AT&T says criminals stole phone records of 'nearly all' customers in data breach • Hacker News Board

Re: AT&T says criminals stole phone records of 'nearly all' customers in data breach

#621

Post by oxide » Sat, Jul 13, 2024, 2:16 AM UTC

Calvin02 wrote: post #597

trompetenaccoun wrote: post #575

Earlier quoted context omitted.

It surprises me that there isn't a single comment pointing out that corporations like AT&T don't collect all that data for fun. This actually costs them a lot of money, but they're legally required by the government. While everyone is blaming the company, did you not take a second and contemplate how weird it is that you're fine with the government (and now everyone else es well) getting a record of all your phone ac…

Banks are required to maintain financial transaction records. Is the argument that governments don't have a good reason to mandate record collection? Why can't I ask my government to keep me safe from terrorists but also expect that companies will not just be careless with the data they collect as part of that?

I agree. I think it's reasonable to expect companies to safeguard that information from malicious actors.

Re: AT&T says criminals stole phone records of 'nearly all' customers in data breach

#622

Post by feedmetrash » Sat, Jul 13, 2024, 2:18 AM UTC

Calvin02 wrote: post #597

trompetenaccoun wrote: post #575

Earlier quoted context omitted.

It surprises me that there isn't a single comment pointing out that corporations like AT&T don't collect all that data for fun. This actually costs them a lot of money, but they're legally required by the government. While everyone is blaming the company, did you not take a second and contemplate how weird it is that you're fine with the government (and now everyone else es well) getting a record of all your phone ac…

Banks are required to maintain financial transaction records. Is the argument that governments don't have a good reason to mandate record collection? Why can't I ask my government to keep me safe from terrorists but also expect that companies will not just be careless with the data they collect as part of that?

[dead]

Re: AT&T says criminals stole phone records of 'nearly all' customers in data breach

#623

Post by kragen » Sat, Jul 13, 2024, 2:20 AM UTC

wow, a spy agency acquired the entire social network graph of the usa in one intrusion. that's bad news for civil defense; it means they have a good guess at who is the favorite relative of each legislator, governor, police chief, or general. and where they can habitually be found at each hour of the week, since this leak included location data!

how can we keep such accumulations of sensitive data from arising in the first place? only countries that figure it out are likely to survive the turbulent coming decades

Re: AT&T says criminals stole phone records of 'nearly all' customers in data breach

#624

Post by SoftTalker » Sat, Jul 13, 2024, 2:22 AM UTC

oxide wrote: post #621

Calvin02 wrote: post #597

Earlier quoted context omitted.

Banks are required to maintain financial transaction records. Is the argument that governments don't have a good reason to mandate record collection? Why can't I ask my government to keep me safe from terrorists but also expect that companies will not just be careless with the data they collect as part of that?

I agree. I think it's reasonable to expect companies to safeguard that information from malicious actors.

I don't agree. I don't think it's reasonable to expect it, because companies show over and over that they cannot do it. And let's face it, the only reason your company hasn't fallen victim to a data breach or ransomware is that you haven't been seriously targeted yet.

We need to change our approach. We need to look at why these kinds of data are valuable, and then make them not valuable. Then nobody will bother with hacking to get it.

Re: AT&T says criminals stole phone records of 'nearly all' customers in data breach

#625

Post by kragen » Sat, Jul 13, 2024, 2:25 AM UTC

erikaww wrote: post #516

abdullahkhalids wrote: post #492

Earlier quoted context omitted.

The correct way is to follow what all other engineering and trade (medicine/law) already follow. Some software engineers are licensed. A company must hire these software engineers, and any changes to what data is saved or how is saved must be signed by these engineers. If a breach occurs, an investigation occurs and if these licensed software engineers are found to be negligent, they lose their license. If they are f…

If AT&T had spent more on security, this would not have happened. I absolutely do not believe individual engineers should be held liable.

how do you know? maybe they were spending too much on security, but it was going to useless or counterproductive measures like crowdstrike, compliance training, or virus scanners. money is no substitute for competence, as steve jobs's death shows

Re: AT&T says criminals stole phone records of 'nearly all' customers in data breach

#626

Post by kbolino » Sat, Jul 13, 2024, 2:27 AM UTC

Calvin02 wrote: post #597

trompetenaccoun wrote: post #575

Earlier quoted context omitted.

It surprises me that there isn't a single comment pointing out that corporations like AT&T don't collect all that data for fun. This actually costs them a lot of money, but they're legally required by the government. While everyone is blaming the company, did you not take a second and contemplate how weird it is that you're fine with the government (and now everyone else es well) getting a record of all your phone ac…

Banks are required to maintain financial transaction records. Is the argument that governments don't have a good reason to mandate record collection? Why can't I ask my government to keep me safe from terrorists but also expect that companies will not just be careless with the data they collect as part of that?

The government can't keep its own data safe, as the OPM breach showed. Apart from some resignations, nobody faced any serious consequences for that either.

Re: AT&T says criminals stole phone records of 'nearly all' customers in data breach

#627

Post by kragen » Sat, Jul 13, 2024, 2:27 AM UTC

gaze wrote: post #534

whyenot wrote: post #416

AT&T has 110 million customers. Let's be optimistic and assume that each customer only has to spend one minute of extra time managing their account due to the break-in. That is more than 209 years of lost time. Laws related to data breaches need to have much sharper teeth. Companies are going to do the bare minimum when it comes to securing data as long as breaches have almost no real consequences. Maybe pierce the c…

Everyone says what needs to happen. Every thread has this same exact post. We all know what needs to happen. How _would_ this ever happen? This is a board of innovators -- innovate!

we all know this does not need to happen, if 'we' are people familiar with the quality of software in already-regulated environments

Re: AT&T says criminals stole phone records of 'nearly all' customers in data breach

#628

Post by brewdad » Sat, Jul 13, 2024, 2:28 AM UTC

hluska wrote: post #610

abdullahkhalids wrote: post #492

Earlier quoted context omitted.

The correct way is to follow what all other engineering and trade (medicine/law) already follow. Some software engineers are licensed. A company must hire these software engineers, and any changes to what data is saved or how is saved must be signed by these engineers. If a breach occurs, an investigation occurs and if these licensed software engineers are found to be negligent, they lose their license. If they are f…

You want a P.Eng (or equivalent) to sign off on anything that involves data? That won’t solve the problem but will dramatically slow down the pace of innovation. And all the while, it will funnel money further into regulated professions instead of into actually securing software. This is precisely how we end up in a world where we’re all running twenty five year old software.

> This is precisely how we end up in a world where we’re all running twenty five year old software.

Linux?

Re: AT&T says criminals stole phone records of 'nearly all' customers in data breach

#629

Post by EasyMark » Sat, Jul 13, 2024, 2:29 AM UTC

kragen wrote: post #623

wow, a spy agency acquired the entire social network graph of the usa in one intrusion. that's bad news for civil defense; it means they have a good guess at who is the favorite relative of each legislator, governor, police chief, or general. and where they can habitually be found at each hour of the week, since this leak included location data! how can we keep such accumulations of sensitive data from arising in the…

How do you know it was a spy agency? Sounded like just a hacker group. I assume 5 eyes are the only ones who have this already anyway as a matter of course. All they have to do is buy it from AT&T, no hacking necessary.

Re: AT&T says criminals stole phone records of 'nearly all' customers in data breach

#630

Post by simfree » Sat, Jul 13, 2024, 2:31 AM UTC

SoftTalker wrote: post #624

oxide wrote: post #621

Earlier quoted context omitted.

I agree. I think it's reasonable to expect companies to safeguard that information from malicious actors.

I don't agree. I don't think it's reasonable to expect it, because companies show over and over that they cannot do it. And let's face it, the only reason your company hasn't fallen victim to a data breach or ransomware is that you haven't been seriously targeted yet. We need to change our approach. We need to look at why these kinds of data are valuable, and then make them not valuable. Then nobody will bother with…

This data is valuable primarily for spam mitigation and perhaps customer profiling.

Expect every SMS and MMS sent or received to be part of a spam mitigation and profiling program where it's stored indefinitely.

Apple not encrypting RCS is likely due to similar factors, where they have seen existing spam problems on RCS that are much harder to root out when you have end-to-end encryption.