Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

1k Data Breaches Later, the Disclosure Lag Is Worse

troyhunt.com

Post reply on HN
Print view View original

81–90 of 133 posts

Re: 1k Data Breaches Later, the Disclosure Lag Is Worse

#81

Post by alexfoo »

bruce343434 wrote: post #30
kleiba2 wrote: post #19

For years, I've been trying my best to stay low-key when it comes to my personal information on the internet. I don't create new accounts, I never cross-login with my email address, I don't use phones. Certainly not perfect, but a lot of times I'm preferring privacy over convenience. At the same time, my government and society at large is pushing more and more for "digital everything". It's great when it works. But t…

The issue is how easy computers make everything, and how well processes scale with computers. Back in the day to heist data you'd have to physically break in or infiltrate, rummage through files, copy them somehow or just straight up take them. In a briefcase?? How many files can you exfiltrate per day like that? But on a database it's practically a matter of running a copy command and uploading it or exfiltrating it…

It all comes down to where the boundary for data access is implemented, and how strictly.

If your webapp has unfettered database access then don't be surprised if it is hacked and someone can do `select * from users` and then posts that dump somewhere.

The attack surface changes if your webapp can only do a REST call to pull a single user record at a time. That way you can put some auditing in, you can put rate limiting in to detect that, etc.

Obviously the user record REST api endpoint is still vulnerable, but it's a much smaller attack surface, easier to audit, and can be monitored a lot more closely.

Yes, ultimately, there will still be a set of vulnerable humans that have access to the database servers themselves and they can always walk out of the place with an SD card hidden in a Rubik's cube but there has to be an element of trust somewhere.

The problem is that too many people put that trust boundary way too far out into the big bad Internet. Or don't even consider it at all and just rely on the fact that other targets are more appealing.

Re: 1k Data Breaches Later, the Disclosure Lag Is Worse

#82

Post by trumpdong »

ItsBob wrote: post #58
no-name-here wrote: post #38

Earlier quoted context omitted.

Why does the app need to store the google/apple Id? Because it stores the data in the cloud, instead of locally for the app to use?

It's for your login and payments. I need to verify that you are authenticated somehow and Google/Apple also handle payments. You "Login with Apple" or "Login with Google". They manage the login entirely and pass me your id and an access token (assuming you pass their login test). I store that in my DB so that your data from the app can sync (the paid-for app syncs your training data to my backend but I match it only…

If I'm using an app I'm very skeptical of "Login with Google" because I have no way to verify that you're only getting a random identifier and not my email address. I prefer to sign up with a proxy email address.

Re: 1k Data Breaches Later, the Disclosure Lag Is Worse

#83

Post by trumpdong »

bcye wrote: post #48
c0balt wrote: post #11

Earlier quoted context omitted.

A minor problem with GDPR is enforcement. At least in germany it feels like you need a very dedicated and persistent person to make the case against a company/service (bonus points if they get media attention). Other countries are a bit better but it generally is not very consistent. The enforcement for most small to mid-sized companies is often just not present and resources for relevant agencies are often only relu…

At least there is the very dedicated and persistent https://noyb.eu :)

See how many of their cases have been dragging on since almost the beginning of GDPR.

Re: 1k Data Breaches Later, the Disclosure Lag Is Worse

#84

Post by ItsBob »

trumpdong wrote: post #82
ItsBob wrote: post #58

Earlier quoted context omitted.

It's for your login and payments. I need to verify that you are authenticated somehow and Google/Apple also handle payments. You "Login with Apple" or "Login with Google". They manage the login entirely and pass me your id and an access token (assuming you pass their login test). I store that in my DB so that your data from the app can sync (the paid-for app syncs your training data to my backend but I match it only…

If I'm using an app I'm very skeptical of "Login with Google" because I have no way to verify that you're only getting a random identifier and not my email address. I prefer to sign up with a proxy email address.

It's built into Android/iOS and an accepted way of logging into an app. The app store page (when it's released) shows exactly what I need: practically no information at all.

Google handle the payment and the subscription too (same with Apple) and that's a very common pattern too.

I understand the skepticism though.

Re: 1k Data Breaches Later, the Disclosure Lag Is Worse

#85

Post by cfiggers »

dubcanada wrote: post #76
cfiggers wrote: post #71

So at the risk of sounding incredibly apathetic toward something that I'm sure is probably a massive headache for some people somewhere... I'm a millennial and I've been told probably hundreds of times by this point in my life that my data has been breached. Not a single one of those times was there a) anything truly actionable for me to do about it[0] or b) a single negative impact to my actual life. In anyway. At a…

Because nothing bad happened to you, therefore nothing bad happens?

I see your reductio ad absurdum and counter you with its exact inverse:

Because something bad has happened at some point to someone somewhere, you personally must take precautions against it happening to you?

Do you intend to modify your behavior, spending habits, or thought patterns to reduce the risk of catching mad cow disease? Oh, no? So you're saying mad cow disease doesn't exist?

But mad cow disease has a documented casualty count and data breaches do not. So actually, you're being irrational if you care about and take measures to mitigate the one but not the other.

Now that we've established that you are rationally obligated to mitigate the risk of mad cow disease, I have some guaranteed Definitely Not Placebo[^TM]-brand pills to sell you.

---

If you find this counterargument spurious, absurd, or unfair, then I have a proposal for you: let's both agree that reduction to absurdity benefits no one, and try to talk reasonably in the middle ground between extremes.

Re: 1k Data Breaches Later, the Disclosure Lag Is Worse

#86

Post by kavok »

kleiba2 wrote: post #19

For years, I've been trying my best to stay low-key when it comes to my personal information on the internet. I don't create new accounts, I never cross-login with my email address, I don't use phones. Certainly not perfect, but a lot of times I'm preferring privacy over convenience. At the same time, my government and society at large is pushing more and more for "digital everything". It's great when it works. But t…

We need to attach actual monetary amounts to PII. If a company loses the data they owe you that money. The money is increased based on how and if they disclosed the leak. Lying about a leak should be a criminal offense.

This would would allow engineers to better be able to prioritize security, which typically gets ignored or put low in priority.

Re: 1k Data Breaches Later, the Disclosure Lag Is Worse

#87

Post by mrln »

kavok wrote: post #86
kleiba2 wrote: post #19

For years, I've been trying my best to stay low-key when it comes to my personal information on the internet. I don't create new accounts, I never cross-login with my email address, I don't use phones. Certainly not perfect, but a lot of times I'm preferring privacy over convenience. At the same time, my government and society at large is pushing more and more for "digital everything". It's great when it works. But t…

We need to attach actual monetary amounts to PII. If a company loses the data they owe you that money. The money is increased based on how and if they disclosed the leak. Lying about a leak should be a criminal offense. This would would allow engineers to better be able to prioritize security, which typically gets ignored or put low in priority.

Wow, I've not heard this idea before and I think it is very interesting! How would you set this amount though? Does the company/user/government set it? Would the same data have different amounts depending on the company? How would that system handle users with multiple accounts?

Re: 1k Data Breaches Later, the Disclosure Lag Is Worse

#88

Post by cfiggers »

BoxFour wrote: post #75
cfiggers wrote: post #71

So at the risk of sounding incredibly apathetic toward something that I'm sure is probably a massive headache for some people somewhere... I'm a millennial and I've been told probably hundreds of times by this point in my life that my data has been breached. Not a single one of those times was there a) anything truly actionable for me to do about it[0] or b) a single negative impact to my actual life. In anyway. At a…

I feel you're correct, and it's why it's a losing battle. It's a spectrum of consequences. The worst outcomes are serious but rare. For most people the most severe outcome they'll deal with are unauthorized credit card charges, which are an annoyance at worst. The most severe consequences just aren't common enough to elicit any kind of change, and even when they are the response is about cleaning up the damage instea…

If we conceive of civilization as being like a biological system, then perhaps there are certain maladies that just are not worth dedicating resources to. Cells die all the time, of a trillion different causes. Few are worth rewriting an immune system for.

If the most severe consequences of this pattern are sufficiently uncommon—uncommon enough that even by your own admission the system as a whole fails to notice them, much less feel any pain over it—then maybe it's a waste of the organism's resources to attempt a systemic resolution. Maybe the "losing battle" as you call it is not with individual organizations or even with broader data security culture per se. It might not even be with the legal system to finally inflict some, any consequence on anyone for letting this repeatedly happen. Perhaps the battle we're losing is, at some deeper level, with the very physics of civilizational energy distribution and consumption, aka, with societal entropy. In which case... Yeah, that battle seems pretty heckin' losing to me. Good thing identity theft only seems to happen to "other people."

I know this argument is going to ring pretty hollow and the irony will bite me pretty hard if I get my SSN highjacked literally tomorrow. Which, thanks to Equifax in 2017, could theoretically happen any minute now! Just like it could've happened any minute now for the last 9 years!

But then again, even if and just because I suddenly personally care a lot more about this issue because I'm suddenly affected by it, that doesn't obligate you or anyone else to feel the same way.

A certain kind of indifference toward the suffering of others might be civilizationally efficient. In which case it might be absurd and maybe even ethically problematic to care in aggregate any more than we happen to do.

Literally, who's to say?

Re: 1k Data Breaches Later, the Disclosure Lag Is Worse

#89

Post by cfiggers »

cfiggers wrote: post #88
BoxFour wrote: post #75

Earlier quoted context omitted.

I feel you're correct, and it's why it's a losing battle. It's a spectrum of consequences. The worst outcomes are serious but rare. For most people the most severe outcome they'll deal with are unauthorized credit card charges, which are an annoyance at worst. The most severe consequences just aren't common enough to elicit any kind of change, and even when they are the response is about cleaning up the damage instea…

If we conceive of civilization as being like a biological system, then perhaps there are certain maladies that just are not worth dedicating resources to. Cells die all the time, of a trillion different causes. Few are worth rewriting an immune system for. If the most severe consequences of this pattern are sufficiently uncommon—uncommon enough that even by your own admission the system as a whole fails to notice the…

(Just for anyone who struggles with reading comprehension: I'm being incredibly sarcastic here. I think it sucks enormously that we broadly ignore the plight of the few just because most people skate by fine. My top level post is also intended satirically. I do care about this stuff and hate that on balance big companies do not. I'm shouting my protest into the void in the form of irony-laced nihilism, aka, the song of my people, aka, burned-out and disenfranchised millenials tired of hoping for the better world we came up believing would some day exist.)

Re: 1k Data Breaches Later, the Disclosure Lag Is Worse

#90

Post by thewebguyd »

cfiggers wrote: post #71

So at the risk of sounding incredibly apathetic toward something that I'm sure is probably a massive headache for some people somewhere... I'm a millennial and I've been told probably hundreds of times by this point in my life that my data has been breached. Not a single one of those times was there a) anything truly actionable for me to do about it[0] or b) a single negative impact to my actual life. In anyway. At a…

> I use a password manager to guarantee that I'm not sharing passwords between logins

This already makes your digital hygiene better than at least 70% of the population if not more. I don't have the link off the top of my head but I vaguely recall some survey or article put out by bitwarden that nearly 70% of folks re-use the same password for everything.

A surprising number of those little services do store passwords in plain text, and that's where the risk comes from. So you're right, you and anyone else remotely tech savvy that is smart enough to not re-use passwords is unlikely to face any real hardship over a data breach, but the rest of the population that puts in the same email and re-uses "password123" across every service gets into trouble.

As for anecdata about the hairdresser's cousin - my wife, before I met her, had nearly all of main online services compromised from a plain text password data breach because she also re-used the same email & pass everywhere. Netflix, spotify, her email, and amazon account all taken over and did have fraudulent purchases as a result. Now she has 2FA on everything and uses a password manager :) So I don't doubt that there are real people that suffer financial consequences from data breaches due to poor password hygiene.

Even knowing all of that though, I'd still put phishing as a much bigger threat than most data breaches.

Post reply on HN