Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Personal and social information of 1.2B people discovered in data leak

dataviper.io

Post reply on HN
Print view View original

341–350 of 440 posts

Re: Personal and social information of 1.2B people discovered in data leak

#341

Post by chmod775 »

godelski wrote: post #203
shadowgovt wrote: post #138

It's a tragedy that all of this data was available to anyone in a public database instead of.... checks notes... available to anyone who was willing to sign up for a free account that allowed them 1,000 queries. It seems like PDL's core business model is irresponsible regarding their stewardship of the data they've harvested.

Would it be better if this was a paid service? If the issue access to the data, then maybe we should ask if this data should be collected in the first place.

> If the issue access to the data, then maybe we should ask if this data should be collected in the first place.

Outlawing the collection of data would be hard and is unlikely to work, but the fact that companies like AT&T are allowed to sell your data, as they did with OP's (where else would that unused phone number come from), is an angle new legislation can use.

The EU now already has a piece of legislation aimed at stifling these practices. The US and other economies just need to follow suit.

Re: Personal and social information of 1.2B people discovered in data leak

#342

Post by Scoundreller »

deusofnull wrote: post #306
Scoundreller wrote: post #66

Earlier quoted context omitted.

Easier to just send them your own template on paper instead of using theirs. It should be like a doctor’s prescription in a lot of places: as long as it’s on paper and has the right elements, it’s valid.

Well then thats the trick. A legal research team that develops the form for as many sites as you could find, and then a mechanism to send that form filled with each users data to those sites.

Like, what more do they need than disambiguating identity info and a declaration that I'm opting out? E.g. name and DOB?

My only fear is that you're now sending this all to them, but in 2019, we can safely say your name+DOB+address isn't a secret. Or national identity number if that's a thing in your jurisdiction.

It's the metadata around it we want wiped out.

Re: Personal and social information of 1.2B people discovered in data leak

#343

Post by wildmusings »

YawningAngel wrote: post #313
GhettoMaestro wrote: post #273

Earlier quoted context omitted.

> At some point you just have to call out people for being utter morons. The blame is on them, 100%. [...] Your attitude is a symptom of a broader issue that plagues this industry: Indifference to risk*probability. If you don't ship software with "secure defaults" (depending on the threat/attack model), you essentially are handing out loaded shotguns, then blaming the "dumb" user when they inevitably point it at thei…

Is it a secondary concern, though? As a startup, uptake is as vital as oxygen

Tort law is going to catch up to software soon enough and people will be held accountable for negligently creating or deploying software that they should have known would cause harm.

The fact that someone else down the chain should have known better is not a perfect defense. If that misuse was foreseeable and you didn’t do enough to prevent or discourage it, then you can still be held liable.

Re: Personal and social information of 1.2B people discovered in data leak

#344

Post by arcticfox »

isoos wrote: post #271
kaivi wrote: post #85

Earlier quoted context omitted.

I've crawled a popular social network on a large scale, currently doing the same for dating services as a hobby. God, wish I'd still got paid for webscraping. Here are some tricks which may or may not work today: - Have an app where user logs in through said website, then scrape their friends using this user's token. That way you get exponential leverage on the number of API calls you can make, with just a handful of…

> Don't be too kind on the big websites. I usually recommend latency-based dynamic load control for that. Once the website starts to reply 500-1000ms longer than the average one-thread latency, it is time to take a bit of it back. It is also a co-operative strategy between fellow scrapers, even if they don't know about the other ones pushing larger load on the servers.

1000ms is a massive slowdown when revenue-noticeable impacts are far, far smaller. I don't know the legality, but hitting a site hard enough to cause 1000ms slowdowns seems like it's approaching DOS legality issues.

Re: Personal and social information of 1.2B people discovered in data leak

#345

Post by Mirioron »

toxicFork wrote: post #317
vermilingua wrote: post #312

Earlier quoted context omitted.

https://gist.github.com/joepie91/5a9909939e6ce7d09e29

Ah... but that is very inconvenient :( I guess comfort comes at a cost. Is there at least a less shady provider if I would like to compromise myself but a bit less than nordvpn? How far do we go in assuming all are bad?

You could set up your own VPN on a server you run.

Re: Personal and social information of 1.2B people discovered in data leak

#346

Post by tomc1985 »

kchamplewski wrote: post #151
tomc1985 wrote: post #137

Earlier quoted context omitted.

The use case is in a local datacenter, with a NAT-ed IP not exposed to the main web

A firewalled IP would be much more appropriate, and NAT is not a firewall or a security mechanism.

Same thing, more-or-less. And NAT is effectively a firewall for inbound traffic, even if a lot of people say it isn't.

Re: Personal and social information of 1.2B people discovered in data leak

#347

Post by Scoundreller »

codetrotter wrote: post #340
jillesvangurp wrote: post #155

I was at an Elasticsearch meetup yesterday where we had a good laugh about several similar scandals in Germany recently involving completely unprotected Elasticsearch running on a public IP address without a firewall (e.g. https://www.golem.de/news/elasticsearch-datenleak-bei-conrad... , in German). This beats any of that. Out of the box it does not even bind to a public internet address. Somebody configured this to…

> It's indeed really easy to setup. But setting it up properly still requires RTFMing, dismissing the warning above I would bet that in a lot of cases, people that configure their servers like in the OP just don’t read the official docs at all. Stack Overflow, Quora, etc. are great places to get answers, because of the huge amount of questions that have already been asked and answered there. But when people rely sole…

My favourite was Bitomat.pl's loss of 17k bitcoins in 2011 because they restarted their EC2 instance.

I understand that the "ephemeral" nature of EC2 was in the documentation, but ESL speakers may have glossed over the significance of a word they didn't fully comprehend.

https://siliconangle.com/2011/08/01/third-largest-bitcoin-ex...

Re: Personal and social information of 1.2B people discovered in data leak

#348

Post by blondin »

jillesvangurp wrote: post #187
jerrac wrote: post #165

Earlier quoted context omitted.

I've been using ES off and on since before 1.0 came out. It has always baffled me that ES doesn't require a username and password by default. ES is a database that has to exist on a network to be usable. Heck, it expects that you have multiple nodes, and will complain if you don't. So one of the first things you do is expose it to the network so you can use it. Yes, it takes some serious incompetence to not realize y…

It has to exist on a private network behind a firewall with ports open to application servers and other es nodes only. Running things on a public ip address is a choice that should not be taken lightly. Clustering over the public internet is not a thing with Elasticsearch (or similar products). If you are running mysql or postgres on a public ip address it would be equally stupid and irresponsible regardless of the u…

i agree with GP here. ES is to blame here. not long ago apache airflow had a similar vulnerability discovered about not having sensible authentication defaults. the reasoning on their mailing list was eerily similar to those defending ES here. same arguments (iirc)

history is our greatest teacher. i think ES will end up doing what that team did: they agreed to provide sensible & secure defaults.

Re: Personal and social information of 1.2B people discovered in data leak

#349

Post by CydeWeys »

m00x wrote: post #334
z3t4 wrote: post #275

Earlier quoted context omitted.

Software should be secure by default. Don't blame the user. mySQL in comparison wont even let you install without setting a root password. And it only listen on localhost/unix-socket by default. Then you need to explicitly add another user if you want to allow it to login from a non local ip. I don't think it's even possible - to both set a blank root password and allow it to login from a public IP. So you really thi…

This is ridiculous. Software should be built in the best method of delivering maximum value to its users. A trade-off for usability can be made for certain cases like ease-of-use for new software. Redis was part of this a while ago http://antirez.com/news/96 . Engineers should know their tools before using them. It's a huge part of our jobs. You could introduce a ton of other vulnerabilities in software: XSS, SQL inj…

"Software should be built in the best method of delivering maximum value to its users."

Yes, and defaulting to insecure, thus repeatedly causing huge data breaches, is the exact opposite of delivering maximum value to users. It's delivering maximum liability.

Re: Personal and social information of 1.2B people discovered in data leak

#350

Post by sedachv »

jillesvangurp wrote: post #187
jerrac wrote: post #165

Earlier quoted context omitted.

I've been using ES off and on since before 1.0 came out. It has always baffled me that ES doesn't require a username and password by default. ES is a database that has to exist on a network to be usable. Heck, it expects that you have multiple nodes, and will complain if you don't. So one of the first things you do is expose it to the network so you can use it. Yes, it takes some serious incompetence to not realize y…

It has to exist on a private network behind a firewall with ports open to application servers and other es nodes only. Running things on a public ip address is a choice that should not be taken lightly. Clustering over the public internet is not a thing with Elasticsearch (or similar products). If you are running mysql or postgres on a public ip address it would be equally stupid and irresponsible regardless of the u…

> It has to exist on a private network behind a firewall with ports open to application servers and other es nodes only.

Have you ever heard of the end-to-end principle, IPv6, or number 4 of the eight fallacies? http://nighthacks.com/jag/res/Fallacies.html

Post reply on HN