Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

1k Data Breaches Later, the Disclosure Lag Is Worse

troyhunt.com

Post reply on HN
Print view View original

111–120 of 133 posts

Re: 1k Data Breaches Later, the Disclosure Lag Is Worse

#111

Post by 1vuio0pswjnm7 »

"Today, I loaded the 1,000th data breach into Have I Been Pwned. Reflecting on that milestone number, I pondered how to mark the occasion in writing, and what immediately came to mind was a very simple question: why is it still needed?"

Maybe it isn't needed

Originally HIBP and other websites used data breach dumps to solicit further data collection^1, e.g., with a fear-based, clickbaity title like "Have I been pwned?"

Maybe HIBP serves the author, maybe that's why it's "needed"

For example, it brings him notoriety

For example, he can promote his other cybersecurity website via HIBP and paid speaking engagements

The author has expressed dissatisfaction that companies are being penalised for data breaches through class action litigation, including any compensation users might receive as part of these settlements

He believes there is no user injury

https://www.troyhunt.com/data-breaches-class-actions-and-amb...

If that's his position, if he believes users are unharmed by data breaches, then what's the point of HIBP

Is it to support the companies who are collecting data and then being breached (not the users to whom the data belongs)

1. Data collection being the root cause of the data breach problem

Re: 1k Data Breaches Later, the Disclosure Lag Is Worse

#112

Post by cortesoft »

parable wrote: post #47
cortesoft wrote: post #35

Earlier quoted context omitted.

Is the alternative just accepting that my data is out there? Even if I never used any online service, there are databases out there with my information anyway. Just figure anything online that you aren't securing yourself is compromised. Minimize the effect that has on your life. Identify theft is annoying, but it rarely has severe effects. You will have to go out of your way to be truly anonymous online, and it migh…

> Otherwise, just assume everything you do online is public and act accordingly. This is such a depressing reality. It's also what governments want you to believe. If you aren't able to speak your mind about anything anonymously, then you won't be able to, say, spread ideas that go against them. Admitting defeat at all and not even trying to teach people about privacy results in the "I don't care, what's the point?"…

So what is the alternative? I don't feel like there is a legislative fix, so what else can we do?

Re: 1k Data Breaches Later, the Disclosure Lag Is Worse

#113

Post by zahlman »

kleiba2 wrote: post #19

For years, I've been trying my best to stay low-key when it comes to my personal information on the internet. I don't create new accounts, I never cross-login with my email address, I don't use phones. Certainly not perfect, but a lot of times I'm preferring privacy over convenience. At the same time, my government and society at large is pushing more and more for "digital everything". It's great when it works. But t…

> I don't create new accounts, I never cross-login with my email address

... you don't create burner email addresses specifically to cross-login with them to one service?

Re: 1k Data Breaches Later, the Disclosure Lag Is Worse

#114

Post by sandeepkd »

pixl97 wrote: post #92
SoftTalker wrote: post #74

Earlier quoted context omitted.

Katherine Archuleta and Donna Seymour aren't writing code or administering online systems. I'm sure their organizations have security policies and standards, why not put the devs and sysadmins in prison if they didn't follow them? I think that what we're seeing is evidence that humans, in general, are not capable of securely delivering the kinds of online services that they are trying to deliver. It's just too compli…

>why not put the devs and sysadmins in prison if they didn't follow them So we should start treating them like licensed engineers... Actually I agree with this.

This is bit too far to put onus on devs for security and the comparison is more like apples to oranges with other regular licensed engineers. It hard to justify ROI on Security, if anything it makes it harder to roll out features with more traction.

In the absence of any fine, most companies are comfortable with bit of reputation damage.

Re: 1k Data Breaches Later, the Disclosure Lag Is Worse

#115

Post by zahlman »

adev_ wrote: post #54
cortesoft wrote: post #35

Earlier quoted context omitted.

Is the alternative just accepting that my data is out there? Even if I never used any online service, there are databases out there with my information anyway. Just figure anything online that you aren't securing yourself is compromised. Minimize the effect that has on your life. Identify theft is annoying, but it rarely has severe effects. You will have to go out of your way to be truly anonymous online, and it migh…

> Identify theft is annoying, but it rarely has severe effects. I disagree. It has already severe effects. - The fact we are facing so many data leaks made easy for malicious agent to cross and mix data sources and setup much more evolved and convincing scam scheme. It is now trivial to get name, address, birthday and phone number from a data leak and crossed check that with the login id (email) used for lets say, a…

> Many website will request my personal physical address for trivial matters like billing or delivery. That can not under any mean be considered public data.

I just don't buy things online, and avoid anyone having my physical address that way.

Sadly, the ubiquity of terrible 2FA means at least some companies have my phone number, though.

Re: 1k Data Breaches Later, the Disclosure Lag Is Worse

#116

Post by BoppreH »

1vuio0pswjnm7 wrote: post #111

"Today, I loaded the 1,000th data breach into Have I Been Pwned. Reflecting on that milestone number, I pondered how to mark the occasion in writing, and what immediately came to mind was a very simple question: why is it still needed?" Maybe it isn't needed Originally HIBP and other websites used data breach dumps to solicit further data collection^1, e.g., with a fear-based, clickbaity title like "Have I been pwned…

1. People come to him with breaches that are not public yet.

2. He validates the breaches through a network of volunteers who check if the credentials are real.

3. He provides an easy-to-use service for free.

What is your alternative? Having each person run their own agent scanning the corners of the internet, downloading breaches, and looking for their own accounts? What the point of that?

Re: 1k Data Breaches Later, the Disclosure Lag Is Worse

#117

Post by sandeepkd »

alexfoo wrote: post #81
bruce343434 wrote: post #30

Earlier quoted context omitted.

The issue is how easy computers make everything, and how well processes scale with computers. Back in the day to heist data you'd have to physically break in or infiltrate, rummage through files, copy them somehow or just straight up take them. In a briefcase?? How many files can you exfiltrate per day like that? But on a database it's practically a matter of running a copy command and uploading it or exfiltrating it…

It all comes down to where the boundary for data access is implemented, and how strictly. If your webapp has unfettered database access then don't be surprised if it is hacked and someone can do `select * from users` and then posts that dump somewhere. The attack surface changes if your webapp can only do a REST call to pull a single user record at a time. That way you can put some auditing in, you can put rate limit…

There are layers of understanding about security and people assume they are doing best as per their knowledge.

Databases (SQL) have concept of views, restricted access going all the way to column level.

Connections can be restricted from firewall itself.

One can have MTLS connections with database on the top of it to beef up security.

Unfortunately the generation of people who knew and did all this is just considered friction and has been made obsolete.

Re: 1k Data Breaches Later, the Disclosure Lag Is Worse

#118

Post by saltcured »

SoftTalker wrote: post #74
jasode wrote: post #52

Earlier quoted context omitted.

>We need to establish measures of accountability for data holders. Not securing customer data appropriately needs to be persecutable, and the affected parties need to be given a right for compensation. The ultimate entity that could hold businesses accountable is the government but the government itself is careless with citizens' private data. I underwent a government required background check to get a security clear…

Katherine Archuleta and Donna Seymour aren't writing code or administering online systems. I'm sure their organizations have security policies and standards, why not put the devs and sysadmins in prison if they didn't follow them? I think that what we're seeing is evidence that humans, in general, are not capable of securely delivering the kinds of online services that they are trying to deliver. It's just too compli…

Accountability needs to start at the top. To allow a system where some underling is a liability blind for the top is to set up a system ripe for abuses of power.

Re: 1k Data Breaches Later, the Disclosure Lag Is Worse

#119

Post by crefiz »

cfiggers wrote: post #71

So at the risk of sounding incredibly apathetic toward something that I'm sure is probably a massive headache for some people somewhere... I'm a millennial and I've been told probably hundreds of times by this point in my life that my data has been breached. Not a single one of those times was there a) anything truly actionable for me to do about it[0] or b) a single negative impact to my actual life. In anyway. At a…

Indeed I feel the same all the time:

I do the more less the same as you, the bare minimum of protecting my data that would actually have any impact at all (banks, whatsapp, etc.) and nothing bad has ever happened -- I'm yet to see what will happen if my email gets leaked someday (if not already!) by any EvilCorp

But there are still people (eg, the main comment, as of this writing, by @kleiba) telling you about WHY we you must deGoogle ASAP, avoid using any social network to cross-login, etc.

Go touch some grass mate, life is too short to worry about what your local ISP will or will not do with your "data" (we do are a number in the end in this society)

Re: 1k Data Breaches Later, the Disclosure Lag Is Worse

#120

Post by paulddraper »

jasode wrote: post #52
kleiba2 wrote: post #19

For years, I've been trying my best to stay low-key when it comes to my personal information on the internet. I don't create new accounts, I never cross-login with my email address, I don't use phones. Certainly not perfect, but a lot of times I'm preferring privacy over convenience. At the same time, my government and society at large is pushing more and more for "digital everything". It's great when it works. But t…

>We need to establish measures of accountability for data holders. Not securing customer data appropriately needs to be persecutable, and the affected parties need to be given a right for compensation. The ultimate entity that could hold businesses accountable is the government but the government itself is careless with citizens' private data. I underwent a government required background check to get a security clear…

> As far as persecution/prosecution, I suppose Katherine Archuleta, the director of OPM, and the CIO, Donna Seymour could have been put in prison as punishment instead of just resigning.

If they committed a crime.

Law enforcement failing to prevent a robbery is not treated on the same order as someone committing a robbery.

As a practical matter, I just assume that the data I provide to anyone will get leaked, because there's a pretty good chance it will.

Post reply on HN