Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Quora User Data Compromised

blog.quora.com

Post reply on HN
Print view View original

111–120 of 525 posts

Re: Quora User Data Compromised

#111

Post by tedunangst »

_coveredInBees wrote: post #71
bhauer wrote: post #31

Earlier quoted context omitted.

Many of us who operate our own mail services use a unique email address for every web service we use. You'd be surprised how many of these unique email addresses I've received spam at (and have subsequently blackholed). I would estimate less than 50% of the associated services ever report a data breach event. I figure either there has been an unreported breach or, possibly more likely, the service sold their userlist…

You can do this with a gmail account too. If your email address is johnsmith@gmail.com...the following addresses all fwd to your main address John.smith@gmail.com Johnsmith+quora@gmail.com Johnsmith+equifax@gmail.com Etc...

While we're on the subject, all combinations of dots are equivalent. this.isme and th.isisme and thisis.me, etc. Finite variety, but good enough for a few generic throwaways and never filtered or stripped that I've seen.

Re: Quora User Data Compromised

#112

Post by wpietri »

RoadieRoller wrote: post #57

Barely a month back in the facebook data breach thread in HN, I was downvoted and my comment removed when I said that it has become a fashion for the top 500 web/e-com companies to come one day and announce data breach and walk away. I said there that it all looks to me as part of a conspiracy theory where they hide behind a breach to sell data/ buy data en masse for marketing purposes.

I don't think large companies have much interest in selling data. It's a long-term asset. The real money is in renting. E.g., Google and Facebook make a lot of money renting access to you based on the data they have. That's far more lucrative than selling the raw data once.

Also, it's implausible to me that selling the data wouldn't come out eventually. As we saw with Cambridge Analytica, even pretty obscure uses of data can eventually turn into giant media exposure for privacy breaches. The brand damage is is very expensive. Facebook's market cap is down something like $100 billion; there's no way they could have made that kind of money from trying to quietly sell copies of their data.

Re: Quora User Data Compromised

#113

Post by jedberg »

mehrdadn wrote: post #103
jedberg wrote: post #91

Earlier quoted context omitted.

I use privacy.com and Lastpass to help with this problem. Any time there is a service I have to have a business relationship with that I don't trust to keep my info secure, I use a unique password and a unique credit card number with a tight limit. What's nice is that they tie the card to a single vendor too. For example, the water company. I know the water bill is usually $50 or less, so I set the limit to $60/mo. A…

You could just use a normal Citi or BoA or any other card that generates virtual card numbers and that'll also lock it to that vendor after the first charge. So that they couldn't even hit it for $0.80 if they wanted to.

The 80 cents didn’t go through. I got a warning instead. And my regular cards don’t offer the level of control privacy.com Does.

Re: Quora User Data Compromised

#114

Post by driverdan »

jjoonathan wrote: post #104
jedberg wrote: post #91

Earlier quoted context omitted.

I use privacy.com and Lastpass to help with this problem. Any time there is a service I have to have a business relationship with that I don't trust to keep my info secure, I use a unique password and a unique credit card number with a tight limit. What's nice is that they tie the card to a single vendor too. For example, the water company. I know the water bill is usually $50 or less, so I set the limit to $60/mo. A…

Lastpass has been going downhill with every acquisition and had gotten to the point where autofill failed on the majority of sites and the "copy password" menu item disappeared, bringing clicks-to-login from 1 to ~10. A few weeks ago I saw bitwarden finish their third party security audit and took the opportunity to jump. Couldn't be happier. Autofill fails less, the "copy password" menu works, the mobile experience…

I second this. I was a long term LP user that switched to Bitwarden this year and haven't looked back.

Re: Quora User Data Compromised

#115

Post by tlow »

This is seriously distressing. This underscores the reasons why you should never use a third party messaging system for any sort of private conversations.

Why is this so easy? Is it impossible for a well-funded company to keep it's user information private? If so, can we act like it?

Re: Quora User Data Compromised

#116

Post by kccqzy »

mehrdadn wrote: post #103
jedberg wrote: post #91

Earlier quoted context omitted.

I use privacy.com and Lastpass to help with this problem. Any time there is a service I have to have a business relationship with that I don't trust to keep my info secure, I use a unique password and a unique credit card number with a tight limit. What's nice is that they tie the card to a single vendor too. For example, the water company. I know the water bill is usually $50 or less, so I set the limit to $60/mo. A…

You could just use a normal Citi or BoA or any other card that generates virtual card numbers and that'll also lock it to that vendor after the first charge. So that they couldn't even hit it for $0.80 if they wanted to.

Last time I checked, both Citi and BofA give me virtual card numbers via a Flash plugin. I really have no desire to run Flash any more. Has that changed?

Re: Quora User Data Compromised

#117

Post by harshreality »

jedberg wrote: post #95
sharkweek wrote: post #6

At this point I am operating on the assumption that ALL businesses that have my data are going to inadvertently leak it at some point, and thus I am attemtping to provide individual companies with as little information about me as possible. The toughest ones here are my online banking and my online health portal, but other than that, I have gotten pretty picky about what information I give any company.

Luckily your bank and your health provider probably have decent security, because those two industries face extra heavy fines for breaches.

Yes, heavily regulated banks and medical providers have wonderful security. You can see that they do whenever they require punctuation (but not spaces or $) in the password, and demand an 8 character password (but reject anything over 16 or 24 characters). /sarcasm

I especially like financial companies that have you login by using symantec VIP[1] which you append to your password. There's no way anyone thought that was a good idea. They did it that way because they had a worthless legacy authentication stack they couldn't rewrite, didn't understand 2FA well enough to implement it themselves, went with Symantec because "nobody ever got fired for contracting $importantfunction to $bigcompany", and the only way they could shoehorn any 2FA auth into their login flow was to concatenate it with the password.

[1] If you haven't had the pleasure of using it, it's a proprietary 2FA app that has a single seed per app install, shared between the app and symantec's database. It generates 6 digit codes that make it look similar to standard TOTP, but it's not TOTP. If you need to use it for multiple websites, you give them all the same seed hash (displayed by the app) which they use to synchronize your auth credentials with your account at symantec. IOW, it doesn't scale securely. There's also no way to have a backup 2FA device with this system; at least the two companies I've used it for haven't let me set up my account with two VIP apps on two different devices. Since normally you'll only have a single 2FA device using this Symantec VIP service, that means you have to go through a manual, insecure identity verification process to get back into your account if your one Symantec VIP device gets lost or broken.

Re: Quora User Data Compromised

#119

Post by tedunangst »

s3r3nity wrote: post #19

So I'm not a security expert, so I ask this in real earnest to learn: what is it that these companies keep doing wrong, and/or why aren't they adjusting to the climate that these types of attacks are increasing over time? Or are they trying to adjust, and the attacks are getting so sophisticated that the pace of investment in counter-measures is below that of the pace of advancement in the complexity of attacks? Or s…

Effectively nobody is secure against an insider threat. Whereby I mean a sales agent who clicks offer.pdf.exe. Which allows an attacker to find your internal traffic stats billboard running last years unpatched drupal. Which has MySQL creds for your database sitting on it.

Re: Quora User Data Compromised

#120

Post by Marsymars »

jjoonathan wrote: post #104
jedberg wrote: post #91

Earlier quoted context omitted.

I use privacy.com and Lastpass to help with this problem. Any time there is a service I have to have a business relationship with that I don't trust to keep my info secure, I use a unique password and a unique credit card number with a tight limit. What's nice is that they tie the card to a single vendor too. For example, the water company. I know the water bill is usually $50 or less, so I set the limit to $60/mo. A…

Lastpass has been going downhill with every acquisition and had gotten to the point where autofill failed on the majority of sites and the "copy password" menu item disappeared, bringing clicks-to-login from 1 to ~10. A few weeks ago I saw bitwarden finish their third party security audit and took the opportunity to jump. Couldn't be happier. Autofill fails less, the "copy password" menu works, the mobile experience…

I've been looking into password managers for my team/department, and bitwarden has some good looking stuff, but they seem to only invoice in USD, which creates constant friction for recurring IT bills at my company.
Post reply on HN