Live data from Hacker News

Internet Archive: Security breach alert

theverge.com

371–380 of 648 posts

Re: Internet Archive: Security breach alert

#371
post #55

https://www.reddit.com/r/DataHoarder/comments/h02jl4/lets_sa... I found this reddit thread from /r/DataHoarder about backing up the internet archive particularly interesting, given the circumstances

Backup / duplication is not an easy project for sure. But meanwhile for now IA is a single organization operating under one legal system. And one technical setup, would be relevant today. That's a major weakness.

Re: Internet Archive: Security breach alert

#372

Earlier quoted context omitted.

Out of curiosity, do you use a unique email address for every single service?

Not the author but yes, I do. It’s trivially easy so why not?

Same here, only issue I’ve ever had was when my email address had the name of the company in it in the format of spamlklcompanyname@domain.com CS people are sometimes confused by that and I’ve been accused of attempting to hack them by a small shop online because of my email.

Re: Internet Archive: Security breach alert

#373

Earlier quoted context omitted.

This raises an interesting question: should email addresses be private? Addresses of buildings aren't private, and they're somewhat analogous as with many computing concepts. (Aside: Before spam filters were quite good, it was typical to avoid scraping of addresses by mild obfuscation, but I think those days are gone, and this is distinct from privacy anyway.) If someone wants to upload and never be found out, then t…

> should email addresses be private? I dunno. Should your personal phone number be private? Or your home address? Would you be okay if I knew it and shared it with a stranger? Or would you rather be asked permission to share it first? Seems pretty cut and dry to me. Yeah, there's going to be someone out there (there always is) who doesn't care, but I'd wager the majority would be pretty ticked off if you gave those p…

Interestingly, public U.S. state property records will just disclose where you live whether you like it or not. With as little as your name, a home address is trivial to find.

Re: Internet Archive: Security breach alert

#374

Earlier quoted context omitted.

Curious, how trivially easy is that?

It's quite trivial. 1. Buy a domain. About $10/year for a .com 2. Buy a /24 ipv4 block with good reputation (maybe like $10k) 3. Get a rack in a nearby datacenter, rack up a BGP-capable router and your servers for redundancy to run email. Takes about $30k initial setup costs if you buy all new, and about $5k initial setup costs if you cut corners and buy used. It'll be $2k/mo after that, so less than the cost of 1 $1…

Hold on.

Why do you need a dc rackspace and a /24 just to have your email ?

Re: Internet Archive: Security breach alert

#375

Earlier quoted context omitted.

Zero problem. I have used this exact setup with my domain for over 23 years. First, it's rare that I had to give my email over the phone or something. And in the couple of times someone raised an eyebrow, it was an opportunity to educate the person that yes, "donotspamYOURCOMPANY@" is indeed a valid address (not exactly what I use, but similar). The advantages are numerous: tracking who leaked my data (many times bef…

I recently started getting "targeted" bitcoin extortion emails that have your home address (or what they scraped from public records) and a picture of Google Street view, but they're all going to the email I used for a now-defunct online grocery

Ha, same here. Including photos of my house (well, actually my neighbor's house) and everything.

I'd be worried if 1) I hadn't seen many versions of similarly creative extortion emails over the years, and 2) if they hadn't use some obvious "donotspamCompanyThatWasHacked@mydomain".

Sadly, I can see how this may trick some people into sending money to scammers.

Re: Internet Archive: Security breach alert

#377

Just in terms of privacy, it's worth noting that anyone who has uploaded something on IA already has their email address publicly viewable. This isn't something that commonly known (even judging by comments here) but in the publicly viewable metadata of every upload it contains the uploader's IA account email address. So from a security perspective it's bad but from a privacy perspective a lot of users probably weren…

This raises an interesting question: should email addresses be private? Addresses of buildings aren't private, and they're somewhat analogous as with many computing concepts. (Aside: Before spam filters were quite good, it was typical to avoid scraping of addresses by mild obfuscation, but I think those days are gone, and this is distinct from privacy anyway.) If someone wants to upload and never be found out, then t…

An issue is for most sites/services an email has just become a standard authentication method, rather than something that can easily be more unique per account. So any usernames across sites/services that share it identify that user as being the same person (for data broker profiling, doxxing, etc), which is the privacy issue (not the email address per se, unless it perhaps contained one's real name).

For contrast truly unique email aliases for example aren't possible on common services like free Gmail*, only things like self-hosting/certain paid email hosts, which makes less feasible for many. So from a privacy perspective while in an ideal world everyone would be able to freely create entirely unique per-account creds we're mostly stuck with the email implementation.

* One could create entirely separate accounts but it's high friction and IIRC the same phone number (now a requirement) can only be used for 2-3 accounts.

Re: Internet Archive: Security breach alert

#378

Just in terms of privacy, it's worth noting that anyone who has uploaded something on IA already has their email address publicly viewable. This isn't something that commonly known (even judging by comments here) but in the publicly viewable metadata of every upload it contains the uploader's IA account email address. So from a security perspective it's bad but from a privacy perspective a lot of users probably weren…

This raises an interesting question: should email addresses be private? Addresses of buildings aren't private, and they're somewhat analogous as with many computing concepts. (Aside: Before spam filters were quite good, it was typical to avoid scraping of addresses by mild obfuscation, but I think those days are gone, and this is distinct from privacy anyway.) If someone wants to upload and never be found out, then t…

In a world where email costs ten cents to send (per receiver) email addresses need not be private. In our world? They kinda need to for sanity.

Re: Internet Archive: Security breach alert

#379

Earlier quoted context omitted.

This raises an interesting question: should email addresses be private? Addresses of buildings aren't private, and they're somewhat analogous as with many computing concepts. (Aside: Before spam filters were quite good, it was typical to avoid scraping of addresses by mild obfuscation, but I think those days are gone, and this is distinct from privacy anyway.) If someone wants to upload and never be found out, then t…

> should email addresses be private? I dunno. Should your personal phone number be private? Or your home address? Would you be okay if I knew it and shared it with a stranger? Or would you rather be asked permission to share it first? Seems pretty cut and dry to me. Yeah, there's going to be someone out there (there always is) who doesn't care, but I'd wager the majority would be pretty ticked off if you gave those p…

None of that information is actually private though. Your home address and personal phone number are likely in the public record for any number of reasons, such as ownership records or court filings. Or maybe a Facebook post from 2009 that your mom made. Unless you're one of the 0.00001% of people who do things like rotate your phone number and address annually, it's out there somewhere.

But public vs private is a spectrum, not a binary true/false. My phone number is public because I get sales calls from various companies to it. It's annoying, but bearable. But there's a big gap between that and the New York Times putting my name, number and picture on the front page.

So your home address and phone number aren't private. But they're also not readily accessible unless someone is really dedicated to finding them, so they're not quite public either.

Re: Internet Archive: Security breach alert

#380

Earlier quoted context omitted.

I see 24 seeders for the entire 72-episode run of the 1991 sitcom "Herman's Head" which was so poorly rated that it's never seen a home media or streaming release, your premise doesn't hold any water at all.

People are pirating comic books and cookbooks from the 30s; there are a lot of people in this world, if something goes on the web and you tell everyone you put it there, it's pretty much preserved. It's only law enforcement that kills free availability of everything all the time online, for better or for worse. With copyright, as individuals we get to trade all of the wonderful stuff already made (and long paid for)…

I never thought about UBI and copyright - but as soon as you say that, it is immediately obvious to me that when we have some kind of UBI, copyright should be dramatically reduced.
Post reply on HN