Hacker News Reader

Comment by nathan_f77 | Hacker News Reader

Wow, that's a lot of my personal data leaked in these last months. My email and encrypted password in the adobe breach, my user id and part of my mobile number via SnapChat, and now hackers potentially have scans of my passport courtesy of Mt. Gox.

I'm probably forgetting about some leaks, and who knows how many security breaches were never discovered. The internet is not a safe place.

View on HN

I'm still getting almost daily phishing/malware from the Mt Gox leak in 2011, and I never even signed up for anything more than to see what it's interface was like. Can't imagine how that will be with people having copies of passports (supposedly).

My spam folder is also full of, well, spam addressed to the email address I supplied to Dropbox (and only Dropbox) when I first signed up there sometime in 2011 and later leaked (I think 2012).

Sometimes I wish data privacy laws were stricter, but it appears that not even financial services laws are sufficiently strict, as just demonstrated here.

Please contact Dropbox support about this. Mine vendor-tagged address leaked on or before 3 Feb 2014, as that's when I got the first spam. I'm currently in the middle of persuading them that they have a security issue, and more people expressing the problem would be helpful.

The spam to mine goes back to at least March 2013 (yeah, I like to keep spam, makes it easier to train filters later one…), possibly earlier, so I don’t think that it is a recent leak.

I have stopped using Dropbox shortly after receiving the first such spam email, so I cannot comment on more recent leaks.

Pretty much what mine is too, a pile of spam from various compromises services I should have done better than to trust. Mt Gox, Dropbox, Bitstamp (yeah, they never made a big mention of that one) and a variety of other small services.

> Sometimes I wish data privacy laws were stricter

I think the laws and awareness are good enough atm, but no laws and probably no amount of knowledge or auditing will stop a data leak from indadvertedly occurring.

It happens relatively rarely that a large multinational food company poisons half its customers (or so I like to think), hence I would assume that laws and proper auditing can stop such problems.

In summary I have spent at least five to ten minutes (and likely more) on spam brought to me by Dropbox without any compensation. How about a fixed payout of, say, 100€ per leaked detail (username, password, email etc.), payable immediately to each customer? At least companies with bad security would be out-of-business soon.

For those wondering, I finally got an explanation from them. It turns out they had a leak in 2012:

https://blog.dropbox.com/2012/07/security-update-new-feature...

It's surprising to me that my email address took 2 years to be used, but who knows.

Just a few years back I thought my biggest security risk was myself. In retrospect, this seems horrifically naive: The services I use outnumber me so vastly that the 10 or so breaches that I'm aware of, merely counting the services that I use, seems astoundingly low.

Be aware that they also have a different attack surface, and are likely more notorious/interesting than you as a single person. While I agree that keeping control over your own security is a good thing, the comparison you're making is dangerously biased.

I feel for you bud. I'm a UMD grad (SSN) who shopped at Target in December (CC).

sorry dude..fellow terp here...I never got IDs from the affected campuses and I have had a security freeze on my credit report for a number of years now. hopefully that protects me ):

I signed up for Mint.com once. I liked the concept in theory. But then after an hour of using it, I realized just how incredibly stupid it is giving a third party total access to all your bank accounts. Then I immediately went and changed the passwords on all my bank accounts.

For most large banks it's read only access through purpose built scraping API's. Mint won't be stealing your funds. Generally this is due to Regulation of the financial information space.

But you still have to give them your regular (read/write) credentials.

Was just thinking about the implications of my DL scan being out on the net and potential attempts at identity theft. Excluding market risks, my money is now safer in a properly generated cold bitcoin wallet than it is in my bank account.

So this is actually good news?

and thats just the leaks you know about

Reply on news.ycombinator.com