3 ms·
Me. The less sensitive information on me that is centralized, the better for my privacy and security, as very clearly demonstrated by this leak. If you think E
by wyager 9y ago
Me. The less sensitive information on me that is centralized, the better for my privacy and security, as very clearly demonstrated by this leak.
If you think Equifax's security is bad, wait until you see what it's like at any government agency that doesn't explicitly focus on security.
It's also pretty unlikely that a credit bureau decides to use vast stores of personal information to prosecute people, but governments have done this several times throughout history, perhaps most notably during WWII.
- gglitch 9y ago> The less sensitive information on me that is centralized, the better for my privacy and security This is interesting. I don't agree or disagree with it; I'm not informed enough to stake a position. But as a thought experiment, if we took it as given that any information a given entity tried to keep secure will eventually be revealed publicly, what kind of security infrastructure would we end up with?
- Kalium 9y agoA highly de-centralized one, with information joined together across services only after authentication, authorization, and a lot of artificial identifiers. Or at least, in a context where the people driving product decisions place a high priority on security. In reality, we're in the world you hypothecate right now. Centralization is really convenient for a lot of uses, and security advocates are rarely in a position to impose the kind of privacy controls the rest of us might like. And the average people who buy services LOVE the convenience enabled by centralization - until there's a breach, and they disapprove for a few days.
- Atheros 9y agoI don't think we're proposing a centralized information store- only an identity service.
- wyager 9y ago"Real-name" identity services inherently need to know and store a great deal of identifying information. It's also naive to assume that the government would stop at a straightforward oauth service. They are going to add request tracking (if they don't have it already), background check data, etc. It's too politically and practically appealing to leave it even as privacy-preserving as, say, google oauth (which is a pretty low bar already).
- Fej 9y agoI like to think that fewer try to hack US government services because of the consequences. Attempting to do so would get a black hat chased after by multiple three-letter agencies. I'm sure the FBI is looking into the Equifax breach but not as hard as if someone breached the Social Security Administration.
- banned1 9y agoYou have too much faith in the federal government 3-letters: https://www.google.com/amp/s/www.wired.com/2016/02/hack-brief-fbi-and-dhs-are-targets-in-employee-info-hack/amp/ https://www.google.com/amp/s/www.wired.com/2016/02/hack-brie...