Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AT&T says criminals stole phone records of 'nearly all' customers in data breach

techcrunch.com

Post reply on HN
Print view View original

431–440 of 874 posts

Re: AT&T says criminals stole phone records of 'nearly all' customers in data breach

#431

Post by reaperducer »

gz5 wrote: post #319

The root cause (1) is the data store should not have been available on the underlay network. Anything connected to an underlay network is a ticking time bomb. Any servers or admins which need to talk to the data store should instead use a private overlay (2) network. Any users (likely just remote admins) should do the same. (1) Same root cause as 99% of breaches and yet it is too often swept under the rug while we fo…

Software, not private circuits

If only AT&T had some kind of way for its computers to talk to one another without going over the public internet…

Re: AT&T says criminals stole phone records of 'nearly all' customers in data breach

#432

Post by josh-sematic »

whalesalad wrote: post #421
josh-sematic wrote: post #409

Earlier quoted context omitted.

IANAL but this would seem like a “class action” situation.

can't wait to get that check in the mail for $1.32

True but personally I also wouldn’t want to go through the time and expense to sue them solo. At least in a class action the company faces some penalty that’s possibly meaningful to them (even if it’s not meaningful to most of the claimants).

Re: AT&T says criminals stole phone records of 'nearly all' customers in data breach

#433

Post by chankstein38 »

galdosdi wrote: post #194
ajsnigrutin wrote: post #96

Earlier quoted context omitted.

I never understood the american secrecy about SSN... it should be a "username" not a "password"... In my country you can calculate our own national id (mix of date of birth, autoincreasing number by each birth that day + 1 checksum number), and if you do/have any kind of personal business, your personal tax number has to be written everywhere, on every receipt you hand out or anything you buy as a business. Somehow k…

> Somehow knowing that first boy born today will have an ID number of 120702450001X It's even worse. Only post-2011 IIRC births have an algoirthmic SSN. So everyone over the age of 13 still has old fashioned sequential SSNs, where XXX-YY-ZZZZ is determined by 1) XXX is the code for the office that issues your card. Can be guessed precisely and accurately by knowing birth location. For example, I can guess what region…

When I was in school (almost 20 years ago) this came up because someone mentioned the first 6 digits of their SSN and they matched mine. Since then it's similarly bothered the hell out of me that the practice is to mask all but the last 4 of the SSN and that a lot of places require you to enter your last 4 of your SSN.

I didn't know the reasons for the matches but them being my age and likely born in the same place as me made me realize those were identifiers and the last 4 were the unique bit.

Re: AT&T says criminals stole phone records of 'nearly all' customers in data breach

#434

Post by james_marks »

galdosdi wrote: post #178
ajsnigrutin wrote: post #96

Earlier quoted context omitted.

I never understood the american secrecy about SSN... it should be a "username" not a "password"... In my country you can calculate our own national id (mix of date of birth, autoincreasing number by each birth that day + 1 checksum number), and if you do/have any kind of personal business, your personal tax number has to be written everywhere, on every receipt you hand out or anything you buy as a business. Somehow k…

It's because it happened gradually / naturally / semi un intentionally, because: 1) SSN was not intended as a national ID, but it so happened to fit the shape of one, in that almost everyone has one and they're unique. 2) It has never been possible to institute an intentional national ID system in the US for political reasons That is the recipe for the problem we have now. Strong demand for a national ID from many bu…

Also NAL, but watch out for how this is reported to states. California is currently $800/year min, even if the entity has no activity.

Re: AT&T says criminals stole phone records of 'nearly all' customers in data breach

#436

Post by 5555624 »

nostrademons wrote: post #336
5555624 wrote: post #236

Earlier quoted context omitted.

> 1) XXX is the code for the office that issues your card. Can be guessed precisely and accurately by knowing birth location. While the first sentence is true, the second is only true if you were born after the mid-1980s, when a Reagan-era tax reform was enacted. (It required a SSN when claiming dependents.) Prior to that, most people did not get a SSN until they got a job.

I looked this up and while your first sentence is true, the second (non-parenthetical) sentence is only true if you did not require any of the other services that required a SSN. There's a list of those under "Exhibit 2" (about 2/3 of the way down the page) on the SSA's website: https://www.ssa.gov/policy/docs/ssb/v69n2/v69n2p55.html tl;dr: If you had a bank account, applied for a federal benefit, were on food stamps…

I stand corrected. Thanks. I didn't bother to look it up, since I'm old and got mine when I started working. Although people born 1968-1981 were getting SSNs where they currently lived, which is not necessarily where they were born; which was the original point.

Re: AT&T says criminals stole phone records of 'nearly all' customers in data breach

#437

Post by [deleted] »

gz5 wrote: post #319

The root cause (1) is the data store should not have been available on the underlay network. Anything connected to an underlay network is a ticking time bomb. Any servers or admins which need to talk to the data store should instead use a private overlay (2) network. Any users (likely just remote admins) should do the same. (1) Same root cause as 99% of breaches and yet it is too often swept under the rug while we fo…

[deleted]

Re: AT&T says criminals stole phone records of 'nearly all' customers in data breach

#438

Post by gz5 »

mbreese wrote: post #422
wmf wrote: post #414

Earlier quoted context omitted.

OP is using weird terminology. It would probably be clearer to say "Anything connected to the Internet is a ticking time bomb. Any servers or admins which need to talk to the database should instead use a VPN." which indeed was best practice until recently.

> indeed was best practice until recently But we should remember why it's not always considered best practices... you shouldn't assume that your private network is any more secure than the public network. When you have too many devices attached to that private (overlay?) network, it can be at just as much risk as if it was on the public internet. So, the zero-trust model is that you don't trust anything... public...…

yep was trying to avoid word which carry varying connotations, e.g. vpn or zero trust.

zero implicit trust is likely the best term? you have to trust something, but enforce (and therefore trust) strong (not network based) identity, authN and authZ. this can be done anywhere via a software-only overlay.

a litmus test is server iptables (to use an example) looks like: iptables -P INPUT DROP iptables -P FORWARD DROP

and the only route outbound from the server is to the private overlay on one port, and that server still can't make those connections unless it is strongly identified and authenticated, and the overlay will not connect the client and server unless they are both authorized to communicate for that particular service(1)

(1)so for example if there is a zero day causing the 'server' to try to communicate with some_IP then the private overlay will not accept the connection, even though it is coming from the server

Re: AT&T says criminals stole phone records of 'nearly all' customers in data breach

#439

Post by whalesalad »

reaperducer wrote: post #428
whalesalad wrote: post #421

Earlier quoted context omitted.

can't wait to get that check in the mail for $1.32

I got a check in the mail last week for 12¢ from Google hoovering up my data. Yes, that's twelve cents! Google certainly made more off of my data than that.

costs more to mail a letter

Re: AT&T says criminals stole phone records of 'nearly all' customers in data breach

#440

Post by pcblues »

whyenot wrote: post #416

AT&T has 110 million customers. Let's be optimistic and assume that each customer only has to spend one minute of extra time managing their account due to the break-in. That is more than 209 years of lost time. Laws related to data breaches need to have much sharper teeth. Companies are going to do the bare minimum when it comes to securing data as long as breaches have almost no real consequences. Maybe pierce the c…

Personal data cannot be secured. The only way is to not store it. That will (imaginationaly) cost companies in lost revenue for being unable to mine and sell it. Only government can make laws against a company taking your personal information and selling it. Even passwords shouldn't be stored by a company.

The years of lost time argument is disingenuous. Over that number of people, 209 years of lost time from 700 million years of lives is nothing.

Post reply on HN