Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AT&T says criminals stole phone records of 'nearly all' customers in data breach

techcrunch.com

Post reply on HN
Print view View original

201–210 of 874 posts

Re: AT&T says criminals stole phone records of 'nearly all' customers in data breach

#201

Post by chefandy »

0cf8612b2e1e wrote: post #166
pavel_lishin wrote: post #115

Earlier quoted context omitted.

My mother was concerned that some of her information, and mine, leaked because she signed up for another bank account from a place she decided she didn't trust. She said she wasn't worried about the money being stolen, but she was worried about our identities being stolen. My concern was the complete opposite - I assume that my social security number and address are already for sale for a fraction of a cent somewhere…

As a nobody, I keep wanting a financial product that is a black hole. Money can go in, but cannot come out without significant pain. Seven+ day waiting period, in person visit, physical mail verification, something, anything that means if I do get hacked my accounts are not drained in milliseconds. When I need a legitimate large withdrawal, I can go through the required effort.

You can have a financial manager control your accounts for you and just keep a small checking account, (plus they'll help you grow your balances) but they're not free. Well, they're not free if you want them to be unbiased. Given, what's going to keep them from getting scammed? Maybe what you're looking for is several safe deposit boxes.

Re: AT&T says criminals stole phone records of 'nearly all' customers in data breach

#202

Post by xyst »

graybeardhacker wrote: post #104

Freeze your credit people! It's super easy. It's not a perfect fix but it's so trivial to do and it will help. https://www.usa.gov/credit-freeze You can unfreeze through an app whenever you want/need to.

I typically don’t “freeze” my credit but do have a handful of services actively monitoring my credit for free (have been involved with many data breaches) and it’s included with my credit cards.

> A credit freeze restricts access to your credit report

So if I freeze my credit, this will also deny access to the monitoring services AND financial institutions, right?

Side note: financial institutions often do “soft” credit pulls on active account holders to determine if they are eligible for credit limit increases. Have been growing my existing credit line for some time now without having to obtain additional credit cards. So far, close to $500K in unsecured credit.

Seems more like a nuclear option.

Re: AT&T says criminals stole phone records of 'nearly all' customers in data breach

#203

Post by psadauskas »

graybeardhacker wrote: post #104

Freeze your credit people! It's super easy. It's not a perfect fix but it's so trivial to do and it will help. https://www.usa.gov/credit-freeze You can unfreeze through an app whenever you want/need to.

Fuck that. I'm gonna open a bunch of credit cards, buy a bunch of cool shit, and when they ask me to pay my bill, just say my identity was stolen.

If I have to fight the credit bureaus anyway, I might as well get something out of it. Stealing my own identity seems pretty straightforward.

Re: AT&T says criminals stole phone records of 'nearly all' customers in data breach

#204

Post by dboreham »

graybeardhacker wrote: post #95
jader201 wrote: post #84

Earlier quoted context omitted.

I never got the impression that the market ever cares about data breaches. It seems most companies are rarely held financially responsible for data breaches anyway. I would bet any effects you’re seeing in stocks is unrelated to this news.

I agree. This is precisely why breaches keep happening and will keep happening. It cost money to implement security. There's no cost benefit to spending that time and money since there are no consequences. Businesses do not spend money unless it will make them money or save them money. There needs to be a hefty federal fine on a per-affected-user basis for data breaches. Also a federal fine for each day a breach is u…

> It cost money to implement security.

Yes, but no amount of money will stop the data in a big database being stolen by someone sufficiently motivated to steal it. It's just bits on someone's disk.

The only true solution is to not create the database. But then what would all the data scientists and their MBA masters so with their time?

Re: AT&T says criminals stole phone records of 'nearly all' customers in data breach

#205

Post by mdavidn »

demondemidi wrote: post #110
pylua wrote: post #75

And earlier this year my ssn was on the dark web due to their leak (or vendor). One year of monitoring? No, I’m going to need it for life. Security is not a concern. There is no real incentive to change the status quo. Make them pay for monitoring indefinitely .

When I went to college in the late 80s my ssn was automatically used as my student id. When I got my first bank account in 1990, they used my ssn as the account number.

My first big employer in the aughts had my SSN encoded in a bar code on the back of my company ID, which they expected us to display at the office.

Re: AT&T says criminals stole phone records of 'nearly all' customers in data breach

#206

Post by dboreham »

skybrian wrote: post #196

> Snowflake blamed the data thefts on its customers for not using multi-factor authentication to secure their Snowflake accounts, a security feature that the cloud data giant did not enforce or require its customers to use. And is that going to change?

This is a diversion. Why did they build a system that permitted a bulk database dump of hundreds of millions of rows even with 2FA?

Re: AT&T says criminals stole phone records of 'nearly all' customers in data breach

#208

Post by dboreham »

strangecharm2 wrote: post #109
ajsnigrutin wrote: post #96

Earlier quoted context omitted.

I never understood the american secrecy about SSN... it should be a "username" not a "password"... In my country you can calculate our own national id (mix of date of birth, autoincreasing number by each birth that day + 1 checksum number), and if you do/have any kind of personal business, your personal tax number has to be written everywhere, on every receipt you hand out or anything you buy as a business. Somehow k…

This comment pops up every time someone talks about social security numbers. Yes, they were never supposed to be private, but now they are. So either Congress can do something about it, or big companies can stop leaking them. Clever "well, actually"s didn't stop my identity from being stolen recently after a breach, and they never will.

They're not really private+, and nobody should design a system with the assumption that they are. afaik nobody does these days. There are extra authentication checks done in addition to simply "I have the SSN".

+ e.g. until very recently there were US states that used your SSN as your driver license number.

Re: AT&T says criminals stole phone records of 'nearly all' customers in data breach

#209

Post by dahart »

dghlsakjg wrote: post #164
yyyfb wrote: post #131

Earlier quoted context omitted.

AT&T and phone carriers in general are not technology companies. They are infrastructure companies that purchase off-the-shelf communication technology, slap a billing system on top, and then spend most of their time on operations (finding places to put towers, keeping the gear up and running) and marketing. The security component of communications isn't built by them, but by the equipment manufacturers that they pur…

ATT has a rich history of being a technology company. They invented UNIX! That's in the past, fair enough. So they used to develop cutting edge technology, they sell technology, they buy technology, they operate technology, they work with manufacturers to develop new technology, they operate the infrastructure underpinning the modern technology economy, but they aren't a technology company? Even if you want to argue…

> They invented UNIX!

They also invented the transistor, C, the photovoltaic cell, radio astronomy, and … the telephone. ;)

Yes that’s the past, but AT&T labs still employs almost two thousand people. It’s very funny to try to claim AT&T isn’t a technology company and only peddles services on top of equipment made by others.

Re: AT&T says criminals stole phone records of 'nearly all' customers in data breach

#210

Post by theluketaylor »

athenot wrote: post #160
browningstreet wrote: post #117

Earlier quoted context omitted.

A lot of financial things in the US are “secured” or anchored by SSN, that’s the only reason why. That and mother’s maiden name and first vacation and other security questions. It’d be less important with MFA now but SSN is also needed when opening new credit, so having it allows you to pretty easily fake someone else’s identity for credit. KYC hasn’t removed it from the equation.

One mitigation is to make your mother's maiden name the output of: head -c 20 /dev/random | base64 And keep track of the result in your favorite password manager. Fortunately, fewer and fewer orgs are using security questions, but there are still some important ones that only use that and no MFA.

The problem with that plan is social engineering attacks. CSRs are often careless and will accept 'a bunch of random letters and numbers' as the answer rather than validating each character.

Better to randomly select a long dictionary word or hypenate a few together. Equally unguessable but easily verified, so it won't be weakened during a phone conversation.

Post reply on HN