Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Notice of Data Breach

content.myfitnesspal.com

Post reply on HN
Print view View original

31–40 of 160 posts

Re: Notice of Data Breach

#31

Post by matthewmacleod »

BadassFractal wrote: post #25

I wonder if the daily progress photos were leaked as well. I imagine most people won't be thrilled to have their not-too-flattering progress selfies be out in public for the whole world to see. Side note: MyFitnessPal the app is awful, but many of us still use it because it has the most extensive database of food products out there. Outside of that it has no merit and has felt abandoned in forever. Can someone recomm…

What’s wrong with it, out of interest? It seems to work perfectly reliably for me, and I’m super happy that they aren’t getting all change-happy with it.

Re: Notice of Data Breach

#32

Post by samthecoy »

antonkm wrote: post #2

This is how transparent an organization should be when breached. Kudos to Under Armour.

GDPR, the new EU Data Protection legislation, will actually require companies to issue notification of a breach of PII, within 7 days of becoming aware of it, I believe.

Re: Notice of Data Breach

#33

Post by lev99 »

bhouston wrote: post #22

MyFitnessPal was horribly written app when I used it. The idea was good but God was it slow as hell when doing simple things.

I started using the app in 2012. I still use it.

I'm under the impression it's the best nutrition tracking app.

I've moved on to iHealth for tracking weight and exercise amounts, which I used MyFitnessPal in the past. This information is still in MyFitnessPal, and I will sometimes look at the graphs there, but not often. Apple Watch and a Bluetooth scale are great for the quantified self.

Re: Notice of Data Breach

#34

Post by Someone1234 »

That's unfortunate.

At least we didn't get the stereotypical "your passwords are hashed, so nothing to worry about" one liner I've been reading from a lot of companies during disclosures. All they said here is that the passwords are hashed and with a reasonably secure method -- bcrypt (although without knowing work-factor and percentage of passwords, it is hard to know just how strongly).

It has become pretty difficult to operate online these days without password managers. Password reuse has become a massive problem that worsens with each breach at a popular service. With a password manager you can just rotate the randomly generated password since you likely didn't know your old one anyway.

Off Topic: I'm surprised nobody makes a hardware "pepper"[0] that supports popular algorithms. Meaning you hash the password as you normally would (inc. salt) and then send it through the pepper-ing device for another round before storing it. That way even if someone stole the database, knew the salt, and the hashing algorithm+work-factor, they'd still lack the hardware pepper making their job significantly harder.

[0] https://en.wikipedia.org/wiki/Pepper_(cryptography)

Re: Notice of Data Breach

#36

Post by rojobuffalo »

lev99 wrote: post #33
bhouston wrote: post #22

MyFitnessPal was horribly written app when I used it. The idea was good but God was it slow as hell when doing simple things.

I started using the app in 2012. I still use it. I'm under the impression it's the best nutrition tracking app. I've moved on to iHealth for tracking weight and exercise amounts, which I used MyFitnessPal in the past. This information is still in MyFitnessPal, and I will sometimes look at the graphs there, but not often. Apple Watch and a Bluetooth scale are great for the quantified self.

I didn't think MyFitnessPal was good enough either so I started working on a chatbot that you can just tell it what you ate in natural language and it will maintain a private web journal for you. I got a basic version to work and then discovered [Nutritionix][1] and lost motivation to compete. They seem to have nailed to web UI part. And they have an NLP input form you can use in the app. So it isn't the same as just texting a bot since you have to open the app, but the NLP is pretty good. And the UI for verifying what the NLP comes up with is also good. After researching every app I could find in this space Nutrionix stands as my favorite.

[1]: https://www.nutritionix.com/app

Re: Notice of Data Breach

#37

Post by Someone1234 »

llccbb wrote: post #11

Does anyone have a good offline FOSS for macro-nutrient lookup and tracking? Been thinking about starting one for myself.

The biggest limitation seems to be getting the nutrient information itself. MyFitnessPal has a huge database of off the shelf food products built in (and restaurants) from all over the world. Much of that information provided to the company for free by its users.

MyFitnessPal has a similar advantage to Google, they have the most and richest data, and anyone else entering that market starts at a huge disadvantage. You could definitely make a FOSS app of the core tracking concept, it is just going to be super painful to use compared to MyFitnessPal.

Re: Notice of Data Breach

#38

Post by zodPod »

tragic wrote: post #3

> The affected data did not include government-issued identifiers, such as Social Security numbers and driver’s license numbers, information that the app does not collect from users Well, I suppose it wouldn't, would it? Is this supposed to be impressive? How many more of these before serious legislation gets through?

I don't think it's supposed to be impressive as much as just reassuring users who are uneducated about that kind of thing. I guarantee someone read this post and started being concerned that it had that information because they don't know how this stuff works.

EDIT: Plus, like someone pointed out below, Facebook collected a lot of data that it shouldn't and didn't declare as well.

Re: Notice of Data Breach

#39

Post by Someone1234 »

Thriptic wrote: post #17
internobody wrote: post #7

Perhaps this will also prompt them to start using HTTPS as well?

It's funny you would mention that because I also got annoyed by this and submitted a feature request for https. This is the response I received: Hello, Thanks for writing into us regarding https on MyFitnessPal. We have technical and organizational measures in place to protect your information. Specifically, we have a secure login process designed to protect your information as you access MyFitnessPal (i.e., login an…

That's an extremely embarrassing response. Helps me understand how this data breach occurred if an organization is this uninformed about basic security.

Re: Notice of Data Breach

#40

Post by zodPod »

bhouston wrote: post #22

MyFitnessPal was horribly written app when I used it. The idea was good but God was it slow as hell when doing simple things.

Agreed! I always like FatSecret's Calorie Counter app better. MFP always felt bloated and glitchy.
Post reply on HN