Details of some 100M visitors to Thailand exposed online | Hacker News Reader

Details of some 100M visitors to Thailand exposed online

scmp.com

92 pointsprostoalex48 comments

There's so little culpability for leaks like this. The typical "1yr of credit monitoring" corporations spring for is a joke.

We need stronger laws around data protection, with real consequences.

This sounds extreme but there's a point where I'd be happy to see some areas of government banned from using electronic records. They managed with paper records for decades, and much of the information is "write-once, store forever" anyway.

I recently had my identity stolen and used for the first time. My data has been leaked so many times who knows where it was taken from (40+ hits on haveibeenpawned). The process of clearing the debt in my name was pretty enlightening. I feel like it’s only going downhill from here.

> I recently had my identity stolen and used for the first time. My data has been leaked so many times who knows where it was taken from (40+ hits on haveibeenpawned). The process of clearing the debt in my name was pretty enlightening. I feel like it’s only going downhill from here.

I'm sorry, that's a really crappy experience! I hope you can get things cleared up soon. Back before I realized how easy it is for someone to steal my identity or even what any mitigating steps would be, I had an identity theft and fraud that went unnoticed for so long that I had a summary judgment executed against me by the thief's creditors- imagine my surprise when 1/4 of my paycheck suddenly vanished. Unfortunately, there was no recourse for me- I ended up having to pay for the fraud with 1/4 of my paycheck for a little over a year.

"Unfortunately, there was no recourse for me- I ended up having to pay for the fraud with 1/4 of my paycheck for a little over a year."

Really? That seems insane. You didn't do anything wrong. I would think the creditors themselves are responsible since they didn't check who they were dealing with properly.

> Unfortunately, there was no recourse for me- I ended up having to pay for the fraud with 1/4 of my paycheck for a little over a year.

What country are you in? Or was it just not hiring a lawyer over the debt?

1/4 of your paycheck for a year was garnished (roughly 25% of your WHOLE salary for the year) and you were not able to resolve the issue, and lost all that money?

That is ridiculous. In the US, you'd almost certainly be able to file a lawsuit against the company who leaked the info (if you know... and it wasn't the gov't itself). And 1/4 of my salary would be well worth the legal fees.

This doesn’t add up. How was a summary judgement issued without you ever being served? Why didn’t you appeal the decision after being made aware of the issue?

If you have moved recently and or a few times, and not updated your mailing address etc, they might struggle to get in contact with you. I only noticed mine almost 9 months after the fact due to my credit score dropping ~200 points.

Yeah it sucked but honestly it could have been a lot worse. My credit score rebounded pretty quickly. I also only caught it until after it made it to collections, so very close to where you were. Luckily I work freelance so there weren't any wages to garnish.

In order to create an incentive for a solution to the problem of fraud which occurs when an entity takes insufficient steps to identify you it would be helpful to avoid using the term identity theft.

Companies like to normalize the concept that it is our problem if they do something like opening an account based on widely available public information instead of taking more care in identifying a person. By calling what has happened identity theft it deflects the responsibility from them. You have had your identity stolen and they are victims as much as you? That's preposterous. It's a fraud which has been perpetrated on them and should have nothing to do with you or your identity.

Yep! This is highlighted in a fantastic Mitchell and Webb sketch: https://www.youtube.com/watch?v=CS9ptA3Ya9E

I agree with you to the extent that the conversation should basically be "it's not my fault you were dumb enough to lend money to someone who pretended to be me" and it is 100% the institutions fault. In practice though, I find advocating for language change to be a completely empty gesture. There should be clearer laws or precedents about who is liable, and it seems clear it should be "buyer beware" - for greater clarity by buyer I mean to include the lending institutions. If I lend someone money without properly vetting them, it's obviously going to be on me. It should be no different for institutions.

and if the institutions are "criminally" negligent in their actions? yea, it's fine to tell joe shmoe down the street that it's their fault they trusted an institution, but we have laws about this regarding large companies falsely or not "read, it may be in 35000 pages of text agreed to with a button click" claiming to be secure while not, taking advantage of peoples ignorance or more rightly, being busy, that those who claim anything implicit, whether legal or not, should be the ones to shoulder the burden.

There has been a science developed around "how much can we get away with" and that's the problem. Do you expect joe shmoe to have that kind of budget?

I totally agree with you in theory, but someone went and created debt in my name. That is a form of theft. They used my identity to commit a theft. When I was filing a police report, they were talking about how to file it, as fraud, theft and/or identity theft. I thought it was funny that I was considering the semantics of what type of theft it was as well. I agree that the problem is with the system, but I don't think calling it something else will remove the current onus on the individual vs. the company. Anyways, at the end of the day we were both defrauded.

What I do take issues with is how easy they make it with no compensation. Someone opened an account in my name in a state I haven't been to in 10 years while I was 3000 miles away on the other coast. In the end, I felt like I should have been paid for my time from the company that let this happen because at the end of the day they felt to me like an accomplice.

In the example of a debt in your name, bank was defrauded by someone fooling their staff or computer systems—why should their broken security victimize you?

Identity theft implies something was stolen from you. In fact, that something (your very identity) is unalienable—whatever you do, you are as you as you ever were. The contrary is an oxymoron.

> Identity theft implies something was stolen from you. In fact, that something (your very identity) is unalienable—whatever you do, you are as you as you ever were. The contrary is an oxymoron.

This conflates a metaphysical concept ("identity" as "who one is") with a legal and financial concept ("identity" as "who is authorizing a loan").

The person falling victim to identity theft is still the same person ontologically, but quite a different person financially.

There is a line of feasibility—if John Smith has my face, my fingerprints and all of the passwords, John Smith is not me yet an ordinary institution can reasonably claim that beyond their sophistication to detect—but we are far from approaching that line when we speak of modern identity theft. Today it often sounds more like “someone stole from us by fooling our staff so we will just go ahead and reimburse ourselves from your account, thanks!”

Also, I am not a lawyer (are you?), but I don’t think there is a legal concept of “identity” that is somehow different from the metaphysical I of a person. I could be wrong though.

(I hate to make this argument because in a non-ideal world with malicious actors it appears to advocate for zero-trust dystopia with pervasive biometric checks, which is not my intention.)

> at the end of the day they felt to me like an accomplice.

Precisely, it’s a racket. The financial institutions take other people’s money, create more out of thin air to lend to other people while not checking very much whether they are who they claim they are so they can maximize their interest income, and offload most of the risk onto the government and strangers.

Calling it "identity theft" is like saying it's the fault of the person you called when you dial a wrong number on the phone.

I can't imagine the type of espionage operations the various intelligence agencies can now run against each other.

For example, the OPM database hack (by China, allegedly) leaked pretty much every single US citizen who holds a security clearance. A large power like China could simply hack into the travel databases of countries like Thailand, Netherlands, etc. which are known for vices like prostitution and drugs and send themselves notifications when a target enters an area known for "adult fun".

Blackmail has always been a tactic used by the clandestine intel services, but I imagine it was very expensive and time consuming to track the marks you're after.

But these days you'd be able to do it on a scale orders of magnitudes larger for a few thousands dollars per month in cloud costs, duct taping together some pipeline of the various hacked systems and databases with alerting notifications to your army of part-time "gig operatives" all over the world on your Mechanical Turk payroll, lol

My data was leaked in the OPM hack. I had security clearance at that time.

I'm not entirely sure, but there's a part of me that's paranoid about visiting China. I'd like to for tourism reasons. But at the same time, something inside me says "what if?"

What are you afraid of?

At least personally I’m worried about being held on totally fictitious charges of espionage or sedition. I worked for a national security agency that they particularly despise. So yeah, I won’t be going there to find if they want to harass me or not.

(I also don’t trust my own government to not make up fictitious petty crime charges against me, so maybe I’m paranoid.)

This is what I'm afraid of.

I just worked for some stupid government contractor building web-apps of all things, albeit the product was for a US military branch.

However consider the case of those Canadians held on trumped charges to get back at the US/Canada for arresting the Huawei executive.

There’s also the American who’s sons are currently held in china trying to get the father to return to China on some fraud charges.

Have you been to Taiwan? It's China and the government is not paranoid and obsessed about the US.

Taiwan is most definitely not China and does not share passport/visitor data.

I think they meant it’s cultural heritage is Chinese. Not that it’s part of the PRC government. At least that’s my good faith interpretation.

I think given the intense sensitivity around interpretation, please consider my comment as a clarification.

I’m pretty sure even when the PRC calls them a “renegade” it’s because even they admit it’s a separatist government, even if they consider the separatists illegitimate. Nothing in my comment is insensitive to either government.

It calls itself China and I like to think about China as a culture/people that most of what I saw in Taiwan represents very well, so I call them China. Sorry if I offended your sensibilities.

Securities is not a priority or even medium priority for most startups and even worse government because in some countries, they are just moving from paper to online

Security seems like it needs to be solved at the governmental level with more effective prosecution. I don't imagine that stores would hold up well against physical theft without state protection. Can companies/smaller governments realistically either?

This sounds extremely authoritarian to me. Today, if the state wanted to shutdown the internet backbone, they can by the same means you're alluding to - physical raid at all backbone infrastructure of the internet. That's as much government authority as I am willing to accept.

No privacy . think of all the data breaches going back to 2006. linkedin and yahoo for example. At this point you have to just use throwaway emails and pseudonyms wherever possible.

Governments generally do not accept pseudonyms.

Could institutions realistically accept hash + salt?

Discussed previously here: https://news.ycombinator.com/item?id=28603247

Blackmail material for CCP in some instances. CCP has one of the worlds largest blackmail database culled from hacked social, dating and other underground sites.

So how do you find out if your data is in this breach?

> including their name, passport number and residency status.

is that it?

This could be worse for marriages than the whole AshleyMadison fiasco.

In seriousness, at what point are governments held responsible for their data? If you can't keep it secure, keep it offline!

I had an ex that wanted to actual tourism there. I tried explaining I wasn’t yet retired or single, but she didn’t get it. She ruined a cruise instead.

Are you sure it was her?

You're extremely small minded if you think down on Thailand like this. It's an absolutely gorgeous country!

It doesn't matter how one views a country, it's reality. I got downvoted to hell from people who probably never have been.

Is it beautiful? Absolutely. Does creepy sex tourism make up a noninsignificant amount of it? Yup. I'd wager more than 10%, based on my travels.

Anyone who thinks differently is not in tune with reality.

To be fair I've spent like 4 months in Thailand and sex tourism is focused to just a few small touristic areas. It's barely visibly up in the north, and even Bangkok you only see it if you go near walking street or drive out to Pattaya.

In Amsterdam its way more obvious for example, than in most nice touristic islands.

> Does creepy sex tourism make up a noninsignificant amount of it? Yup

nah, I've been in Thailand for almost 5 years and managed to avoid all of it without any extra effort. You need to actively seek out "sex tourist" scene. In fact digital nomad scene is becomming huge here!

If anyone needs some Thailand tips my contacts are in my profile :)

Reply on news.ycombinator.com