Hacker News Reader

Comment by itsalotoffun | Hacker News Reader

I WISH this mattered. I wish data breaches actually carried consequences. I wish people cared about this. But people don't care. Right up until you're targeted for ID theft, fraud or whatever else. But by then the causality feels so diluted that it's "just one of those things" that happens randomly to good people, and there's "nothing you can do". Horseshit.

View on HN

We should also stop calling it ID theft. The identity is not stolen, the owner do still have it. Calling it ID theft is moving the responsibility from the one that a fraud is against (often banks or other large entities) to an innocent 3rd party

Yes tricking a bank into thinking you are one of their customers is not the same as assuming someone else’s identity.

As always, Mitchell and Webb hit the nail precisely on the head.

https://www.youtube.com/watch?v=CS9ptA3Ya9E

> Calling it ID theft is moving the responsibility from the one that a fraud is against (often banks or other large entities)

The victim of ID theft is the person whose ID was stolen. The damage to banks or other large entities pales in comparison to the damage to those people.

I did probably not formulate myself good enough. By calling it ID theft you are blaming the person the ID belongs to and that person have to prove they are innocent. By calling it by the correct words, bank fraud, the bank have to prove that the person the ID belongs to did it. No ID was stolen, it was only used by someone else to commit fraud. The banks don't have enough security to stop it because they have gotten away with calling it ID theft and putting the blame on the person the ID belongs to

While I agree that bank fraud is a more accurate and just labeling, I observe that people are required to prove their innocence regularly.

It’s not clear to me how this is a data breach at all. Did the researchers hack into some database and steal information? No?

Because afaik everything they collected was public web. So now researchers are being lambasted for having data in their sets that others released

That said, masking obvious numbers like SSN is low hanging fruit. Trying to obviate every piece of public information about a person that can identify them is insane.

It doesn't now, but we could collectively decide to introduce consequences of the kind that deter anybody willing to try this again.

What's the right consequence in your opinion?

Criminal liability with a minimum 2 years served for executives and fines amounting to 110% of total global revenue to the company that allowed the breach would see cybersecurity taken a lot more seriously in a hurry

Would be nice to have executives finally responsible for something.

Internet commerce requires databases with pii that will be breached.

Who is to blame for internet commerce?

Our legislators. Maybe specifically we can blame Al Gore, the man who invented the internet. If we had put warning labels on the internet like we did with NWA and 2 live crew, Gore’s second best achievement, we wouldn’t be a failed democracy right now.

A stolen identity destroys the life of the victim, and there's going to be more than one. They (every single involved CEO) should have all of their assets seized, to be put in a fund that is used to provide free legal support to the victims. Then they should go to a low-security prison and have mandatory community service for the rest of their lives.

They probably can't be redeemed and we should recognise that, but that doesn't mean they can't spend the rest of their life being forced to be useful to society in a constructive way. Any sort of future offense (violence, theft, assault, anything really) should mean we give up on them. Then they should be humanely put down.

Reply on news.ycombinator.com