Is it illegal to download/scrape data from a wide open database like this one?
[deleted]
Personal and social information of 1.2B people discovered in data leak
301–310 of 440 posts
Re: Personal and social information of 1.2B people discovered in data leak
#302Earlier quoted context omitted.
I've been using ES off and on since before 1.0 came out. It has always baffled me that ES doesn't require a username and password by default. ES is a database that has to exist on a network to be usable. Heck, it expects that you have multiple nodes, and will complain if you don't. So one of the first things you do is expose it to the network so you can use it. Yes, it takes some serious incompetence to not realize y…
It has to exist on a private network behind a firewall with ports open to application servers and other es nodes only. Running things on a public ip address is a choice that should not be taken lightly. Clustering over the public internet is not a thing with Elasticsearch (or similar products). If you are running mysql or postgres on a public ip address it would be equally stupid and irresponsible regardless of the u…
Security in depth. If I compromise one part of your network, I shouldn't compromise it all.
Re: Personal and social information of 1.2B people discovered in data leak
#303Earlier quoted context omitted.
It has to exist on a private network behind a firewall with ports open to application servers and other es nodes only. Running things on a public ip address is a choice that should not be taken lightly. Clustering over the public internet is not a thing with Elasticsearch (or similar products). If you are running mysql or postgres on a public ip address it would be equally stupid and irresponsible regardless of the u…
Software should be secure by default. Don't blame the user. mySQL in comparison wont even let you install without setting a root password. And it only listen on localhost/unix-socket by default. Then you need to explicitly add another user if you want to allow it to login from a non local ip. I don't think it's even possible - to both set a blank root password and allow it to login from a public IP. So you really thi…
That MySQL stuff is all quite recent... up until 5.7 (?, one of the most recent releases, anyway) there's no root password by default and running `mysql_secure_installation` is a common (but not mandatory) step to, well, secure the installation and set a root password. I think MariaDB still works this way? Not sure.
I'm not aware of "bind to localhost" being the default, either. The skip-networking setting to only allow local socket connections is definitely not the default, and I'm pretty sure the default is still to bind to all interfaces.
Re: Personal and social information of 1.2B people discovered in data leak
#304Earlier quoted context omitted.
I've been using ES off and on since before 1.0 came out. It has always baffled me that ES doesn't require a username and password by default. ES is a database that has to exist on a network to be usable. Heck, it expects that you have multiple nodes, and will complain if you don't. So one of the first things you do is expose it to the network so you can use it. Yes, it takes some serious incompetence to not realize y…
It has to exist on a private network behind a firewall with ports open to application servers and other es nodes only. Running things on a public ip address is a choice that should not be taken lightly. Clustering over the public internet is not a thing with Elasticsearch (or similar products). If you are running mysql or postgres on a public ip address it would be equally stupid and irresponsible regardless of the u…
> Clustering over the public internet is not a thing with Elasticsearch
It is, sort of, https://www.elastic.co/guide/en/elasticsearch/reference/curr...
But it's not a feature you'd be using without a really good reason IMO.
Re: Personal and social information of 1.2B people discovered in data leak
#305> Analysis of the “Oxy” database revealed an almost complete scrape of LinkedIn data, including recruiter information. "Oxy" most likely stands for Oxylabs[1], a data mining service by Tesonet[2], which is a parent company of NordVPN. It is probably safe to assume, that LinkedIn was scraped using a residential proxy network, since Oxylabs offers "32M+ 100% anonymous proxies from all around the globe with zero IP bloc…
I'm a nordvpn user. Practices like this scares me though. I guess it's time to switch to a new vpn?
Re: Personal and social information of 1.2B people discovered in data leak
#306Earlier quoted context omitted.
Would be a great idea and I bet it could be successful, but maybe at a lower price point and using lots of automation of opt-out forms. As far as opting out of many credit reporting agencies, check out https://www.consumer.ftc.gov/articles/0262-stopping-unsolici... https://www.optoutprescreen.com/?rf=t Also it seems like theres a service like this called Delete Me, but it also seems like theyre a manual opt-out shop.…
Easier to just send them your own template on paper instead of using theirs. It should be like a doctor’s prescription in a lot of places: as long as it’s on paper and has the right elements, it’s valid.
Well then thats the trick. A legal research team that develops the form for as many sites as you could find, and then a mechanism to send that form filled with each users data to those sites.
Re: Personal and social information of 1.2B people discovered in data leak
#307ES is the new Mongo. If you make software this easy to use, then people with little or no experience are going to use it. Just have secure defaults, like authentication, how many times do we have to learn this lesson...
Re: Personal and social information of 1.2B people discovered in data leak
#308Earlier quoted context omitted.
Highly recommended. You can put in multiple email addresses, so you can help monitor your non-technical family members’ info as well.
At this point practically everything about me's available either for free or a few dollars. The only interesting thing left is whether a given password has been compromised. The answer to everything else is "yes, it's been leaked". Been that way for most of a decade at this point, guessing it's the same for most other folks with any modern digital or banking presence whatsoever.
[deleted]
Re: Personal and social information of 1.2B people discovered in data leak
#309Earlier quoted context omitted.
Exactly. The very reason for existence of the two companies, pdl and oxy, is to tie n pieces of data with m pieces of data. So depending on how the "anonymous" phone number was used, it's plausible that the number can be connected with other PII. In fact I wonder if there is any such thing as non-PII, given the existence of such companies.
Companies need to stop treating knowledge of this information as proof that you are who you say you are. I would have no problem publicly posting my name, social security number, birthday, mother's maiden name, etc., if not for the fact that someone can actually use this information to open a bank account or take out a loan in my name. It's ridiculous that this is all it takes in most cases.
> Companies need to stop treating knowledge of this information as proof that you are who you say you are.
If we assume that isn't happening in the very immediate future due to the latency of introducing new legislation...
Do we have any other options to protect ourselves?
I've personally worked myself in to a bad credit rating. I have a home loan and a credit card, but any new credit applications auto-reject. Not the ideal scenario though!
Re: Personal and social information of 1.2B people discovered in data leak
#310Is there any way to see what data they had on me?