Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

PayPal says personal data may be compromised for 1.6M TIO users

foxbusiness.com

Post reply on HN
Print view View original

21–30 of 44 posts

Re: PayPal says personal data may be compromised for 1.6M TIO users

#21

Post by chrishacken »

rectang wrote: post #19
calvano915 wrote: post #9

Earlier quoted context omitted.

Companies have a reasonable obligation to protect our data, so I'm with you if they were negligent in prevention, detection, mitigation, or revelation. If they took reasonable measures to prevent, and were forthcoming if compromised anyway, and took measures to minimize damage to users, there's no reason to blame them.

It's OUR data, and WE as individuals are the ones who have to clean up the mess after aggregators spill it. Perfect security is impossible, but let's not forget 1) who is harmed, or 2) who is getting rich and who will in a worst case will cut their losses, go bankrupt, then start another company with the accumulated weath.

Then don't give your data to anyone. Perfect security doesn't exist, no matter how hard you try or how much money you throw at the problem. Breaches happen, end of story.

So the real issue should be: When and how will a new secure form of identity be created, used, and made available. Social security numbers were never intended to be used in the manner in which they are.

Re: PayPal says personal data may be compromised for 1.6M TIO users

#22

Post by electrum »

cwbrandsma wrote: post #12
blattimwind wrote: post #6

Earlier quoted context omitted.

FTFY: That is the only way we can make sure companies will avoid disclosing breaches for sure and to have them pursue a burnt-and-salted-earth-approach towards anyone who might turn up evidence of a breach.

Pretty much becomes “blame the messenger” in a hurry. That and these comments quickly become “why didn’t they just do it the ‘right’ way...as if such a thing existed. With security there is no right way, just many known wrong ways. I got into a discussion once about how to properly handle passwords (cause somebody has to do it). There is no right answer, just lots and lots of wrong ones. Don’t encrypt, hash. But not…

The "how to hash passwords" discussion should be easy: use PBKDF2, which is an IETF standard specified in RFC 8018 (originally specified in 2898 from the year 2000).

Re: PayPal says personal data may be compromised for 1.6M TIO users

#23

Post by adrianN »

cwbrandsma wrote: post #12
blattimwind wrote: post #6

Earlier quoted context omitted.

FTFY: That is the only way we can make sure companies will avoid disclosing breaches for sure and to have them pursue a burnt-and-salted-earth-approach towards anyone who might turn up evidence of a breach.

Pretty much becomes “blame the messenger” in a hurry. That and these comments quickly become “why didn’t they just do it the ‘right’ way...as if such a thing existed. With security there is no right way, just many known wrong ways. I got into a discussion once about how to properly handle passwords (cause somebody has to do it). There is no right answer, just lots and lots of wrong ones. Don’t encrypt, hash. But not…

Yes, security is hard. If there were real consequences to data breaches, then maybe companies would think twice before collecting every scrap of personal information that they can get their hands on. Large databases of personal information need to be seen as liability, not as an asset.

Re: PayPal says personal data may be compromised for 1.6M TIO users

#24

Post by adrianN »

calvano915 wrote: post #9
nafizh wrote: post #8

Earlier quoted context omitted.

The victim is not the company. It is the users - people like you and me. Let me say it again - companies are NOT the victims.

Companies have a reasonable obligation to protect our data, so I'm with you if they were negligent in prevention, detection, mitigation, or revelation. If they took reasonable measures to prevent, and were forthcoming if compromised anyway, and took measures to minimize damage to users, there's no reason to blame them.

"We used best practices to protect your data" is such a bullshit excuse. If a bank gets robbed its customers aren't told "sorry your money is gone, but we had it behind a locked door, so we're not liable".

If a company decides to collect, store and profit off of my personal data and they lose it, I really don't care about "best practices". They profited from my data, they have to pay if they lose it. The company always has the choice of not storing the data in the first place, if they can't bear the risk of a substantial fine in case my data is disclosed.

Re: PayPal says personal data may be compromised for 1.6M TIO users

#25

Post by adrianN »

chronic824 wrote: post #20
rectang wrote: post #19

Earlier quoted context omitted.

It's OUR data, and WE as individuals are the ones who have to clean up the mess after aggregators spill it. Perfect security is impossible, but let's not forget 1) who is harmed, or 2) who is getting rich and who will in a worst case will cut their losses, go bankrupt, then start another company with the accumulated weath.

It's not YOUR data. It belongs to the COMPANY. If I draw a sketch of you sitting on a subway, sorry, but you don't own the sketch.

That may be the case in the US, but here in Germany I could sue you if you made that picture public. Here people have the right to decide whether pictures of them can be made public or not (with some exceptions).

Re: PayPal says personal data may be compromised for 1.6M TIO users

#26

Post by aseipp »

cwbrandsma wrote: post #12
blattimwind wrote: post #6

Earlier quoted context omitted.

FTFY: That is the only way we can make sure companies will avoid disclosing breaches for sure and to have them pursue a burnt-and-salted-earth-approach towards anyone who might turn up evidence of a breach.

Pretty much becomes “blame the messenger” in a hurry. That and these comments quickly become “why didn’t they just do it the ‘right’ way...as if such a thing existed. With security there is no right way, just many known wrong ways. I got into a discussion once about how to properly handle passwords (cause somebody has to do it). There is no right answer, just lots and lots of wrong ones. Don’t encrypt, hash. But not…

If your development priorities are so unbelievably messed up they can't look into basic fundamentals like PBKDF2 or bcrypt, and you hoard large amounts of personal data, and you get compromised, and you think it's not your fault -- your company should not exist.

> Not that one either, we don’t recognize the author by name...and not the other one because we don’t like the owner of the company (who is not a developer).

This is quite obviously bad rhetoric (outright dumb, I'd say.) But let's say it's remotely true: you think "complete dysfunction, and inability to analyze root problems" -- that it's a reason why we shouldn't crack down these people?

Doctors make mistakes. Everyone knows that. Sometimes it's negligence, sometimes it's tragedy, sometimes it's just random happenstance or Friday the 13th or whatever. But for some reason, we don't interpret this as a blank cheque to let any jackass on the street legally operate on people, risking their lives, and then -- when they hurt someone -- we all throw up our hands, sigh, and say -- "well dang, at least Frito Pendejo, he tried really hard, tried his best and doctors, y'know, medicine is crazy and uncertain!!! there are no right answers!!!"

Re: PayPal says personal data may be compromised for 1.6M TIO users

#27

Post by toomanybeersies »

It seems we're at the point now where we can assume that any data we put online is going to get leaked.

What we need to do is figure out a way that even if our data is leaked, it doesn't have substantial negative effects. How exactly we do that, I don't know. But if a website is hacked, it shouldn't compromise our credit or our personal information.

Re: PayPal says personal data may be compromised for 1.6M TIO users

#28

Post by doesnt_know »

chronic824 wrote: post #20
rectang wrote: post #19

Earlier quoted context omitted.

It's OUR data, and WE as individuals are the ones who have to clean up the mess after aggregators spill it. Perfect security is impossible, but let's not forget 1) who is harmed, or 2) who is getting rich and who will in a worst case will cut their losses, go bankrupt, then start another company with the accumulated weath.

It's not YOUR data. It belongs to the COMPANY. If I draw a sketch of you sitting on a subway, sorry, but you don't own the sketch.

In my country (NZ), it is my data. It's the literal law that any agent that collects personal information needs to follow a number of rules. (Search for NZ privacy Act for the gory details).

I'm allowed access to the information, and can request that it be updated. They can't keep the information longer then is necessary, they can't use it for anything other than the original collection purposes, they have to take reasonable measures to secure it, they can't disclose it etc.

I won't harp on about the details, but it's relatively well thought out (apart from some limitations regarding the reporting of breaches, but there are changes in the pipeline to patch that up).

Re: PayPal says personal data may be compromised for 1.6M TIO users

#29

Post by onion2k »

iamthirsty wrote: post #3

> PayPal will offer affected TIO consumers free credit-monitoring services through Experian Plc, the spokesman said. What's the point anymore? This has happened so many times this year I've got more credit monitoring than I could ever need . Now I just need them to actually redo the "identity" system into something I can actually use with peace of mind.

If Experian were really sneaky they'd pay teams of hackers to steal personal data from businesses so the affected businesses would then have to buy huge contracts for free credit monitoring for their users from Experian. That's not what's happening here, obviously, but it'd make a great Hackers-esque movie.

Re: PayPal says personal data may be compromised for 1.6M TIO users

#30

Post by codazoda »

aalleavitch wrote: post #15

This is ridiculous. Does anyone have any insight into how these security breaches keep happening? Is it rampant carelessness on the part of the companies, some new technology that's opening a significant number of new exploits, or is it an escalation on the efforts/persistence of hackers?

Software is imperfect, and therefore vulnerable, and it's also pervasive. Data for all our providers will probably be compromised. It's not if, but when. We need to make plain facts, like name, address, birthday and, ssn, less valuable.
Post reply on HN