Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Personal and social information of 1.2B people discovered in data leak

dataviper.io

Post reply on HN
Print view View original

91–100 of 440 posts

Re: Personal and social information of 1.2B people discovered in data leak

#91

Post by farisjarrah »

bonestamp2 wrote: post #55
shantly wrote: post #45

Earlier quoted context omitted.

At this point practically everything about me's available either for free or a few dollars. The only interesting thing left is whether a given password has been compromised. The answer to everything else is "yes, it's been leaked". Been that way for most of a decade at this point, guessing it's the same for most other folks with any modern digital or banking presence whatsoever.

I'm sure there are search engines for it too but I noticed that credit karma can tell you which of your passwords have been associated with your email addresses in data breaches. Credit Karma is free but the CEO appears to be transparent in how they make money (recommending financial products to you based on what they see in your credit profile).

I am a very suspicious and wary internet user, hardly sign up for any services, but been using Credit Karma for my taxes and light financial monitoring for the last 3 years. Tax Filing was totally free and I got the tax refunds I was expecting. No issues with them whatsoever. I have never gotten any email or other spam as a result of using their service. I am a happy customer, though technically speaking I have never actually given them any money directly.

Re: Personal and social information of 1.2B people discovered in data leak

#92

Post by lucb1e »

Scoundreller wrote: post #43
kerng wrote: post #22

Seems like the ball is with Google at the moment, the exposed data is on their GCP servers. So, they can figure out next steps.

Imagine the equivalent in another industry: “Hello, Bank of America? There’s an ATM machine of yours that’s spitting out cocaine. Yes, I understand that it’s probably not your cocaine and that’s not your business, but don’t you think you should maybe shut it down?”

But would you call VendingMachinesCo because there is a vending machine outside the local supermarket, operated by said supermarket, that spits out cocaine? Pretty sure that whatever you put in there is the machine owner's responsibility, not the manufacturer. GCP does not put content in their VPSes themselves the way that a bank operates an ATM.

I think it's more like the responsibility of an ISP to poke their noses in what they transfer, since it might be illegal content (similar to whether Google should poke their noses into people's VPSes). I'm not sure if we should want to require them to do that.

Re: Personal and social information of 1.2B people discovered in data leak

#93

Post by sbarre »

calibas wrote: post #86
Matsta wrote: post #65

Earlier quoted context omitted.

LinkedIn Sales Navigator is a paid tool which allows you to search their whole database. Then depending on how much you pay you can get all their personal details (Email address, phone number, even their address sometimes.) https://business.linkedin.com/sales-solutions/sales-navigato...

I've always been a little confused how this works. If I got all that info for free, it's a "data leak", but if I pay to get the same detailed personal information it's... In either case my personal data is given away without my consent, but there's this implication that it's only an issue when someone doesn't pay for it.

> In either case my personal data is given away without my consent

You gave that consent when you put your info in Linkedin in the first place, according to their ToS.

Re: Personal and social information of 1.2B people discovered in data leak

#94

Post by narrator »

This is why I lie about my birthdate by a couple of days on anything where it's not something like a medical record or where I am required to tell the truth for whatever reason. I also never provide my social security number unless it is required by law.

Re: Personal and social information of 1.2B people discovered in data leak

#95

Post by Abishek_Muthian »

Matsta wrote: post #65
Havoc wrote: post #17

Out of curiosity how do you guys think they managed to scrape LinkedIn on such a large scale? I've been wanting to do some social graph experimentation on it (small scale - say 1000 people near me) but concluded I probably couldn't scrape enough via raw scraping without freaking out their anti-scraping. (And API is a non-starter since that basically says everything is verboten).

LinkedIn Sales Navigator is a paid tool which allows you to search their whole database. Then depending on how much you pay you can get all their personal details (Email address, phone number, even their address sometimes.) https://business.linkedin.com/sales-solutions/sales-navigato...

LinkedIn gives away email id and phone number (even if you had given just for 2FA) to all your contacts. I checked PDL, it has all the information from LinkedIn except for phone number, which I promptly removed once I identified the 2FA issue (now TOTP is available).

Re: Personal and social information of 1.2B people discovered in data leak

#96

Post by simonlc »

john-radio wrote: post #64
sparkywolf wrote: post #48

I found a vulnerability in linkedIn a few years back that allowed anyone to access a private profile (because client side validation was enough for them I guess..?) They didn't take my report seriously (still not completely patched) and I feel like that told me all I needed to know about their security practices.

I reported an issue to the LinkedIn competitor https://about.me two years ago where signing in with my Google credentials gives me access to some the account of some random other person with a similar name to me. I think that during registration, I attempted to register about.me/johnradio (except it's not "johnradio"), but he was already using it, and then the bug occurred that gave me this access. I randomly check e…

I actually had a similar thing happen with facebook, though we didnt share names.

Re: Personal and social information of 1.2B people discovered in data leak

#97

Post by ThrustVectoring »

troebr wrote: post #90
anilshanbhag wrote: post #31

People data labs's data is pretty accurate. Here is mine: https://api.peopledatalabs.com/v4/person?api_key=9c6a1382204... You can try it for yourself by changing the email. All of the information is public, so I don't mind. They are basically doing data integration.

It would be really surprised if this were compliant with the GDPR. I live in the US but I tried email accounts of relatives in Europe and they had data in there.

It looks like it's a US-based company without enough of a European presence to fall under their jurisdiction.

Re: Personal and social information of 1.2B people discovered in data leak

#98

Post by olivierduval »

troebr wrote: post #90
anilshanbhag wrote: post #31

People data labs's data is pretty accurate. Here is mine: https://api.peopledatalabs.com/v4/person?api_key=9c6a1382204... You can try it for yourself by changing the email. All of the information is public, so I don't mind. They are basically doing data integration.

It would be really surprised if this were compliant with the GDPR. I live in the US but I tried email accounts of relatives in Europe and they had data in there.

So... if the owner is known, it will be quite costly ;-)

Re: Personal and social information of 1.2B people discovered in data leak

#99

Post by DarthGhandi »

dclusin wrote: post #81
toomuchtodo wrote: post #14

Earlier quoted context omitted.

They're everywhere. Just ask Shodan.

I remember there was some brewhaha a while back about how Shodan was able to discover services on IPv6 since the address space was so sparse. Apparently they were running enough of their own NTP servers to reliably map out lots of devices on IPv6.

Not being able to map ipv6 space is a myth. There's plenty of workarounds.

Re: Personal and social information of 1.2B people discovered in data leak

#100

Post by kaivi »

hitpointdrew wrote: post #89
kaivi wrote: post #85

Earlier quoted context omitted.

I've crawled a popular social network on a large scale, currently doing the same for dating services as a hobby. God, wish I'd still got paid for webscraping. Here are some tricks which may or may not work today: - Have an app where user logs in through said website, then scrape their friends using this user's token. That way you get exponential leverage on the number of API calls you can make, with just a handful of…

> - Call their API through ipv6, because they may not yet have a proper, ipv6 subnet-based rate limiter. Nice tip!! > -- From a purely practical perspective, start with a baremetal transaction-isolation-less database like Cassandra/ScyllaDB. Don't rely on googling "postgres vs mongodb" or "sql vs nosql", those articles will all end in "YMMV". What you really need is massive IOPS, and a multi-node ring-based index wit…

>Somewhat ironically Elasticsearch would probably work really well for this too (just make sure your elasticsearch isn't open to the world on the internet!).

Sure it will work, but I personally don't like Elasticsearch for anything high-intensity because of its HTTP REST API and the overhead it carries. Take a look at Cassandra's [1] "CQL binary protocol", it simple and always on point.

[1] https://github.com/apache/cassandra/blob/trunk/doc/native_pr...

Post reply on HN