Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

PayPal says personal data may be compromised for 1.6M TIO users

foxbusiness.com

Post reply on HN
Print view View original

31–40 of 44 posts

Re: PayPal says personal data may be compromised for 1.6M TIO users

#31

Post by Caligatio »

I really don't know what it is going to take to shift people from thinking "oh no, my private data leaked" to "I really don't have any private data." Honestly, look at the stuff that was leaked:

- Names: this is public information

- Addresses: this is public information

- Bank Account Details: this is on every check you've ever written

- SSN: this is on so many applications for things and compromised so many times it can't be realistically called private

- Account Login Details: not to be pedantic but this is a shared secret and should be treated as such

I know there have been some rumblings about actually trying to change the financial identification system in the US but really this needs to be the focus. We've been pretending that we have any sort of "secure" identification system for too long and now it's finally catching up to us. Solutions exist for a majority of these problems:

- For stolen credit card numbers: Force the issuers to add one-time CC number generation and have that one-time number locked to a merchant. Discover had this years ago and got rid of it; I'm sure others had it as well. This effectively solves the online merchant problem. Things like Visa Checkout and Masterpass also can help here by eliminating the need to give merchants your actual number (as can Android Pay, Apple Pay, Samsung Pay, PayPal, etc)

- For stolen credit cards: Actually change over to chip and pin

- For online financial identification: Issue smart+national ID cards like Estonia that can provide digital authentication. Is it perfect? No. If people don't like the concept of a smart+national ID card, put the risk of doing anything online on them. https://www.login.gov/ is a baby step in this direction.

Re: PayPal says personal data may be compromised for 1.6M TIO users

#32

Post by sigi45 »

Caligatio wrote: post #31

I really don't know what it is going to take to shift people from thinking "oh no, my private data leaked" to "I really don't have any private data." Honestly, look at the stuff that was leaked: - Names: this is public information - Addresses: this is public information - Bank Account Details: this is on every check you've ever written - SSN: this is on so many applications for things and compromised so many times it…

So just wait until you get a stalker and that person is able to find that 'public information' with a google search.

There is a difference and it still should be secured.

My address might be public information but because i choose to not because someone else chose this for me.

Re: PayPal says personal data may be compromised for 1.6M TIO users

#33

Post by ben_w »

michael_storm wrote: post #14
em3rgent0rdr wrote: post #13

Aside: a downside of Know-Your-Customer laws (and anything else that requires your to upload personal data to web services) is now that data can be compromised as well. Maybe there should be less such requirements.

Or requirements to not keep data unless for a legitimate business purpose.

That sounds like the UK’s Data Protection Act, soon to be replaced with an EU successor that will apparently cause all sorts of interesting times if the UK tries to get rid of it post-Brexit.

Re: PayPal says personal data may be compromised for 1.6M TIO users

#34

Post by Caligatio »

sigi45 wrote: post #32
Caligatio wrote: post #31

I really don't know what it is going to take to shift people from thinking "oh no, my private data leaked" to "I really don't have any private data." Honestly, look at the stuff that was leaked: - Names: this is public information - Addresses: this is public information - Bank Account Details: this is on every check you've ever written - SSN: this is on so many applications for things and compromised so many times it…

So just wait until you get a stalker and that person is able to find that 'public information' with a google search. There is a difference and it still should be secured. My address might be public information but because i choose to not because someone else chose this for me.

Saying your physical address is private ignores the reality of the situation: it's on your driver's license that you hand over to people that you don't explicitly trust (getting carded at bars, airports, stores, etc), it's sold between companies that you don't give explicit permission, you give it out to receive goods, and there is no law to force people to remove your address (to your point, try to request removal from sites like 411.info). Given all of that, it's unfortunately a fantasy to think that this is somehow private.

Private information isn't private if you have to give it out.

Re: PayPal says personal data may be compromised for 1.6M TIO users

#35

Post by sitepodmatt »

iamthirsty wrote: post #3

> PayPal will offer affected TIO consumers free credit-monitoring services through Experian Plc, the spokesman said. What's the point anymore? This has happened so many times this year I've got more credit monitoring than I could ever need . Now I just need them to actually redo the "identity" system into something I can actually use with peace of mind.

I'd be fuming if I was opted in to any product from Experian without direct consent, I've seen php bitcoin exchanges with more credibility than those cunts

Re: PayPal says personal data may be compromised for 1.6M TIO users

#36

Post by thanksgiving »

onion2k wrote: post #29
iamthirsty wrote: post #3

> PayPal will offer affected TIO consumers free credit-monitoring services through Experian Plc, the spokesman said. What's the point anymore? This has happened so many times this year I've got more credit monitoring than I could ever need . Now I just need them to actually redo the "identity" system into something I can actually use with peace of mind.

If Experian were really sneaky they'd pay teams of hackers to steal personal data from businesses so the affected businesses would then have to buy huge contracts for free credit monitoring for their users from Experian. That's not what's happening here, obviously, but it'd make a great Hackers-esque movie.

I didn't even think PayPal has to pay Experian money for this... Wow. Likely a bulk deal too like you said.

Re: PayPal says personal data may be compromised for 1.6M TIO users

#37

Post by coldtea »

Caligatio wrote: post #31

I really don't know what it is going to take to shift people from thinking "oh no, my private data leaked" to "I really don't have any private data." Honestly, look at the stuff that was leaked: - Names: this is public information - Addresses: this is public information - Bank Account Details: this is on every check you've ever written - SSN: this is on so many applications for things and compromised so many times it…

>- Names: this is public information - Addresses: this is public information - Bank Account Details: this is on every check you've ever written - SSN: this is on so many applications for things and compromised so many times it can't be realistically called private - Account Login Details: not to be pedantic but this is a shared secret and should be treated as such

Those may not be difficult for an adversary that targets someone personally to get. They'll have some trouble getting a few of them (something being on "every check you've ever written" doesn't mean I can see it easily if I'm not a person making business with you. Besides few write checks anymore anyway), but they will be able to gather most.

That's completely different than anybody who doesn't know you at all having all those details for millions of people in a large data dump - that is, any scammer worldwide.

Re: PayPal says personal data may be compromised for 1.6M TIO users

#38

Post by coldtea »

Caligatio wrote: post #34
sigi45 wrote: post #32

Earlier quoted context omitted.

So just wait until you get a stalker and that person is able to find that 'public information' with a google search. There is a difference and it still should be secured. My address might be public information but because i choose to not because someone else chose this for me.

Saying your physical address is private ignores the reality of the situation: it's on your driver's license that you hand over to people that you don't explicitly trust (getting carded at bars, airports, stores, etc), it's sold between companies that you don't give explicit permission, you give it out to receive goods, and there is no law to force people to remove your address (to your point, try to request removal f…

>Saying your physical address is private ignores the reality of the situation: it's on your driver's license that you hand over to people that you don't explicitly trust (getting carded at bars, airports, stores, etc), it's sold between companies that you don't give explicit permission, you give it out to receive goods

None of those are arguments against making it easier for some 4chan kiddie from Iowa to fine one's details in a Google search.

Many people can't seem to understand that something possible and easy is worse than something possible.

They consider security/privacy etc a strict binary.

Post reply on HN