018, 1:22 AM UTC

So I'm not a security expert, so I ask this in real earnest to learn: what is it that these companies keep doing wrong, and/or why aren't they adjusting to the climate that these types of attacks are increasing over time?

Or are they trying to adjust, and the attacks are getting so sophisticated that the pace of investment in counter-measures is below that of the pace of advancement in the complexity of attacks?

Or something in the middle?

Re: Quora User Data Compromised

#20

Post by aviv » Tue, Dec 04, 2018, 1:23 AM UTC

sharkweek wrote: post #6

At this point I am operating on the assumption that ALL businesses that have my data are going to inadvertently leak it at some point, and thus I am attemtping to provide individual companies with as little information about me as possible. The toughest ones here are my online banking and my online health portal, but other than that, I have gotten pretty picky about what information I give any company.

I have an email address that I've only ever used as my AWS account email since many years ago. Somehow I started getting spam on it last year. It is not an address anyone could guess or somehow generate based on other data points such as name or otherwise.