21–30 of 39 posts
Earlier quoted context omitted.
https://security.stackexchange.com/a/95070 https://en.wikipedia.org/wiki/Phishing#Spear_phishing
As I mentioned, the real issue is around considering of this data as a secret.
I've never been able to unsubscribe from their shitty emails - which I never subscribed to. I only signed up for a flight. And now, my data is open-source ಠ_ಠ
Maybe if the US was willing to perform an air strike on each business that violated CAN-SPAM we'd get some real compliance.
Trying to understand what's the real damage here. Dates of birth, Email addresses, Loyalty program details, Names, Phone numbers - how is one going to use this data to cause a loss the data owner? If any security check depends on this data by considering it as a secret, then I guess it's the fault of that security check.
That is very small solace when you're the victim, regardless of the failures of others. "But you shouldn't be using that data as validation!" is not the first response when say, you find out someone's opened a credit card in your name with a $20K balance. Or your friends & family get phished (especially with the help of AI) because they know so much about you it had to be you.
Testing some emails in haveibeenpwned i realized something terrible about these leaks. In isolation, ok, you have just your personal data like birthdate, name, phone number leaked just based on an email. But now that there was so many leaks, just taking a single email, you can easily map an important part of the profile of a person. Give me an email, I now have: - All identification details, sometimes scanned id docu…
Makes me feel OK about my strategy to use a different email for every sign up
at this point one should just assume all their data is already public once they entered it to any platform...
And when governments try to plug up some of the loopholes when it comes to privacy and data sharing, every major company finds some new gap to exploit or just does it illegally without telling anybody until they get found out and pay the fine.
Haven't heard a word from Vietnam Airlines - my whole family are members. Interesting to see how a Vietnamese organisation handles this type of incident.
Does the Vietnamese government have any interest in cases like this? Or are things pretty laissez-faire over there despite the nominal socialism?
Testing some emails in haveibeenpwned i realized something terrible about these leaks. In isolation, ok, you have just your personal data like birthdate, name, phone number leaked just based on an email. But now that there was so many leaks, just taking a single email, you can easily map an important part of the profile of a person. Give me an email, I now have: - All identification details, sometimes scanned id docu…
Trying to understand what's the real damage here. Dates of birth, Email addresses, Loyalty program details, Names, Phone numbers - how is one going to use this data to cause a loss the data owner? If any security check depends on this data by considering it as a secret, then I guess it's the fault of that security check.
It's inherently a loss of privacy that anyone (given that the dataset is now public) can correlate > Dates of birth, Email addresses, Loyalty program details, Names, Phone numbers
Earlier quoted context omitted.
Makes me feel OK about my strategy to use a different email for every sign up
if you run your own domain and have a wildcard for email this is a very good strategy. I also never provide my real birthdate for (almost) anything. The vast majority DO NOT NEED IT, and the rare case where it might be required (still doubt it, but maybe age of majority or consent, or a waiver) I use Jan 1st of the real year. This has caused problems (ex: doesn't match your id) but on the balance seems to be positive…
Trying to understand what's the real damage here. Dates of birth, Email addresses, Loyalty program details, Names, Phone numbers - how is one going to use this data to cause a loss the data owner? If any security check depends on this data by considering it as a secret, then I guess it's the fault of that security check.