Hacker News Reader

Comment by bogomipz | Hacker News Reader

There's a different "nightmare letter" in the US, one that ordinary citizens receive. It comes from a credit agency or a company that uses a credit agency. The letter informs folks that they have been the victim of a data breach and that their personal data "may have been accessed." The nightmare letter provides little meaningful detail beyond that.

The letter is sent via regular snail mail and arrives months after the actual data breach occurred. The letter is largely devoid of any meaningful recourse for the victim. It does however offer "free credit monitoring" for up to 1 year by the same agency that displayed complete disregard for security.

If compliance and accountability with people's data especially when they are not permitted to opt out of such a system constitutes a "nightmare" then perhaps those companies should rethink parts of their business model.

View on HN

Considering the normal situation is they receive no actual notice at all from most breaches and find out through the news if they are lucky I would say the very absence of disclosure is the true nightmare. You usually find out a year later when the data appears on the dark web and is then pulled into something like haveIbeenpwned.com.

Yes agreed and of course Experian has now starting using the existence of people's data on the dark web as another revenue stream See:

http://securityaffairs.co/wordpress/64043/deep-web/experian-...

From the article:

>"By using the “Free Dark Web Email Scan” a user will receive advertisements for Experian products at the e-mail address that is being scanned. The user agreement includes a clause which states that not only will Experian send you advertisements, but “offers for available credit cards, loan options, financial products or services, or credit-related products or services and other offers to customers.”

It's like a vertically integrated criminal syndicate.

The best way to counter this nightmare letter is to freeze your credit. It works better than monitoring, imho. You switch from opt-out to opt-in. It should be the default for most people. It takes a little planning to grant individuals access to your credit file.

The fact that the credit reporting agencies can (and do, when not prohibited by state law) charge a fee for each freeze and unfreeze event is what prevents me from doing this. While the fee isn't expensive compared to dealing with the ramifications of ID theft, it's the principle of paying the data guardians to guard my data better that I object to. Especially when I have no choice (assuming I want to live a modern life) but to have them manage my data.

That those practices are bad does not mean that something as simple & proper as storing IP addresses in your logs justifies receiving a nightmare letter.

The GDPR is trying to do a good thing, but it goes too far.

>The GDPR is trying to do a good thing, but it goes too far

By asking for:

* Data Classifications?

* Privacy Impact Assessments?

* Access Controls?

* Breach Escalations?

If your business is collecting and processing data on individuals, you should already have these Security 101 basics in place.

It also requires you explain the logic of any algorithmic decision you make.

I.e. If you use any sort of machine learning model, such as a neural network, you have to be able explain every decision it makes. Given that there's currently no know method to fully explain the outcome of a neural network decision, GDPR would apparently make it illegal for any EU business to use a neural network in any user facing capacity.

GDPR advocates answer to this seems to be that, while the regulations might read as such, it hasn't actually been tested in court yet and, who knows, maybe whatever judge it eventually comes up with will decide to keep neural networks legal!

So, if you're a company using machine learning in Europe, you just have to wait a few months and keep an eye on court news to determine if you entire strategy is permitted or not. Thank God for the stability and confidence provided to businesses by the single market!

Why are you storing IP addresses in your logs? The web server my college computer club ran made a point of not storing IP addresses. We would respond to legitimate requests from campus police / the deans / other people who could kick us out of the college (usually when someone was, like, making threats of violence in the comments of a WordPress blog or whatever), but we would often answer with, "No, we don't have that data, it never got logged."

If the GDPR is forcing businesses to abandon dangerous logging practices that they don't really need, it is hardly going too far.

Most applications will log ip addresses by default. Why? 1) Many security products rely on IP addresses in order to blacklist known malicious users (including fail2ban) and/or detect hacking attempts. Monitoring for stolen credentials b also will typically check IP addresses ie why is John showing up as being logged in from an unknown IP address when he's in the office with me? 2) It can be useful for debugging. Are those requests going to the right server? Is there one server where something isn't working correctly ie is that server misconfigured? 3) Some businesses are required to prevent screenscraping of certain data. Solutions to prevent that typically use and store IP address information.

1 can be done by checking but not logging IPs, which we certainly did (we'd tcpdump traffic and throw it in iptables) or logging IPs of malicious requests but not of normal behavior.

2 is what this regulation is intended to stop: you shouldn't be trading off "it might be useful in the future" for "it can be misused by authorized users, or exfiltrated by hackers".

3 seems reasonable, but does that require a retention policy of more than a couple of hours?

> Why are you storing IP addresses in your logs?

Both Apache and Nginx (and others?) log IP addresses by default. The expected result of this is that storing IP addresses in server logs is widespread, useful for troubleshooting, and entirely normal.

This seems like a very good reason to have a law about it: if the only reason you log IP addresses is that it's on by default and you haven't thought about the risks of storing it, you should think about it for your production servers. Otherwise it's purely a risk and has no benefit. (And the risk is to your users, not you, so it makes sense that a law would be needed to give your users the ability to complain about that needless risk.)

If you make the active decision that you specifically want the IP addresses, great, you can do that. Just have a strategy for keeping that sensitive data secure and getting rid of it at some point.

What's the risk of storing an IP address. IP addresses aren't people and most people have a carrier natted or rotating address.

The real question is what value does storing the IP address even hold?

- You can identify trends and patterns in your traffic

- You can figure out where in the world your traffic is coming from

- It can be helpful in responding to security incidents

- arbitrary user, session and request IDs

- this can be done and then discard the address

- how so? What does knowing the address months later help? Something like fail2ban and other automated systems, sure, but long term logging?

The IP address is like a temporary phone number. It could not pinpoint the person persistently but can be tracked down with the help of ISP.

Other information you can retrieve from IP address is geolocation information such as https://www.ip2location.com

It's not a phone number because it doesn't need to resolve back to anything in particular. With carrier grade nat for instance, it could be shared by many people. At best it's shared by a house.

With regards of tracking you with the help of the ISP, if you have someone with those resources, it's not you storing an IP address that's their biggest concern.

Geoinformation can also change daily. Figuring it out afterwards isn't reliable.

If it doesn't have value, why storing it then?

I just watched Wes Bos' Learn Redux course, which was sponsored by Sentry - and he had a little video showing their service. By default it logs the user's IP (or at least did when he recorded) on all events - any client-side error, any messages the developer raises to Sentry from the client side code, any feedback form powered by Sentry the developer uses. I'm sure you can turn it off, but I imagine that kind of thing is all over some companies.

My new favorite thing is libraries that track every mouse move you make, every scroll action, every key you type, etc., including things you pasted into a textbox by mistake, and send it back over a websocket or something to a third-party service so that the website's UX people later can see how real people interact with their website and optimize it. Google for "website mouse tracking" or "website session replay" to see a bunch of startups that do this (many of whom have ads at the top).

I am incredibly excited for the GDPR to make these products too much of a regulatory burden to be worth considering.

They are like privacy-invading rent-seekers of the internet and I too will be pleased to see a lot of these trash companies go under.

Reply on news.ycombinator.com