Hacker News Reader

Comment by ziddoap | Hacker News Reader

With the billions of records breached this year alone, I'm feeling quite apathetic to these stories now.

Thousands or millions of records are breached due to X (usually egregious negligence, sometimes not), the company makes an apology full of mental gymnastics, blame game, and bold lies ("Your privacy is our number one concern, we're sorry we are only pretending to care now."), a few days later the heat is off because another company let loose a few million other records. Repeat.

I feel like I need to be re-sensitized. This is a major problem - and I just can't seem to muster up any care for it anymore.

View on HN

Everyone has an opinion on why Amazon is a monopoly and should be broken up, but this is what they don't think about. I trust Amazon not to get breached. No one is infallible, but tech is their thing.

I have no interest however, in further increasing the amount of online shopping accounts I maintain, because that means I have to keep tabs on the shenanigans of even more, highly technically incompetent, companies to know if I've been compromised.

Just use a password manager so you can have a different password for each site. It's not that hard.

The article points out that MoviePass had user and credit card data in plain text. A password manager wouldn't have helped with that.

The credit agencies are supposed to protect cardholders via PCI DSS audits (see https://www.pcisecuritystandards.org/pdfs/pci_fs_data_storag...). This is definitely non-compliant. Obviously this system is broken.

Additionally, I don't understand why companies continue to roll their own payment processing rather than paying a service that knows how to do it. I guess it seems easy...

Well if you can make more profit, have all the advantages without being PCI DSS compliant. Why would you not roll your own payment processing? Since nothing happens apparently when the data of your customers get "breached"

> Why would you not roll your own payment processing?

There are various "financial hammers" these types of breaches will induce, depending on the network (Visa, MasterCard, etc.). Plus, processors (the banks) will put the liability onto Merchants which are shown to have violated thier ToS. Storing PAN's in clear text (or at all in some cases) is certain to trigger one or both of these ramifications.

What about being “big enough that they will discount all of these ramifications”?

PCI DSS is a program of the card associations to protect the issuing banks from fraud losses. Merchants have difficulty complying so it ends up as a balancing act between keeping the wheels of commerce moving and preventing fraud.

Fully outsourced payment solutions are a good fit for some business models but not for others.

Great post.

One thing I would add is that PCI DSS is also applicable for ISO's as well VAR's which operate payment processing gateways.

It is a hard-ish habit to start, and fully migrate into. But easy to maintain

I do use a password manager. Offline, in a separate VM. No amount of password security is going to protect my credit card information, address, phone number, shopping data, and other PI from being leaked by incompetent companies.

That and 2FA. If a service fucks even 2FA up, then I don't know.

Aspects of Amazon's businesses have been breached in the past. One could argue that tech is Facebook's thing too, but that didn't stop them from storing millions of passwords in plaintext[0]. Drinking the kool-aid of a big tech brand does not a secure platform make. Amazon is inevitably gonna get hit again someday precisely because they're Amazon.

Whether or not they could theoretically provide a more secure service has no bearing on the monopoly argument because the moment that we accept companies completely destroying fundamental tenets of capitalism (i.e. not controlling a market) because they can do it better is the moment that capitalism truly begins to die. Amazon shouldn't have the power to control the ecommerce market regardless of their security, and the fact that there are people out there willing to make this trade-off kinda scares me.

It's also not that hard to replace a credit card since the industry has been regulated to cooperate with consumers on fraudulent claims. As another user mentioned, password managers help here too.

0: https://krebsonsecurity.com/2019/03/facebook-stored-hundreds...

Your argument doesn't make sense. You admit that even Amazon, who makes a living in providing sophisticated technology, is not perfect when it comes to security. How does that help the argument that my data would be safer split across tons of non-technical providers? How does wanting digital security kill capitalism? What does capitalism have to do with the market of a Socialist country?

The fact that you think they’ll keep your password safe is a terrible reason to support a monopoly that is bad for society in so many other ways. But hey, it’s more convenient I guess.

They didn't say anything about passwords. This was credit cards and address information. An online retailer breach could be purchase history on top of that.

>I have to keep tabs on the shenanigans of even more, highly technically incompetent, companies to know if I've been compromised.

But why not just assume that your data has already been compromised? It has.

What could you even do with that information? How do you respond when you find out that your data has been leaked?

I feel the same way about pretty much everything and anything related to any type of news. Whether it's tech news like this, environmental news, or political news. It's the same thing over and over, as you described. Incident, Twitter/media coverage/hype, blame, lies, apologies, and then it's not talked about again a week later. Sigh.

The president's new outrageous tweet / orange man = bad, another wedding blown up in some middle eastern country, someone famous said something inappropriate / groped someone that got them fired, earthquake/fire/tsunami wiped out a few thousand people in some distant land, another school got shot up, "clear signs we're in a bubble" and the market is about to crash, something generic about Silicon Valley's hubris, something about how another oppressed group is being screwed over etc etc.

I don't think we're really meant as a species for this constant stream of depressing information we can't act upon, it's not good for us. Apathy seems like the only natural response to this barrage of stressors.

Had an annual checkup recently and did a screening for anxiety/depression. It felt unrealistic - is it a problem with me to be "Worrying 'too much' about different things"?

A small counterpoint to your last point: the youngsters at Fridays for future and the folks of Extinction rebellion

I actually believe that the present and the future are bright. Pinker's last book does a great job at showing how we're all simply victims of recency/availability/selection/confirmation bias when consuming the news. The world is getting dramatically better, it's our perception of it that is getting constantly worse.

I wonder about the extent to which the seemingly endless supply of breaches has translated into an increase in identity theft (or any other negative consequences that I haven't thought of)

I think a bigger use-case for these breaches is credential stuffing and more elaborate phishing rather than old fashioned identity theft - but I'm honestly just guessing and have no data to point to.

You don't need phishing if they have the credit card numbers and name/address information.

If the credit card number is the end goal, sure.

However, there are many other goals of phishing: Pivoting through another person/company to reach another target, IP theft, espionage, corporate sabotage, impersonation, etc.

I'm more concerned about the propaganda issue. I argued a couple years ago (heavily edited) when I left the Army that foreign actors (read: Russia) were data mining stolen data for fracture lines to amplify [0] which makes it hard to form a comprehensive list of politically relevant topics.

[0] https://www.armyupress.army.mil/Journals/NCO-Journal/Archive...

Partisan politics really gets in the way of that point. Both sides of the aisle have been pointing to the other side saying “Russia” or “China” for the past few years, so admitting civil division is their primary objective would almost be admitting complicity.

Maybe we could accept that despite the leaks society is carrying on just fine?

Perhaps the paranoia is a bit overblown, and is implicitly allowed to satisfy notions that financial market performance is somehow the highest priority or literally reflective of efficiency.

Remember, scores of people are convinced Sky Wizards are literal things. I’ve seen no reason to believe common held beliefs in economics are anything less than qualification without well reasoned checking.

My priorities in life are not a rich person’s financial portfolio. And we can see how they treat each other when these breaches happen. They don’t care and pat each other on the back coughEquifaxcough.

Why should we take such a serious posture if the rich owners don’t?

Bad actors having access to intimate personal details (health and financial records), past passwords (not everyone uses 1 password per site), etc. is not a matter of my paranoia being overblown.

I don't know how someone getting access to my medical records or locking me out of my email account is related to financial market performance.

>Remember, scores of people are convinced Sky Wizards are literal things.

We know, for a fact, that data is being breached and ending up in the hands of the wrong people. How are you honestly making a comparison to "Sky Wizards"?

Why should we take such a serious posture if the rich owners don’t?

Because it's my f'in data.

I’m questioning your belief in a system that clearly doesn’t a give shit about your data and your ability to do anything about it in that system.

You and some other engineers on this forum can conjure all the concepts you want about how to fix it, and the perceived value in doing so, on here in these forums and nothing will come of it. Because by and large the system doesn’t give a shit.

You’re “f’in” data is being bought and sold to bad actors without you even knowing it. And you agreed to that by using these services.

Like you said in another post, the genie is out of the bottle.

The value of securing an inherently insecure society is stupid.

You’re thinking about this like an engineer only and you’re losing and have been for years. There’s no engineering solution to these problems at the technical or social level.

We’ve been fighting fraud since society began. Good luck. I’m sure a hardcore software engineer will figure it out

>And you agreed to that by using these services.

I have no right to complain if the service I sign up to tells me they are selling my data to 3rd parties. I certainly have a right to complain if the service I sign up to tells me my data is private, then through their negligence someone lays their DB bare.

>The value of securing an inherently insecure society is stupid.

A real live nihilist. Better give up on everything that's broken, eh?

>There’s no engineering solution to these problems at the technical or social level.

No technical engineering solutions to a technical issue, that's a hot take I haven't heard. As for social, luckily we are able to communicate with other humans and work together on different aspects of a problem. Or I guess some people just shit on others, claim everything is insolvable, and ride their high horse into the sunset.

>Good luck. I’m sure a hardcore software engineer will figure it out

Thanks, friend.

Haha yes you’ve nailed me in two posts on a forum as a nihilist

Like I’ve nailed you as a self aggrandizing tech bro who thinks he’s smarter and more aware than anyone else and can tackle a problem there’s no social will to tackle in earnest.

Good luck.

That's a pointless sentiment, there's no social will to tackle an emergent problem until there is.

Data is our century’s version of leaded petrol, CFCs [0], greenhouse gases and long-term nuclear waste containment.

Not saying those things are no longer problems, but they weren’t seen as ones until they suddenly became ones.

Like toxic waste, data always finds a way to escape its container. Data wants to be free - just not in the way we originally hoped.

Just like those early fridge manufacturers, we don’t yet know what the long-term effects of releasing so much data into the atmosphere are going to be.

The next 50 years are going to be bumpy as we find out.

[0] Fun fact: the inventor of leaded petrol also invented CFCs. He probably did more damage to the environment than anyone else ever, living or dead. https://en.m.wikipedia.org/wiki/Thomas_Midgley_Jr.

> Why should we take such a serious posture if the rich owners don’t?

If somebody’s ssn or sexual preferences got leaked and They had their identity stolen, or lost a job, and the rich ceo doesn’t care, you are suggesting that they shouldn’t take it seriously until the damage is proven?

The issue is that there are no punishments for the leaks, not that they are harmless

There's no accountability. Executives never see jailtime for gross negligence. They just push profits at the sake of all else, and don't give a shit about the PII of their users.

With all the information exposed probably 60-70% of all people have been exposed. We need to stop the ability of anyone to do anything useful with this data. Which means forcing banks to improve their security standards... rather than calling it identity theft and forgetting about it.

I think it might be too late to put the genie back in the bottle without a multi-industry, multi-system overhaul.

I agree banks need to improve security standards (along with just about every other major and minor company). But banks being more secure doesn't get to the root of the issue any more than just forgetting about it (after all, it's generally not the bank having their innards on display). There is no silver bullet.

How about 2 forms of government ID to open an account just like you need to get a passport. Identity theft is so easily facilitated by just having to enter a social security number online and the banks are responsible because they are trying to make it as easy as possible for anyone to sign up.

This doesn't address credential stuffing, spear-phishing, propaganda, or many of the other issues that come along with data breaches. Identity theft is a piece of the puzzle, but no where near the whole thing.

Your idea might cut down on identity theft - I'm not sure. But it doesn't speak to the root issue. (Not to say it isn't worth pursuing, just that it doesn't do anything if I shared a password between my email, bank, and MoviePass)

Sign all communication with a private key. Have mail clients verify it. Make that government mandated.

How are you doing to deal with 11-30 million of people who are here illegally/visa overstays/etc? What about people who are in SF but were born in Maine and need a birth certificate from the county court house to get that "government issued key"? (The Maine court house would need that key to issue a certificate though ).

If we are claiming that it is too difficult for people especially poor people to get a current state photo ID ( which is why we do not want to mandate it for voting ) what are we going to do with 20-30% of the US population that won't have a key?

We need to shift identity theft back onto the businesses being the ones to bear the costs. This would be hard to do, but would be far simpler than trying to force all businesses to use a new identity system (that just ends up being leaked with two years). It creates an incentive for the businesses to care about actually verifying one's id.

I think it's worth mentioning that GDPR was basically exactly this.

They're putting in systematic regulations to ensure that data isn't arbitrarily kept, it must be secure and the regulations have teeth. It's really well thought out - minimize the number of companies that have your data, minimize the data they have, minimize how long they can hold it for and hold them repsonsible for keeping it safe.

Yet, when these regulations were actually bought in, you can see especially on this forum, that people were incredibly sceptical. So whilst you might think that we need to be sensitive to private personal data, it seems like people disagree when it comes to actually implementing that.

I don't think people are skeptical so much as they are aspiring data abusers. They're taking the corporate side over users, over their friends and family.

> I think it's worth mentioning that GDPR was basically exactly this.

There is very little the GDPR would have done to prevent this.

The data was legitimatly collected from customers. It was leaked because of badly configured server or firewall. The company is no longer in business so no fines (or minimal fines) would be paid.

Your argument only makes sense because MoviePass is now gone, but MoviePass didn't design their technology stack planning to go bankrupt. GDPR would've required them to take more reasonable precautions with the storage of private info - knowing that if they failed they could be fined even if they didn't go bankrupt for other reasons.

"The age of privacy is over" (2010) [1]

[1] https://archive.nytimes.com/www.nytimes.com/external/readwri...

The point is a technological solution isn’t viable when societies norms and laws allow it to go unpunished.

You’re barking up the wrong tree trying to engineer a solution before society changes laws that would hold the power brokers accountable.

Push aside your keyboard and get out there advocating for legal accountability.

At the same time, those of us around today have been leaked. I’ve been in tech since the 80s, data tapes went missing all the time. One breach in the 90s resulted in tapes showing up in Russia.

Change the laws. Cause there is no stopping it from a tech perspective.

You’re not needing re-sensitizing. You’re needing to think of the problem outside the context of technical solutions.

I didn't anywhere in my comment say this was a purely technical issue, or that I was advocating a purely technical solution, or that the societal side does or does not need to change, or really anything that you mentioned.

I said I'm apathetic because this happens too much, and that it is a problem. Where you assumed all the other stuff about me, I'm not sure.

At this point, security measures need to assume that your information has been made public.

For the technically savvy, great. I'm sure most of us think like that.

My poor mom on the other hand doesn't necessarily know what that entails, and what steps she should take.

It should not be up to your mom. It needs to be on the banks, government agencies, and everyone else who needs to verify people's identity.

"Oh, you've got the correct address and the last 4 digits of a social" is no longer acceptable as proof that someone is who they say they are. Something else needs to be in place. Whatever that is, the burden should be on the banks, etc. to develop that and explain to your mom what it is and how it works.

I agree with you wholeheartedly, but right now it is up to her. So, your first comment is great for the technically savvy, but everyone else is SOL.

With the billions of records breached this year alone, I'm feeling quite apathetic to these stories now.

My theory is that the lack of punishment is intentional for just such a purpose, in a collusion between government and industry to milk all of us for free data about every aspect of our lives, from the past into the future. They're just going to take it.

You see, people won't demand privacy protections enshrined in law if they simply don't give a shit anymore. Companies don't incur liability, people get some free "credit monitoring" service that should be provided by default.

None of this does anything about the leaked data being used to market to you, manipulate your votes, or worse. Then, at the end of the day Facebook et al doesn't have to worry about their contributory privacy violations at all. If you don't want your private messages sold (rented) to every spammer on Earth, what are you gonna do about it? What's the business case for caring on their part?

Reply on news.ycombinator.com