Hacker News Reader

Comment by sharkweek | Hacker News Reader

At this point I am operating on the assumption that ALL businesses that have my data are going to inadvertently leak it at some point, and thus I am attemtping to provide individual companies with as little information about me as possible.

The toughest ones here are my online banking and my online health portal, but other than that, I have gotten pretty picky about what information I give any company.

View on HN

This is a healthy mindset to have.

I feel that for every company that self-reports a leak, there are multiple other companies that have leaked your data and either haven't discovered the breach, refuse to disclose it, or flat out sold your data to the highest bidder.

I’m even more worried about the ones that don’t have the facilities to even detect and know they’ve been breached.

You would be correct. In the US, which I might remind you, does not have a national law on the books regarding data breach notification. Even at the state levels, it’s varies pretty wildly on top of, most notifications are only required if there is evidence. So here is the challenge: what if I keep no logs, and have terrible security monitoring capability? If I am notified or discover a critical vulnerability on my own, but have inadequate logs to show or detect if it was exploited... am I required to notify? I have been told no (I fervently disagreed; I think suspected breaches, or critical vulnerabilities which may lead to breaches but were inconclusive should still require notification).

Still, I would have thought it is good practice to notify your users if you leak their data to thieves. Quora did the right thing and should be applauded.

As a counterexample, it seems that Newegg had a massive breach (thieves installed JavaScript that skimmed credit card numbers for weeks) in August, and even though my credit card was likely stolen, I hever heard about it from Newegg.

How did you find out they did that? Just following tech news?

Yes, see for example https://techcrunch.com/2018/09/19/newegg-credit-card-data-br...

Not sure why you didn't hear from Newegg, but they did send out a mass email notification with details of the breach.

I somehow got their email a week or so after the event, and after my card's fraud prevention called for suspicious activity, reverted the transactions and cancelled my card. The bank official was not aware of the leak.

They did? I never got anything from them. And I was definitely within the time window.

>In the US, which I might remind you, does not have a national law on the books regarding data breach notification.

Our federal government is beholden to corporations, so I don't see any legislation ever happening to punish nor place a regulatory significance on breaches.

If the Equifax debacle didn't move the needle, nothing will. How they didn't get a death penalty for not protecting one of the supports of our financial system I will never know.

As the parent said, I've just assumed all my data will be breached eventually. When it occurs I dutifully sign up for the monitoring offered and make sure to review things on a monthly basis.

Your comment on breach notification is spot on. WISH.COM has suffered down line breaches in their process and it is easy to prove by the use of virtual credit card numbers ... numbers that are generated and used at only one site. They have been silent when it is reported to them.

> dutifully sign up for the monitoring offered

and then the monitoring company gets breached.

I don't give any real info besides my first name to any site that doesn't have a legitimate reason to need it. If they force me to confirm an email address, depending on the site, I may use one of my main emails, or may go generate a disposable address.

Yeah, I tag every email address I give to a vendor, and I have for years. It has helped me discover a number of breaches.

The address I gave Quora isn't in the hands of spammers yet, which is a mildly good sign. But normally it takes a while for an address to get out to the bottom-feeders, so we'll see.

> Yeah, I tag every email address I give to a vendor, and I have for years. It has helped me discover a number of breaches.

Can you go into detail on this? What exactly do you mean by tagging? Just wondering in case I want to do the same.

There are a few ways to do it, but I use what is known as subaddressing: https://tools.ietf.org/html/rfc5233

The only way to independently verify a leak is to have a third party create a couple of user accounts with unique passwords and setup a corresponding gmail / facebook honeypot account which would alert them to logins. If my quoraAcct2 password ever gets hacked and used to login to my fake gmail or facebook account, I know that quora was compromised. Works with any site.

Luckily your bank and your health provider probably have decent security, because those two industries face extra heavy fines for breaches.

Yes, heavily regulated banks and medical providers have wonderful security. You can see that they do whenever they require punctuation (but not spaces or $) in the password, and demand an 8 character password (but reject anything over 16 or 24 characters). /sarcasm

I especially like financial companies that have you login by using symantec VIP[1] which you append to your password. There's no way anyone thought that was a good idea. They did it that way because they had a worthless legacy authentication stack they couldn't rewrite, didn't understand 2FA well enough to implement it themselves, went with Symantec because "nobody ever got fired for contracting $importantfunction to $bigcompany", and the only way they could shoehorn any 2FA auth into their login flow was to concatenate it with the password.

[1] If you haven't had the pleasure of using it, it's a proprietary 2FA app that has a single seed per app install, shared between the app and symantec's database. It generates 6 digit codes that make it look similar to standard TOTP, but it's not TOTP. If you need to use it for multiple websites, you give them all the same seed hash (displayed by the app) which they use to synchronize your auth credentials with your account at symantec. IOW, it doesn't scale securely. There's also no way to have a backup 2FA device with this system; at least the two companies I've used it for haven't let me set up my account with two VIP apps on two different devices. Since normally you'll only have a single 2FA device using this Symantec VIP service, that means you have to go through a manual, insecure identity verification process to get back into your account if your one Symantec VIP device gets lost or broken.

Heavily regulated companies have a lot of Microsoft Word paperwork to fill out and months long approval cycles to wait through to get any work done, but even nastier, more bug- and vulnerability-riddled legacy codebases than the rest. Security is inextricable from software quality. Not exactly something EHR systems are known for.

And fixing things is very difficult because you have to go through endless approval cycles with the approvers mostly not being security experts.

Symantec's system does suck but there's actually a way to use it with Google Authenticator:

https://www.cyrozap.com/2014/09/29/reversing-the-symantec-vi...

Interesting. So it's just a bunch of obfuscation and 3rd party api crap around a core of TOTP shared secrets between the app and symantec? Why don't they implement it that way, and make it transparent, so that their app can add multiple VIP credentials, rather than obfuscating everything, locking it down to a single shared credential for all sites?

I work in medical devices and sometimes it feels like we have so much regulation that doing the right thing is too expensive and cumbersome. I wouldn't bet on banks and medical institutions to be extra secure. And Equifax has shown that a massive breach is not really hurting the company.

Luckily we can trust banks and medical data collectors!!!

https://mobile.abc.net.au/news/2018-12-03/commonwealth-bank-...

Oh yeah. Right...

Data is binary: it has either been already leaked, or not yet.

If they get your data from brokers they may be building comprehensive profiles about you without your explicit permission.

Brian Krebs recently posted about this:https://krebsonsecurity.com/2018/12/what-the-marriott-breach...

I have an email address that I've only ever used as my AWS account email since many years ago. Somehow I started getting spam on it last year. It is not an address anyone could guess or somehow generate based on other data points such as name or otherwise.

I am using a separate email for each website, using the catch-all email feature.

It helped me find out a couple of local companies that are selling my data to spammers.

Many of us who operate our own mail services use a unique email address for every web service we use. You'd be surprised how many of these unique email addresses I've received spam at (and have subsequently blackholed). I would estimate less than 50% of the associated services ever report a data breach event. I figure either there has been an unreported breach or, possibly more likely, the service sold their userlist either directly to spammers or sold it to another group who was themselves breached. The upside, though, is that blackholing an address used for a single service is super simple and satisfying.

Do you have any more info on running your own mail server? I looked at doing so but was promptly steered away because of blacklisting, servers that allow it and redundancy.

I'm not sure what the up or downsides would be, but I personally just have all mail sent to *@mydomain.tld forwarded to a single email address. This way I can give each service a unique email address, while preserving the ability to divine whether a particular address has been lost or stolen, by looking at the sent to field.

Well, there's the obvious comfort of having all your mail in one place -- and all the obvious disadvantages that entails, I suppose.

Can't recommend FastMail enough- it has aliases which automatically forward mail from xyz@alias.yourdomain.com to your alias@yourdomain.com - This is very similar in practice to the + trick with gmail[1] but with the benefit that your email addresses will pass all stupid Javascript email validation rules.

[1] https://www.thewindowsclub.com/gmail-address-tricks

You can also set up wildcard aliases, e.g. I have the equivalent of *@example.com, leading to addresses like hackernews@example.com.

Been using Fastmail for ages... great provider.

I do something similar using https://www.spamgourmet.com/

Although many services are getting wise to many of these services and not let you sign up with their domains.

I would guess most companies are not in the business of selling their user email lists, but rather, shared the user's email with a third-party company that provided some service, and that third-party company then sold it.

You can do this with a gmail account too. If your email address is johnsmith@gmail.com...the following addresses all fwd to your main address

John.smith@gmail.com

Johnsmith+quora@gmail.com

Johnsmith+equifax@gmail.com Etc...

Can't the spammer just s/'\+.*@'/'@'/ or something and throw away the + sign and all that follows? Or the company could do this if they were selling your email address.

I used to use this technique for many years, but occasionally ran into issues with form validators rejecting the email address. I finally stopped because I never got spam from those email addresses (even in spam folder). I figured it's trivial for spammers to strip out the extra text, any half-decent spammer should know this trick. Also, I suspected they might change the +text to put the blame on someone else.

While we're on the subject, all combinations of dots are equivalent. this.isme and th.isisme and thisis.me, etc. Finite variety, but good enough for a few generic throwaways and never filtered or stripped that I've seen.

I use domain.tld@subdomain.domain.tld combined with a catch-all address for that sub-domain. It gets around various email validation regexes that won't accept +.

As an anecdote to that:

I've received recruiter spam to "<my_email>+fuckyouadobe@gmail.com". Turns out when I was forced to signed up for an Adobe account years ago I'd added "+fuckyouadobe" to my email and, of course, Adobe was inevitably hacked. The leaked database had somehow made its way into recruiter software. The recruiter told me their vendor and when I got in touch with them (Aevy.com) they, of course, had no idea how that email got there.

Sadly these days people are probably smart enough to strip out these additions to gmail addresses. I would guess that's what Aevy did after I reached out...

You wouldn't know where the data goes to anyway even without any unintentional leaks. No need to provide more than necessary.

That being said, I wonder if it's a good idea to extend KeePass to generate full credentials for given website.

This mindset reminds me of the following "laws":

Anything that can go wrong, will go wrong [0]. Anything that's isn't disallowed by quantum mechanics, will eventually happen [1].

So, if businesses made it cryptographically impossible to leak data, maybe it wouldn't happen, assuming it is even possible to make it impossible...

[0] https://en.wikiquote.org/wiki/Murphy%27s_law

[1] https://en.wikipedia.org/wiki/Totalitarian_principle

Anything can go wrong, will go wrong in the worst possible moment (Sod's law).

Reply on news.ycombinator.com