131–140 of 155 posts
After how many breach of ES clusters, Elastic will decide to make their db not accessible from external IP by default ?
That's the default for a long time already, but people actually want to use it from outside the server and so they configure the listener. https://www.elastic.co/guide/en/elasticsearch/reference/6.3/...
Am I the only one who dislikes some of those column names? isNonIndividual, IsNonVisibleToOthers, ShowableNonVisibleToOthers
Earlier quoted context omitted.
I got notified that I'm in this breach, and I honestly don't know what (if anything) I can do with this information, which implies "If it's not actionable, why bother telling me at all?" Unique passwords per site, with a password manager? Done a long time ago. Should I change some of them? OK, which ones? there are hundreds. Details of what else about me is in this breech? Not clear where I can find that.
> Should I change some of them? OK, which ones? there are hundreds. The ones that you know were pwned. In theory you should change all passwords all the time, but this is a practical middle-ground between that and "never".
Breaches like this one give no indication of which password is exposed, if any.
AFAIK, there is nothing actionable.
For the people that use unique per-merchant e-mail addresses (like someone+amazon@...), could you try some of those aliases on HaveIBeenPwned and see which ones come up in this breach? That might shed some light onto its origin.
Maybe Mozilla could partner with HaveIBeenPwned to help dealing with that?
> Email addresses, Job titles, Names, Phone numbers, Physical addresses, Social media profiles I just got the email notification from HIBP (Have I Been Pwned) a few minutes ago [1], but I am not worried about the compromised data because 1) my personal email address, job title and phone number are all visible in my resume which is publicly available in my website, I actually encourage people —mostly tech recruiters—…
Troy's fighting the good fight, but it's so freaking depressing. If he has hundreds of millions of records worth of personal data from just the breaches that have been shared with him, what _else_ is out there in the hands of criminals and corporations, neither of which have the public interest at heart—only naked self interest in exploiting members of the public for as much money as they can get?
Millions per day. This used to be part of one of my old jobs. A feed of stolen PII would drop into our SFTP server every morning and we'd process it. There's no honour among thieves so there were a bunch of duplicates pretending to be "new" data, but yes there is a cottage industry of stealing smaller quantities of PII, focused particularly on email addresses and passwords (because those get re-used elsewhere) and cr…
If you don’t know the password yourself, then phishing is less effective as it’s quite rare that your password manager forgets that it needs to fill out the form for you.
The email contained in this breach is the one I provided to Facebook. It was probably hacked or sold from one of the handful of apps I've connected with FB over the years.
> Email addresses, Job titles, Names, Phone numbers, Physical addresses, Social media profiles I just got the email notification from HIBP (Have I Been Pwned) a few minutes ago [1], but I am not worried about the compromised data because 1) my personal email address, job title and phone number are all visible in my resume which is publicly available in my website, I actually encourage people —mostly tech recruiters—…
The BambooHR theory is interesting. I looked up email addresses of co-workers at a startup I worked for a few years ago (Jul'15-Jun'16). I was with them earlier in 2012-13. My work email isn't there. But the slice of people between Apr'13-Jul'15...all there. I guess we ran through a bunch of HR software during the period, BambooHR being one of them. So either it's a subset of BambooHR or its some other product a bunc…
Others are saying they've found data from as recently as mid-2019, so could be possible that the reason it's so hard to find a source is that this is multiple sources. Looking at this as a dump from some sort of contact manager, could see this being a dump from some sales guy's CRM or something where he'd imported multiple datasets as potential leads alongside his personal contacts.
Earlier quoted context omitted.
That's the default for a long time already, but people actually want to use it from outside the server and so they configure the listener. https://www.elastic.co/guide/en/elasticsearch/reference/6.3/...
Even then, that also means that their machine has a public routable IP and can answer incoming requests from the internet. My question is: why?
That's not to say it's a good thing, but I'm always surprised by the lack of deeper network knowledge by a lot of engineers (and that's not meant degrading - it's not something that you get for free when programming).
Lastly, you did probably start the project with a single VM - and at that point it's far harder to say when the point comes to move to a NAT, even more given that getting your second server is probably needed in a sudden spike and the switch is a lot of work with no immediate payoff.
Could it be Google+? 3 of 3 my Gmail addresses associated with their profile in some way were on it. Two of it I might have used to register a domain, but the last one I used for G+ and one other website only and none of any friends know this. Also I'm not in US or have US background, can't be from American friends' phones or retailer CRM.
This seems like a winner to me. Iterating a graph along some association explains the ordering mentioned in the blog post, and explains the breadth of connectivity.