Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Personal and social information of 1.2B people discovered in data leak

dataviper.io

Post reply on HN
Print view View original

291–300 of 440 posts

Re: Personal and social information of 1.2B people discovered in data leak

#291

Post by erichurkman »

gddvhy wrote: post #252
calibas wrote: post #86

Earlier quoted context omitted.

I've always been a little confused how this works. If I got all that info for free, it's a "data leak", but if I pay to get the same detailed personal information it's... In either case my personal data is given away without my consent, but there's this implication that it's only an issue when someone doesn't pay for it.

If you get drivers info by hacking a DMV database, it's prison. If you got the same details by paying a few millions for FOIA requests, you're a good citizen and a model tax payer.

Unless you're the state of Florida, and you make millions by selling the DMV database to private buyers... [0]

[0] https://www.abcactionnews.com/news/local-news/i-team-investi...

Re: Personal and social information of 1.2B people discovered in data leak

#292

Post by sjwright »

williamscales wrote: post #238
skissane wrote: post #207

Earlier quoted context omitted.

My gmail is my first initial followed by my last name. There are other people on this planet with same first initial and last name, some of whom seem to think that must be their email too, because I keep on getting emails where they used it to sign up for things.

Even more baffling are the ones who use it to fill out job applications.

My gmail is two initials and last name, so theoretically less susceptible to such errors. Yet I get misaddressed mail all the time—and a surprising amount of it is job applications!

Re: Personal and social information of 1.2B people discovered in data leak

#293

Post by late2part »

GhettoMaestro wrote: post #273
jillesvangurp wrote: post #187

Earlier quoted context omitted.

It has to exist on a private network behind a firewall with ports open to application servers and other es nodes only. Running things on a public ip address is a choice that should not be taken lightly. Clustering over the public internet is not a thing with Elasticsearch (or similar products). If you are running mysql or postgres on a public ip address it would be equally stupid and irresponsible regardless of the u…

> At some point you just have to call out people for being utter morons. The blame is on them, 100%. [...] Your attitude is a symptom of a broader issue that plagues this industry: Indifference to risk*probability. If you don't ship software with "secure defaults" (depending on the threat/attack model), you essentially are handing out loaded shotguns, then blaming the "dumb" user when they inevitably point it at thei…

maybe. but there's always this....

http://www.team.net/mjb/hawg.html

Re: Personal and social information of 1.2B people discovered in data leak

#294

Post by sjwright »

klyrs wrote: post #163
mythrowaway1124 wrote: post #125

Earlier quoted context omitted.

Let's be realistic here. Everyone knows it's not possible to cancel Comcast service.

I managed to cancel my dad's after he died. They STILL tried to upsell me! One of my favorite phrases ever uttered: "He's dead , you asshole, he doesn't need more channels!" And that actually did it. Felt sorry for the salesperson, who didn't have much of a choice in the matter...

Surely by making it difficult to cancel they’re really just making it easier for people to get discounts. If I were a Comcast customer I’d be calling up to cancel every few months.

Re: Personal and social information of 1.2B people discovered in data leak

#295

Post by klyrs »

sjwright wrote: post #294
klyrs wrote: post #163

Earlier quoted context omitted.

I managed to cancel my dad's after he died. They STILL tried to upsell me! One of my favorite phrases ever uttered: "He's dead , you asshole, he doesn't need more channels!" And that actually did it. Felt sorry for the salesperson, who didn't have much of a choice in the matter...

Surely by making it difficult to cancel they’re really just making it easier for people to get discounts. If I were a Comcast customer I’d be calling up to cancel every few months.

He's dead, he doesn't need discounts.

Re: Personal and social information of 1.2B people discovered in data leak

#296

Post by Ayesh »

adrianmonk wrote: post #194
sparkywolf wrote: post #48

I found a vulnerability in linkedIn a few years back that allowed anyone to access a private profile (because client side validation was enough for them I guess..?) They didn't take my report seriously (still not completely patched) and I feel like that told me all I needed to know about their security practices.

While not good, what's the connection to this story? The article says some LinkedIn data was scraped, but I don't see anywhere that it specifically says a LinkedIn security flaw was used in the scraping. Although it is vague about what data was scraped and how, so it doesn't preclude that either. In other words, are you saying a LinkedIn vulnerability was exploited here, or suggesting that it probably was, or are you…

I signed up for an API key to see what they have on me, and the data it returned looks awfully close to what I have on linked in.

Re: Personal and social information of 1.2B people discovered in data leak

#299

Post by musicale »

>According to their website, the PDL application can be used to search: Over 1.5 Billion unique people, including close to 260 million in the US. Over 1 billion personal email addresses. Work email for 70%+ decision makers in the US, UK, and Canada. Over 420 million Linkedin urls Over 1 billion facebook urls and ids. 400 million+ phone numbers. 200 million+ US-based valid cell phone numbers.

Too bad there aren't any laws regulating this sort of private data aggregation and sale. Well, besides GDPR (which apparently isn't enforced) and CCPA (which won't be enforced either.)

Re: Personal and social information of 1.2B people discovered in data leak

#300

Post by Ayesh »

kaivi wrote: post #85
Havoc wrote: post #17

Out of curiosity how do you guys think they managed to scrape LinkedIn on such a large scale? I've been wanting to do some social graph experimentation on it (small scale - say 1000 people near me) but concluded I probably couldn't scrape enough via raw scraping without freaking out their anti-scraping. (And API is a non-starter since that basically says everything is verboten).

I've crawled a popular social network on a large scale, currently doing the same for dating services as a hobby. God, wish I'd still got paid for webscraping. Here are some tricks which may or may not work today: - Have an app where user logs in through said website, then scrape their friends using this user's token. That way you get exponential leverage on the number of API calls you can make, with just a handful of…

Wow these are some hot tips!

YMMV, and cloud providers would hate you for this, but you can automate the IP rotation with a cloud providers that bills you by the hour. It's easier than ever nowadays to spin an instance in Frankfurt, use it for an hour, and then another in Singapore for the second hour.

Pretending to be Googlebot also helps.

Post reply on HN