How Many Times Has Your Personal Information Been Exposed to Hackers? | Hacker News Reader

How Many Times Has Your Personal Information Been Exposed to Hackers?

nytimes.com

106 pointsigonvalue33 comments

Just about every organization that I've entrusted my PII to -- insurance companies (thanks, Anthem), banks, government agencies (thanks VA, OPM, DoD), etc., has managed to lose control of it. I don't know why I even bother trying to keep my identity secure.

I'm probably buying 3 houses in 3 different states as I write this.

And I would like to personally thank you for one of those. :)

Same here. I have been made eligible for free credit monitoring services three times in the past year alone.

I think maybe I'll just get really familiar with the FCRA and the FDCPA, so that when someone inevitably uses my stolen PII to commit fraud, I can hit back--and get paid for my inconvenience--when the creditors and reporting agencies fail to do the right thing.

I was the victim of identity theft about 14 years ago from someone employed at my company. My personal situation wasn't too bad, they opened some credit cards. But other employees had their brokerage accounts broken into. In California at least you can "freeze" your credit reports which means you have to pay a small fee and unlock them with a pin code to get credit. I did that many years ago and while it's occasionally a hassle I think it is well worth it to avoid people opening credit in your name.

The best part about the credit monitoring services is that they're inevitably going to get hacked too. Especially Lifelock, which just got fined for having atrocious security practices (reading between the lines a bit, it looked like they were using unhashed passwords on the backend).

There really is no hope.

It seems like the only hope is that they would switch back to a pen and paper system and never digitalize the data... or if they would use an air gap, that would be a good start. But of course you have to make sure that you never say your data around an android phone, an iphone, an amazon device, a smart TV, etc...

Hashing passwords is NOT difficult. It never ceases to amaze me how many online service providers fail to do this.

This is a good tool for determining whether your account has been compromised by hackers:

https://haveibeenpwned.com

Wow. Thanks for that. I didn't even know about the Bitcoin/Gmail breach that came up for my email, and I didn't remember even having an Adobe account.

That might explain a breach I had a while back.

I don't remember signing up to Adobe, but I have a "Welcome" email from February 2011. Was there a free download of Photoshop, or something like that?

CS5 was released in April of 2010. The update CS5.5 was released in May of 2011.

I'm guessing someone used your email address to start a free trial in order to pirate the software. They were either replacing an older version they had, or wanted a free upgrade and attempted to hide their identity.

FYI Photoshop is one of the most pirated pieces of software.

Thanks! Only once, and not at a site i would put legit info on. Not that i ever do really haha.

Useful though. I doubt thats all in reality unfourtanetly.

Thanks, this site is much more useful than the NYTimes article.

The domain search facility there is fantastic. I have my own domain and try to use a different email address for every signup. Luckily that site allows you to do a complete search for @example.com in the 'domain search' tab.

I wonder why searching for "@gmail.com" does not show any result .. are you sure that works as you mentioned?

You have to prove you own the domain for the domain search to work. https://haveibeenpwned.com/DomainSearch

I was expecting a blank page with the word "Yes." centered in large bold letters.

I saw a similar (presumably joke) page a while ago: "enter your CC information and we'll tell you if it's been hacked".

I saw a similar one to tell you if your password was secure; it responded "not anymore".

Thanks for that, very handy

Wow, that OPM attack sure was a doozy. If you check it your entire financial history is out there. Man, I mean, we talk about National Security concerns and some of the bloviating from the feds on Hn all the time. But wow, that OPM hack sure was a heck of a national security attack.

This article takes a rather fatalist perspective. Seems to me companies/government should have a strict need-to-know policy and some liability for failures. If you can't keep information secure, you shouldn't have it. Acting as though it is secure while it is regularly compromised is reckless wishful thinking.

I realize that perfect security is fantasy, but the practices of many of these organizations don't pass the laugh test. We'd be vastly better off if they would hire a security professional and listen to her.

Private information will get leaked one way or another. It's incredibly easy to get someone's address, SS, phone number, etc. The major problem is not with these sites' security but with the credit system's security. The credit agencies have an oligopoly on credit scores and the banks do not care about security at all. They'll approve a credit card application that has been shredded and taped back together, obviously by a fraudster. These are the systems that need to be fixed/removed. Until those systems are fixed, people will continue to have their lives ruined. Let's not put the blame wholly, or even majorly, on these tech companies when many banks still use an SS number as the login.

Until banks are held responsible for their actions which are the only actions that matter as far as identity theft and fraud goes, this will continue to be an unsolved problem. Once you start charging banks the millions it costs for each victim plus a penalty for not fixing their systems that goes up with each case, we'll see that identity fraud will disappear.

Of course, that's justice and justice, at least in the US, is merely a fantasy.

A useful learning tool and an interesting means for shaping public opinion. The NY Times computation takes into account publicly acknowledged exploits; one wonders how many undetected exploits there are. The number computer here is almost certainly a lower bound.

I worry that the clamor about personal information exposure is going to be used to motivate restrictive and ultimately ineffectual government action and, perhaps, kill the goose that has been laying the golden eggs.

I think the only reasonable assumption is to assume it's all exposed, for everybody. Even if you don't use any online services yourself, you still probably have credit cards and insurance and a driver's license and have filed tax returns. It's almost certain that at least one of those has leaked your data.

The only people who are probably really safe from identity theft are people who just aren't in the system at all. Illegal immigrants, longterm homeless, drifters, i.e. people with no established identity to begin with.

I tried to submit this link a few hours back and it HN threw me a "Deadlink" page, strange.

My numbers:

    Address	1
    Birthday	1
    Email	3
    Password (encrypted)	3
    Phone number	2

Overall, not a bad score. (My passwords are strong and unique thanks to my password manager.)

My score, not including the local gas stations and businesses that have been compromised. I have replaced my credit card four times in the past two years due to compromises.

    Address	4
    Birthday	3
    Credit or debit card	2
    Email	5
    Employment history	2
    Financial history	1
    Fingerprints	1
    Health history	
    Password (encrypted)	4
    Phone number	2
    Social Security number	1

Ouch.

I guess that's what I get for not trusting people with my credit card and using cash for everything (and not shopping online hardly ever, except for VPS and domain names)?

Expose... needs new word. I've been exposed to the flu without catching it. It sounds overly theoretical.

I think that's accurate for this situation as well, though. Your information was exposed to hackers -- whether someone does something with it is another situation entirely.

3 times it seems. Maybe it's better to not give any legit details about yourself whenever possible...:)

Privacy is dead. Not just as we knew it, but every dystopian prediction of the future where we are ID'd, tagged, and tracked at every action has already come true.

Not for the sake of some vast government surveillance apparatus (while they are one of the factors behind this movement, the US government is too bloated and largely too incompetent to be effective at this even if they wanted to) but because there is money to be made in knowing our every detail. In our consumer society, marketers/retailers and the companies that cater to their businesses find great value in this information, and as consumers, we largely benefit from having the efficiencies of amazon product recommendations, facebook/twitter suggestions, tailored advertising, etc... at the cost of some loss in privacy. And people have largely silently accepted this, unknowingly or otherwise.

I have a facebook, linkedin, google, github, multiple handhelds, multiple email accounts, I'm a former federal employee, I've had the same phone number for the past 15 years, and countless other retail/online accounts. If you know my name and middle initial, you can find most of my personal information - age, former/current addresses, relatives - through a quick google search on Intelius. I've requested they take down my information several times, and it seems to disappear from their public listing for a while, but reappears after a couple years or after I've moved again.

I accepted long ago that any/all information I post online (and even locally on my Macbook in some cases) is being scraped, compiled, and stored in some DB somewhere. It would only take a little focus and some link analysis to build a comprehensive profile of nearly every detail of my life using some basic selectors - primarily my email and phone. I assume every link, website (yes, including every porn - pornhub has an analytics team!!!), email I write/send, emails I draft but don't send, fb picture I stalk, youtube video I watch is being tracked/stored/compiled somewhere. If it's not by default made public information or being used by the company in question for their profit motives, I assume it will be in the future when the information is hacked/sold/"leaked" for whatever reason.

As I sit here on my school's public WiFi, I know my IP/MAC address/cookies are exposed to those with the know-how, but I've since given up trying to avoid that. Encryption protocols have been broken too many times to count, and while we continually fight for better security methods, those with enough motivation will find ways around - e.g. NSA firmware hacking. I've decided the only information that is truly private are the thoughts in my head, but it seems that even that is subject to debate (look up memory transplants).

It's alright though, because as we head towards the singularity, my consciousness will be assimilated somehow into some Borg-like meta-consciousness anyway. I just hope they have micro-brews available.

Reply on news.ycombinator.com