Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Personal and social information of 1.2B people discovered in data leak

dataviper.io

Post reply on HN
Print view View original

391–400 of 440 posts

Re: Personal and social information of 1.2B people discovered in data leak

#391

Post by iforgotpassword »

jillesvangurp wrote: post #187
jerrac wrote: post #165

Earlier quoted context omitted.

I've been using ES off and on since before 1.0 came out. It has always baffled me that ES doesn't require a username and password by default. ES is a database that has to exist on a network to be usable. Heck, it expects that you have multiple nodes, and will complain if you don't. So one of the first things you do is expose it to the network so you can use it. Yes, it takes some serious incompetence to not realize y…

It has to exist on a private network behind a firewall with ports open to application servers and other es nodes only. Running things on a public ip address is a choice that should not be taken lightly. Clustering over the public internet is not a thing with Elasticsearch (or similar products). If you are running mysql or postgres on a public ip address it would be equally stupid and irresponsible regardless of the u…

Honestly, I as a user don't give a shit what a good engineer should so. All I see is that my personal data gets leaked left and right by elasticsearch and not mysql or postgres. But its fanbois just keep shifting blame instead of reflecting about reality and going "hey yeah maybe we should try do do something about it on our end". So fuck ES.

Re: Personal and social information of 1.2B people discovered in data leak

#392

Post by [deleted] »

CydeWeys wrote: post #349
m00x wrote: post #334

Earlier quoted context omitted.

This is ridiculous. Software should be built in the best method of delivering maximum value to its users. A trade-off for usability can be made for certain cases like ease-of-use for new software. Redis was part of this a while ago http://antirez.com/news/96 . Engineers should know their tools before using them. It's a huge part of our jobs. You could introduce a ton of other vulnerabilities in software: XSS, SQL inj…

"Software should be built in the best method of delivering maximum value to its users." Yes, and defaulting to insecure, thus repeatedly causing huge data breaches, is the exact opposite of delivering maximum value to users. It's delivering maximum liability .

[deleted]

Re: Personal and social information of 1.2B people discovered in data leak

#393

Post by drusepth »

Spooky23 wrote: post #364
skissane wrote: post #207

Earlier quoted context omitted.

My gmail is my first initial followed by my last name. There are other people on this planet with same first initial and last name, some of whom seem to think that must be their email too, because I keep on getting emails where they used it to sign up for things.

I had a lady send me a zip file that contained a VPN client, certificate and a word document with usernames and passwords to the VPN and a number of industrial control systems at the factory she was a manager of. She sent it religiously, every 90 days.

Every few months I get scans of X-rays from random clients' teeth from some dentist in South America. I've tried so many times to respond and/or unsubscribe but never hear anything back.

Re: Personal and social information of 1.2B people discovered in data leak

#396

Post by Xylakant »

lmilcin wrote: post #211
Xylakant wrote: post #170

Earlier quoted context omitted.

> Out of the box it does not even bind to a public internet address. Bind to all interfaces used to be the default in 1.x - it changed pretty much because people were footgunning themselves. Coupled with lack of security in the base/free distribution, that made for a dangerous pitfall. At least now security is finally part of the free offering, but the OSS version still comes with no access control at all.

You typically use these in pods which share networking but are not available from outside. It doesn't matter then if you bind it to 0.0.0.0.

That still puts you a single firewall mistake away from disaster. It also places a lot of trust into the applications and hosts that can access ES on a network level: They get full access with no control at all.

To add on that: No security also means no TLS, neither in the cluster communication, no TLS speaking to the client etc.

Re: Personal and social information of 1.2B people discovered in data leak

#397

Post by godelski »

chmod775 wrote: post #341
godelski wrote: post #203

Earlier quoted context omitted.

Would it be better if this was a paid service? If the issue access to the data, then maybe we should ask if this data should be collected in the first place.

> If the issue access to the data, then maybe we should ask if this data should be collected in the first place. Outlawing the collection of data would be hard and is unlikely to work, but the fact that companies like AT&T are allowed to sell your data, as they did with OP's (where else would that unused phone number come from), is an angle new legislation can use. The EU now already has a piece of legislation aimed…

I'm more thinking that not all data is equal. We really treat it like it is, at least from the public perspective (it clearly isn't from the perspective of those gathering data, but there's a clear disparity in how these groups view things). Some data is actually necessary to give up to have a well functioning internet (what browser you're using) and some data is not (canvas fingerprinting). There's a tough question here because the people making the decision of what data to be used is not us. It is the websites we visit. I would argue that there is no consent being given here and all is assumed to be "common consent" (which I'm using as a lack for better terms. Things like that if you walk out in public people can see you. But conversely, someone can't run up to you and measure your height with a tape measure). There has to be some balance here. What that is, I don't know. But really the only people that can figure that out are us computer nerds who at least kinda understand these things. We have to be having these discussions, or else it becomes "fuck silicon valley" (a conversation that is becoming national). So if we don't think about these things, then we clearly live in a bubble and bubbles burst. If we do think about these things, maybe we don't live in a bubble.

Re: Personal and social information of 1.2B people discovered in data leak

#399

Post by yoaviram »

shadowgovt wrote: post #138

It's a tragedy that all of this data was available to anyone in a public database instead of.... checks notes... available to anyone who was willing to sign up for a free account that allowed them 1,000 queries. It seems like PDL's core business model is irresponsible regarding their stewardship of the data they've harvested.

If your in Europe or California, I suggest sending both companies an erasure request: https://yourdigitalrights.org/?company=peopledatalabs.com https://yourdigitalrights.org/?company=oxydata.io

Disclaimer: I'm one of the creators of yourdigitalrights.org.

Re: Personal and social information of 1.2B people discovered in data leak

#400

Post by 867-5309 »

trymas wrote: post #263
krn wrote: post #255

Earlier quoted context omitted.

OxyData and OxyLabs seem to be sister companies[1]: the former sells data as a product, the latter sells scraping as a service. [1] https://vpnscam.com/wp-content/uploads/2018/08/2018-08-24-09...

Tesonet is true cancer. I am amazed how unethical (and successful) they are. Knowing how quickly it's expanding, do the employees are just as unethical or they do not connect the dots (company got too big)? I hate fb, et al as any other person here, but most of people know that "if it's free - you are the product". Though with NordVPN users are paying money and are getting stabbed in the back.

> NordVPN users are paying money and are getting stabbed in the back.

could you please expand on this claim?

Post reply on HN