Hacker News Reader

Comment by imgabe | Hacker News Reader

> It's important to me that my physical address not leak, I don't want people or packages showing up that I didn't ask to show up.

What is the likelihood of being a target of this? Are there people out there that you expect might want to mail you an unexpected package or stalk you at your home?

I get that there are people who have stalkers and such, but for the average, random person, what is the likelihood a criminal is going to pick their name and address out of some leaked information and...what? Mail them a bomb? Travel from Estonia or wherever the hacker lives to burgle a house in the US? Why? There's no point to doing that.

View on HN

>What is the likelihood of being a target of this? Are there people out there that you expect might want to mail you an unexpected package or stalk you at your home?

As we see in the instances of so-called "revenge porn", you don't have to be famous to be the victim of these tactics. It just takes one person who becomes annoyed enough to use some of these tools and then you're left with an expensive and time consuming mess.

Did you have a nasty break-up? Fire someone? Do you have a business rival who would like to see your reputation ruined? Did you leave a comment on a website that just happened to offend the wrong person [1]? The tools to completely ruin your life are becoming easier and cheaper to wield, and the costs of defending against them are only increasing.

Even if the likelihood isn't high, the consequences are severe enough that you should take the risk seriously. Objectively, the likelihood of you getting robbed isn't that high either, but you lock your doors and don't leave valuables sitting out in your car either.

[1]: https://gizmodo.com/when-a-stranger-decides-to-destroy-your-...

EDIT: note that in the link above, the attacker wasn't even using non-public data. Imagine how much more damage someone with the ability to gain access to bank accounts, etc. could have done.

> Did you have a nasty break-up? Fire someone? Do you have a business rival who would like to see your reputation ruined?

If you were dating someone, worked at the same company, or even in the same industry and know the same people, they do not need a data leak from Marriott to get your address. That has nothing to do with data leaks.

Maybe, maybe, you could conceivably piss off some Mr. Robot Darknet-wizard on a forum who would then spend hours combing through leaked data to try to figure out who you are so they could mail you some anthrax, but I'm going to put that at "get hit by an asteroid" level of things to worry about.

As far as "take the risk seriously", what is there for an individual to do? I have zero control over the data security practices of Equifax, Marriott, or any other major corporation. I can just avoid their services, but that would basically entail living completely off the grid and being a hermit. If it were something as simple as locking a door, or putting your backpack in the trunk, yeah, people would do it. But all of this "the sky is falling, freak out now!" propaganda, comes with absolutely zero actionable items that the average person can do. I'm not going to waste my life being worried about things I have no control over.

Maybe, maybe, you could conceivably piss off some Mr. Robot Darknet-wizard on a forum who would then spend hours combing through leaked data to try to figure out who you are so they could mail you some anthrax, but I'm going to put that at "get hit by an asteroid" level of things to worry about.

The entire point of that article I linked was that the person doesn't have to be anywhere near you to cause you real damage. The woman who posted the false allegations to the homebreaker site was thousands of miles away. Heck, if you look at instances of "swatting" [1], it's entirely possible to people in mortal danger from thousands of miles away with little more than a phone. Are the people who are doing the swatting "Mr. Robot darknet wizards"? No, they're bored viewers of Twitch streams who think getting someone potentially shot is a barrel of laughs.

I'm not going to waste my life being worried about things I have no control over.

And this is why data-breaches will remain depressingly normal for the foreseeable future. Companies know that there are zero consequences, specifically because of this attitude. If data breaches were treated like chemical spills, companies would be much more proactive and careful about what data they collected, who they shared that data with, and how they secured that data. But companies know that consumers don't care, because "It's only data," and as a result they will continue to underfund data security and make us eat the externalities in the form of having to spend time and money getting transactions reversed.

[1]: https://mashable.com/2017/12/29/swatting-death-andrew-finch/...

The article doesn't say how the swatter got the victim's address. Where they somehow able to cross-reference the streamer's twitch ID with their credit report in the leaked Equifax data? If not, I'm not sure what one has to do with the other.

> If data breaches were treated like chemical spills, companies would be much more proactive and careful about what data they collected, who they shared that data with, and how they secured that data.

Actually, on a personal level, I am treating data breaches exactly the same as chemical spills. I personally have about as much influence on one as the other, which is to say, none. If a law comes along, I'll support politicians who vote for it, but that's about it. Again, what precise, actionable steps are you proposing for the average person to do? I'm looking for something besides "be scared and angry all the time" because that is as unpleasant as it is ineffective.

I worked in a prison facility for three years, where all the inmates knew my first and last name, which is unique (I'm probably the only person with my first/last name in the world). If you google me, you can find my entire immediate family, including home address, home worth, names, occupation, ages. Many of the inmates were able to observe my car make/model/license plate, my arrival and departure time to work, etc. Though I had good rapport with the inmates and believe I did right by them, I still have a nagging fear that a released inmate could track down a family member or show up at our home. These are not dumb people. In fact they are quite creative with plenty of street smarts.

I am not a unique/unusual/margin case.

Saying "there are some people who have stalkers and such" discounts large swaths of (mostly) women who have been victimized, far more than a non-victim would ever realize.

This is a very real concern for more than an insignificant number of people. We are just people who you would not necessarily realize exist.

I'm touched that the e-stonia marketing campaign has ended up at the point where people think hackers only come from Estonia. But do not worry, your house is safe - we only burgle jewellery shops in Finland.

Reply on news.ycombinator.com