Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

120M American Households Exposed In 'Massive' ConsumerView Database Leak

forbes.com

Post reply on HN
Print view View original

101–110 of 163 posts

Re: 120M American Households Exposed In 'Massive' ConsumerView Database Leak

#101

Post by JPKab »

stephengillie wrote: post #27
jordonwii wrote: post #8

The linked article is not very good imo. It goes into almost no detail, despite including two directly contradictory statements: "Yet another cloud storage misconfiguration has exposed personally identifiable information (PII)" and "the data in question contained no names of any individuals or any other personal identifying information" Can we change this to link to the Forbes article referenced in the linked one? It…

The Forbes article also points out that the DB is now secured. I have 2 take-aways: 1. This isn't an announcement that our details have been leaked, so much as a reminder that our details are now and will perpetually be leaked, in one form or another by an externalized party. 2. Databases mapping all American households exist.

Indeed, databases mapping all American households have existed, and been sold and re-sold, for decades.

Compared to Equifax, this is nothing. Why? Because this data can't be used for identity theft, and it's been widely available in downloadable, fully portable form for 2 decades.

Re: 120M American Households Exposed In 'Massive' ConsumerView Database Leak

#102

Post by wyldfire »

RevHaze wrote: post #54
JumpCrisscross wrote: post #40

Earlier quoted context omitted.

> I like the idea of mandatory data insurance Why not just liability for lost data? Companies could then choose to hold the risk themselves or field it out to insurers.

If it doesn't need to be insured, you could just spin off a smaller entity responsible for holding the data for you, and shut the company down if the data leaks. You can do the same if insurance is required of course, but any brand new 'personal data holding' company would likely have very high insurance premiums to offset the risk.

Isn't this where "piercing the corporate veil" comes into play?

Re: 120M American Households Exposed In 'Massive' ConsumerView Database Leak

#103

Post by Bluestrike2 »

RevHaze wrote: post #54
JumpCrisscross wrote: post #40

Earlier quoted context omitted.

> I like the idea of mandatory data insurance Why not just liability for lost data? Companies could then choose to hold the risk themselves or field it out to insurers.

If it doesn't need to be insured, you could just spin off a smaller entity responsible for holding the data for you, and shut the company down if the data leaks. You can do the same if insurance is required of course, but any brand new 'personal data holding' company would likely have very high insurance premiums to offset the risk.

That doesn't necessarily limit your risk exposure if litigation ensues. Anyone going after you (or the data holding company in particular) is going to attempt to pierce the corporate veil. And while that's not necessarily easy, it's still common enough. In that situation, it's almost inevitable that the separation won't be clear and strong enough to avoid being pierced.

Of course, that's all irrelevant unless there's a significant change in how the law treats data security.

Re: 120M American Households Exposed In 'Massive' ConsumerView Database Leak

#104

Post by jimmytucson »

modeless wrote: post #28

Apparently anyone who wants this data can simply purchase it from Experian. The leak doesn't change anything except the price.

Bingo. Ironically, the party that got screwed here is Experian since your PII is their saleable asset.

If you want to be mad, be mad about that, not the fact that somebody applied a publicly readable bucket policy to some data they paid tens of thousands of dollars for.

Re: 120M American Households Exposed In 'Massive' ConsumerView Database Leak

#105

Post by ateesdalejr »

rhizome wrote: post #98
drspacemonkey wrote: post #10

Earlier quoted context omitted.

Instead of a data tax, I like the idea of mandatory data insurance, with payouts to users whose data is leaked/stolen. If your company has shitty security, or a history of leaks, your data insurance provider will charge out the ass. The financial math has to clearly be on the side of it being more profitable to practice proactive security.

payouts to users whose data is leaked/stolen What would the actuarial standards be for something like that?

I'm assuming the strength of your password. The security practices of the company storing data. e.g. Company only uses SHA-1 for storing passwords premiums skyrocket.

Re: 120M American Households Exposed In 'Massive' ConsumerView Database Leak

#106

Post by njarboe »

tlynchpin wrote: post #95
joshuaheard wrote: post #23

Earlier quoted context omitted.

It's my data, why should they pay a tax to the government for it? How about a data royalty. You use my data, you must pay me a royalty.

"It's my data" - this is absurd. Observations I make are mine, if I observe you it's my observation. I can tell stories about my observations, but if I make public statements about you that are false, that's a tort.

This is what needs to happen. "identity theft" is what people fear. It would not happen if the banks got sued for big money and lost every time they lied to credit agencies about debts you did not default on. All this data breach stuff is mostly a bait and switch tactic from the real problem stemming from bank slander.

Your security clearance report stolen by the Chineese from the US government OPM database[1]. This could be a real problem for you. Information anyone can get by paying for it? This would not be a problem if credit fraud and credit reports were not such a big problem.

[1] https://www.nytimes.com/2015/06/05/us/breach-in-a-federal-co...

Re: 120M American Households Exposed In 'Massive' ConsumerView Database Leak

#108

Post by Spooky23 »

ateesdalejr wrote: post #105
rhizome wrote: post #98

Earlier quoted context omitted.

payouts to users whose data is leaked/stolen What would the actuarial standards be for something like that?

I'm assuming the strength of your password. The security practices of the company storing data. e.g. Company only uses SHA-1 for storing passwords premiums skyrocket.

Sounds like the offspring of FIPS 140-2 and PCI. Have fun with that.

Re: 120M American Households Exposed In 'Massive' ConsumerView Database Leak

#109

Post by ThrustVectoring »

yjftsjthsd-h wrote: post #87
CaptSpify wrote: post #46

Earlier quoted context omitted.

At the risk of speaking for OP: The point is that the data should be owned by me. Yeah, I get that it has value to other people, but I'm the one that has to deal with the fallout, not them. Just because something is useful to a business doesn't mean that they have the right to it. If they want information about me, they should be asking me, not some third party.

I don't disagree, but then how do we trust it? I suppose (thinking out loud) that we could have everyone on your credit report sign it, but then encrypt it to your public key? That way only you can let others see it, but it's still tamper-proof.

There's a legit need for tampering, though - to arbitrate disputes between creditors and debtors. Also to comply with the Fair Credit Reporting Act. So there's four parties that contribute to the document:

1. Credit applicants, who release all-or-none of their credit report information, and can see it at any point in time. Means it needs to be stored encrypted with their public key.

2. Creditors, who can add, edit, and remove information from someone's credit report. Presumably this adds a way to verify that the addition/edit/deletion is from them and not some other party (sign with private key).

3. Other creditors, who can - with approval - view an applicant's credit report and know it is complete and up-to-date.

4. Arbitrator, who resolves disputes and deletes or corrects inaccurate information from reports.

And presumably you'd want some sort of additional safety mechanism to prevent dissemination of the unencrypted result? Like, if you gave an organization an unlock code, maybe it's possible to arrange things such that that organization's private key is able to create legit-looking data, so nobody else could trust third-party sharing of credit report data?

Post reply on HN