Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Facebook does not plan to notify half-billion users affected by data leak

reuters.com

Post reply on HN
Print view View original

281–290 of 315 posts

Re: Facebook does not plan to notify half-billion users affected by data leak

#281

Post by RankingMember »

briandear wrote: post #276
RankingMember wrote: post #261

Earlier quoted context omitted.

Perhaps the fine amount should be a function of market cap for public companies.

The fine should be proportional to the damage. A tiny medical startup that leaks psychotherapy records “hurts” more than a company that leaks your shoe size. Perhaps companies should buy insurance for this and then that would incentivize insurance companies to help protect their clients. Insurance requirements are a significant safety factor at many physical businesses. The law is important, but being denied insuranc…

> The fine should be proportional to the damage. A tiny medical startup that leaks psychotherapy records “hurts” more than a company that leaks your shoe size.

I agree. I meant that market cap should be taken into account along with factors such as damage. The goal is that for the same wrong, a small and a large company face the same penalty, but adjusted in proportion to their financials.

Re: Facebook does not plan to notify half-billion users affected by data leak

#283

Post by mLuby »

qudat wrote: post #275
mLuby wrote: post #270

Earlier quoted context omitted.

No, societies recognize that everyone shouldn't need to be a doctor/engineer/financial analyst to avoid harm in daily activities, so we collectively empower regulators like the FDA/FAA/SEC to protect us from unfettered capitalism. Likewise we shouldn't expect people to all be computer security experts, but we should expect regulators to keep us safe by creating standards and enforcing penalties for companies failing…

> No, societies recognize that everyone shouldn't need to be a doctor/engineer/financial analyst to avoid harm in daily activities, so we collectively empower regulators like the FDA/FAA/SEC to protect us from unfettered capitalism. This centralizes power to a few at the expense of the many. Furthermore I deem the social contract to be unethical so I would not include myself in the "everyone" camp. I'd much rather se…

You the individual have no power to make Facebook, or any large organization, change its behavior. To it, you are like an ant is to a human. There is no "at the expense of the few" when you have nothing.

But just as a colony of ants can destroy a house, so too can we puny humans, when united, extract demands from huge corporations. Individual regulators do the actual fighting, but they do so on our behalf, with our collective backing.

(Side note: so cool of you for disagreeing with the social contract, though your edgy dissent is only possible because the majority do accept government.)

Re: Facebook does not plan to notify half-billion users affected by data leak

#284

Post by wyuenho »

The reaction here is why I start losing faith in humanity.

This "leak", has been blown way out of proportion. This leak, if anyone has actually bothered to look into it, will tell you there's very little available of value. For instance, there's no password.

There's about 2.5 mil emails that for all likelihood, it's already out in the wild. For the phone numbers, you can just robo-dial, (there aren't many to be found mind you). For everything else, they are data that the users have set public on their profiles, so they are meant to be seen, and you can readily search for them on Facebook already.

ALL THE LEAKED DATA WAS PUBLIC.

Do better HN.

Re: Facebook does not plan to notify half-billion users affected by data leak

#285

Post by Mediterraneo10 »

dotancohen wrote: post #215
tuxone wrote: post #10

This huge leak has definitely killed the SMS text messaging service. Sender can be spoofed and spam/scam/phishing have reached an intolerable level. The fact that they can cross reference you and then produce a more personalized content is huge. Changing password is easy (ok less easy if you recycle it) but changing phone number is something that I am not even relaxed to do.

> This huge leak has definitely killed the > SMS text messaging service. So with this breach, one now must use WhatsApp for messaging contacts? That is rather convenient for Facebook. As someone who has much friction already convincing people to use SMS with me instead of the WhatsApp account that I've never had (nor a Facebook account), making SMS even more problematic is great for Facebook. Many people assume bad i…

The reason that Whatsapp massively took off in certain parts of the world, and to an extent even replaced the public-telephone system (e.g. restaurants and other local businesses may even want to be contacted by Whatsapp, not phone), is because SMS is expensive, but data is not. Sure, you might be in a part of the world where SMS is a viable option, but for many people it no longer is, and instead of asking for SMS you might suggest an alternative like Telegram or Signal.

Re: Facebook does not plan to notify half-billion users affected by data leak

#286

Post by DerpyBaby123 »

worker767424 wrote: post #269
DerpyBaby123 wrote: post #265

Earlier quoted context omitted.

Your argument doesn't hold water - lots of systems have users without collecting their phone numbers.

It's not just phone numbers, though. It could be private messages, friends-only posts, IP address logs, physical addresses, SSNs--the list goes on. You'll quickly find that anything non-trivial will start collecting data users wouldn't want public.

>Don’t store data you can’t protect.

Services like social networks don't need to store physical addresses, SSNs, phone numbers, etc. Therefore, that data should be looked at like a liability rather than an asset. It shouldn't be collected in the first place.

Data like private messages, friends-only posts, etc are needed for the features they want to provide, and they should only provide those features if they can protect that data.

https://martinfowler.com/bliki/Datensparsamkeit.html

Re: Facebook does not plan to notify half-billion users affected by data leak

#287

Post by downrightmike »

haolez wrote: post #204
rubyn00bie wrote: post #166

I’ve said it before and I’ll say it again, unless and until, companies like Facebook are fined appropriate amounts they’ll never stop. Quite literally, every business school on the fucking planet will tell you do something if it’s cheaper. It is cheaper for them to not give a fuck, than to give one. Unless they are fined upwards of $20-50bn it’ll never stop because it’s always going to benefit their bottom line. Full…

I have a strong suspicion that, if a government tried to fine a company in billions, that company would simply leave the country forever. I'm not saying that this is a good thing or a bad thing. It's just an intuition that I have.

Cool, they can leave, let their competitors take over, or new entrants that will do the needful.

Re: Facebook does not plan to notify half-billion users affected by data leak

#288

Post by ShakataGaNai »

bsimpson wrote: post #256
rpastuszak wrote: post #67

"The Facebook spokesman said the social media company *was not confident it had full visibility on which users would need to be notified*." @Facebook here you go: https://haveibeenpwned.com

I use yourdomain@mydomain to sign up for accounts. name@mydomain is something I try to only give to friends. According to that site, my personal email has been leaked by Adobe, and by a bunch of shady database firms I've never heard of. (On further reflection, I probably used my Google account to log into Adobe, which leaks my personal email to the site I'm logging into.)

Most of those shady databases are data collectors. Sometimes I see those on domain wide reports for names even if the user never actually had that email address. Sometimes it's just a guess.

Ex: You might see joe@mycompany.com in the report for those db, even though Joe Smith only ever had joe.smith@mycompany.com.

And sometimes its legit scum collection. Some of the spam you get is just verify what email addresses work and what don't. If it doesn't bounce, you know you got a valid email address. Works for a lot of businesses (but not if you've got a personal catchall)

Re: Facebook does not plan to notify half-billion users affected by data leak

#289

Post by SN76477 »

rubyn00bie wrote: post #166

I’ve said it before and I’ll say it again, unless and until, companies like Facebook are fined appropriate amounts they’ll never stop. Quite literally, every business school on the fucking planet will tell you do something if it’s cheaper. It is cheaper for them to not give a fuck, than to give one. Unless they are fined upwards of $20-50bn it’ll never stop because it’s always going to benefit their bottom line. Full…

You are right.

This should be a 25 billion dollar fine.

For a business entity this is the only thing that will motivate them to try harder in the future.

Re: Facebook does not plan to notify half-billion users affected by data leak

#290

Post by [deleted] »

viro wrote: post #155
tacone wrote: post #87

For years companies have been steadily asking, mandating or even trickling users to give them their phone numbers under the excuse of security (while the real reasons were different), now what? How can they be trusted anymore? This also strikes a great point about the data sharing between Facebook and WhatsApp. Linking data between services augments the dangers and the consequences are not obvious to the end user. I…

> I think Facebook should offer their users the option to remove their phone numbers with a real deletion. Man sometimes I think people forget phone books existed for a long time.

[deleted]
Post reply on HN