Hacker News Reader

Comment by volgo | Hacker News Reader

The solution here is not technical - we already know the technical solution. The solution is to introduce a cost to the risk.

Right now the "risk" has no cost - if you expose people's data there's not that much consequence besides bad PR. We should assign some dollar value to each person's identify leaked. That way, businesses can properly asses risk and reward when they start these types of projects

Overtime, I think businesses would rather avoid the liability of storing people's info in the first place

View on HN

This is exactly what will happen in Europe next year.

With the General Data Protection Regulation, any leak of private data caused by a major cybersecurity gap in a company will lead to severe financial sanctions such as a fine based on 4% of the company turnover.

This law will indeed give the risk a “cost” :).

As I understand it, Europe does not generally suffer from the disease of banks and courts accepting knowledge of basic demographic data as proof of identity. GDPR is not really comparable to the mess of the US social security number situation.

The risk we need is to introduce is to make banks (not customers) responsible when banks allow themselves to be tricked w.r.t. personal identity. This would motivate them to come up with identity verification schemes reflecting ~anything at all that the security community has figured out in 50+ years.

Exactly, there are best practices to avoid these scenarios. The engineers are just being pushed to produce so quickly that they end up doing things like this.

The problem has been for faaar to long that doing tech right takes much longer than the business side of the company is willing to wait for.

The other cost we can introduce into the equation is holding corporate leaders personally liable for these types of gross negligence.

Once CEOs know that they can go to prison if their customers' data is stolen, I assure you that they will suddenly become very interested in making sure their underlings follow best practices.

Reply on news.ycombinator.com