Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Inside the "3 billion people" national public data breach

troyhunt.com

Post reply on HN
Print view View original

221–230 of 472 posts

Re: Inside the "3 billion people" national public data breach

#221

Post by harimau777 »

shadowgovt wrote: post #25
JohnMakin wrote: post #7

Earlier quoted context omitted.

> Anyone have experience with these sort of services? Quite a bit. Often if you request removal or opt-out, you'll reappear in a matter of a few months in their system, regardless of whether you use a professional service as a proxy or do it yourself. The data brokers usually go out of their way to be annoying about it and will claim they can't do anything about you showing up in their aggregated sources later on. Th…

It's hard to make collection, aggregation, and sharing of facts illegal. Not to minimize the harm that can be done by such collections, but the law is justifiably looking for a scalpel treatment here to address the specific problem without putting the quest to understand reality on the wrong side of the line.

Instead of making it illegal, we could simply make the people who aggregate the data liable for making people whole if the data is misused.

Re: Inside the "3 billion people" national public data breach

#222

Post by croemer »

nine_k wrote: post #141
Workaccount2 wrote: post #109

Earlier quoted context omitted.

The US has three dumb points pushing back on this. The first is religious nuts who think it would be a "mark of the beast" The second is anti-government types who are, well, anti-government anything. The third is many business owners, because it would become much harder/risky to hire illegal immigrants to work.

Correct. But not insurmountable. Make the ID card optional, so that it simplifies things if you have it, but still allows operation without it. If 80% of law-abiding population has the card, only the stubborn deniers will remain targets of easy identity theft and fraud based on it. Partly it will stop being worth the effort, partly it will serve as a good control group. Allow but do not require to use the card for em…

If it's optional, then one would need to be able to have a central database of people who have IDs and want providers to require them.

Otherwise there's no protection against impersonation if IDs aren't mandatory.

Re: Inside the "3 billion people" national public data breach

#223

Post by dtquad »

1vuio0pswjnm7 wrote: post #218
throwup238 wrote: post #28

> While the specifics of the data breach remain unclear, the trove of data was put up for sale on the dark web for $3.5 million in April, the complaint reads. I guess they failed to sell it because links to the leaked data on usdod.io have been available on Breachforum/Leakbase for over a week now. Someone created a magnet link yesterday and it's fully seeded so speeds are fast. The data in the breach is irreversibly…

Now everyone just needs to send their email addresses to HIBP, i.e., email HIBP, so he can connect these identities with IP addresses and working email accounts. For peoples' protection of course. After everyone "has been pwned" then there is no need for HIBP. The answer is always "yes". Yet I am certain sites like "HIBP" will never go away. Something about email marketing. Some HN commenter(s) will inevitably try to…

HIBP has been audited by independent 3rd parties.

Re: Inside the "3 billion people" national public data breach

#224

Post by mistrial9 »

sneak wrote: post #208
Workaccount2 wrote: post #109

Earlier quoted context omitted.

The US has three dumb points pushing back on this. The first is religious nuts who think it would be a "mark of the beast" The second is anti-government types who are, well, anti-government anything. The third is many business owners, because it would become much harder/risky to hire illegal immigrants to work.

There is another group: those of us who think the trend of requiring ID to transact is a dangerous one. One doesn’t need to be anti-government to fear governmental intrusion on one’s rights without due process. Our current government does that now.

> those of us who think the trend of requiring ID to transact is a dangerous one.

agree and second -- history shows that this sort of thing goes badly due to "humans"

Re: Inside the "3 billion people" national public data breach

#225

Post by nine_k »

croemer wrote: post #222
nine_k wrote: post #141

Earlier quoted context omitted.

Correct. But not insurmountable. Make the ID card optional, so that it simplifies things if you have it, but still allows operation without it. If 80% of law-abiding population has the card, only the stubborn deniers will remain targets of easy identity theft and fraud based on it. Partly it will stop being worth the effort, partly it will serve as a good control group. Allow but do not require to use the card for em…

If it's optional, then one would need to be able to have a central database of people who have IDs and want providers to require them. Otherwise there's no protection against impersonation if IDs aren't mandatory.

Indeed. But a federated database is fine, too; this is how Visa and MasterCard work.

Imagine having a bunch of ID cards in you wallet, like you already have (driver's license, library card, office access card, store loyalty card) that all have interoperable smartcard interface, and a QR code of their built-in public key.

They would be much like contactless bank cards you also keep in your wallet.

Banks and phone network operators are uniquely positioned to sell a validation service for such cards, being highly connected and already having data about their existing customers, which would be an easy initial audience pool.

Re: Inside the "3 billion people" national public data breach

#226

Post by Hnrobert42 »

left-struck wrote: post #164

> The problem with verifying breaches sourced from data aggregators is that nobody willingly - knowingly - provides their data to them This is a bit of a tangent but I feel like if we can prove this statement then these data aggregators should be made illegal. How can you consent to something that you don’t know you’re consenting to? Likewise why do these entities have the right to collect detailed personal informati…

I have been using a different site@mydomain email address for every service I've used for the past 15 years. I can point to exactly which site breach furnished my email address to the aggregators.

Re: Inside the "3 billion people" national public data breach

#227

Post by meowster »

EvanAnderson wrote: post #111
kube-system wrote: post #102

Earlier quoted context omitted.

US law does generally make fraud the bank's problem. Identity theft isn't loophole in this, it is a situation in which there is a logical ambiguity in differentiating one fraud from another. If they just believed everyone who said "it wasn't me that spent that money!" that would just be opening another vulnerability.

I think we've got liability pretty well buttoned-up in the banking industry. I'm more concerned about the non-bank businesses. (I recently obtained utilities at a new house. All three utilities-- electrical, gas, and water/sewer-- use my SSN as an authenticator for my account. In 2024.)

When I obtained utilities for my house, none of them required my SSN. The water company asked, but I declined, so they asked for a fax of my DL (which I could have probably photoshopped, but didn't).

Just because people ask for something, doesn't mean you have to give it to them. I leave fields blank all the time on different (paper) forms (including when they ask for SSN), virtually no one hassles me.

Re: Inside the "3 billion people" national public data breach

#228

Post by meowster »

qorrect wrote: post #173
Mtinie wrote: post #162

Earlier quoted context omitted.

You’d need to pick a day of importance to launch the chaos-sowing attack against information and social services. I’m sure there’s a useful one in early November.

Thanksgiving is at the end of the month though

They're alluding to the U.S. presidential election.

Re: Inside the "3 billion people" national public data breach

#229

Post by pests »

Eji1700 wrote: post #96
janalsncm wrote: post #90

Earlier quoted context omitted.

Identity theft is a very clever term to shift blame from the company to the consumer. https://youtu.be/CS9ptA3Ya9E It’s a comedy bit but I take its point seriously: if the bank gives away money, it’s the bank’s job to make sure it is repaid. Not mine, unless I was actually a party to the agreement.

Well then you're up against the wall of digital verification. I know there's a fuck load of situations where the banks are 100% screwing the customer to their benefit, but there's a legit conversation about people who give out their passwords, or claim they did, when money gets wiped out. If you meet all the requirements to identify yourself to the bank, at what point does the bank have to say "this is that person, a…

How do you feel about the recent case where a caretaker for a disabled person who was given permission and access to use the person's cards, banking app, etc ended up stealing from the person. The banks response - they had given the caretaker access so it was their fault.

Even if you have all the passwords and bioinformatics, passkeys, 2FA, etc - how can you prevent theft like this?

Re: Inside the "3 billion people" national public data breach

#230

Post by hollerith »

pests wrote: post #229
Eji1700 wrote: post #96

Earlier quoted context omitted.

Well then you're up against the wall of digital verification. I know there's a fuck load of situations where the banks are 100% screwing the customer to their benefit, but there's a legit conversation about people who give out their passwords, or claim they did, when money gets wiped out. If you meet all the requirements to identify yourself to the bank, at what point does the bank have to say "this is that person, a…

How do you feel about the recent case where a caretaker for a disabled person who was given permission and access to use the person's cards, banking app, etc ended up stealing from the person. The banks response - they had given the caretaker access so it was their fault. Even if you have all the passwords and bioinformatics, passkeys, 2FA, etc - how can you prevent theft like this?

Just because the bank didn't reverse the transaction doesn't mean the disabled person can't sue the caretaker and doesn't mean a prosecutor can't charge the caretaker.
Post reply on HN