5 ms·

In case someone is wondering, the previous post - "I'm Testifying to Congress about Data Breaches – What Should I Say? " was discussed here: https://news.ycomb

In case someone is wondering, the previous post - "I'm Testifying to Congress about Data Breaches – What Should I Say? " was discussed here: https://news.ycombinator.com/item?id=15751344 https://news.ycombinator.com/item?id=15751344 Some of the replies really touch upon what can go wrong with government regulation. That said, I do really want something done about this: > An attitude of “data maximisation” is causing services to request extensive personal information well beyond the scope of what is needed to provide that service Stop collecting information which is not required. Most of this information ends up in some form of advertisers/advertisement in guise of creating "more engagement with users".

ashark 9y ago
IMO there should be expensive data breach bond/insurance requirements for any company storing data about people, scaled by how much and possibly which kinds of data are stored. Discourage holding a bunch of stuff "just in case". And FFS, at least outlaw the required arbitration BS for data breaches. Let the bond or insurer pay out when it happens, then jack up their prices on the breached company until they cry.
- pc86 9y ago
  By "until they cry" I assume you mean "until they can no longer continue passing the costs directly to the consumer, at which point they simply go into bankruptcy and reincorporate 6 months later at the lower insurance rate?"
  - ashark 9y ago
    1) if they have competitors, they can't do much "passing along to consumers" to begin with, and 2) I thought insurance companies were supposed to be really good at assessing risk, and markets are magically efficient and all that, so shouldn't the better insurers unravel such schemes? Plus it's not like losing, you know, brand recognition and such is nothing. Point is it should hurt a lot to leak personal data, and it's this or directly regulate (this sort of thing used to be the right-wing way of doing things, but now doing anything at all about these problems, no matter the mechanism, is "left", at least in the US—see also health care)
  - abakker 9y ago
    If the data you hold as a business is so valuable that the insurable risk of loss is too expensive for your business, then ask, "do we really need to hold that data?" If your business needs to pass that on to consumers because you can't afford the hit to your margins, then consumers need to ask, "is [service/product] really worth that much to me?" The downside is that the most critical components of information which tie to identity itself, are the ones that businesses most commonly need to hold to verify identity. More challenging is that without a way to modify identity data (i.e. change your SSN), the insurable risk is huge because it needs to include a discounted cost of identity monitoring forever, and the cost of the individual losses that someone might encounter for the loss of that data. Then of course, if a person's identity is compromised more than once, how do you discount the responsibility across multiple careless parties? IMO it all comes down to never using immutable information (Name, DOB, etc) to firmly define identity online. That information should be for display purposes only. At the backend, we need an identity that is tolerant of change, and can easily be updated if it is ever lost. In reality this will probably mean that instead of an ID, we have ID probability, which would include photos, addresses, ID numbers, Credit card account access, and companies that needed to verify it would be able to evaluate how certain they were the identity was real, and to insure against mishandling of the individual components of information.
    - ashark 9y ago
      > The downside is that the most critical components of information which tie to identity itself, are the ones that businesses most commonly need to hold to verify identity. More challenging is that without a way to modify identity data (i.e. change your SSN), the insurable risk is huge because it needs to include a discounted cost of identity monitoring forever, and the cost of the individual losses that someone might encounter for the loss of that data. Then of course, if a person's identity is compromised more than once, how do you discount the responsibility across multiple careless parties? If it gets expensive enough, maybe banks and CC companies and such will finally get off their asses and fix the whole "identity theft" issue. That's a feature, not a bug. I think the US is too allergic to anything with even a whiff of "secure national ID" for us to let the government fix it, so this is the next best (or, better, depending on your perspective) option. I frankly don't care how we do it, but it's really stupid this is still a thing people have to worry about, and making it cheaper for the banks to fix it than not to fix it seems like the most politically viable solution.
  - curun1r 9y ago
    One would hope that insurers would start proactively setting the rates for their policies based on several factors and not just in response to breaches and payouts. For instance, an insurers exposure would be greatly affected by the types of information collected, so they could offer a lower costs to a business that was only collecting email addresses than to one that collected many more types of PII. You'd also hope that insurers would start to give preferential rates to companies that complete (and resolve) periodic security audits from trusted auditors. The benefits of insurers getting involved is that they can de facto mandate these kinds of security audits and practices by making insurance policies unaffordable without them. And, unlike government regulation, the requirements from insurers can evolve rapidly over time in a way that's difficult for laws to evolve. Insurers will hire security experts to advise on best practices and each have their own ideas of what security means. If a business finds a single security practice onerous, they can shop for an insurer that doesn't require it.
- deleted 9y ago
  [deleted]
- sbov 9y ago
  What data about people would apply? What about public records? Note that if you own property, your name and address are already public.
  - syshum 9y ago
    "Public Records" is part of the maximization problem The Government is more guilty than any business on collecting, hoarding, and making public all kinds of personal information about you. If the government wants to curb data breaches it needs to start cleaning its own house. 90% of "public data" should not be public at all
loeg 9y ago
The information has already been collected and breached, or will be breached eventually. Data minimalism isn't going to put the horse back in the barn, so to speak. (It may help anyone too young to have a credit card, and younger generations.) So we need to do something about identification not relying on knowledge factors for everyone currently over 16.

ashark 9y ago

IMO there should be expensive data breach bond/insurance requirements for any company storing data about people, scaled by how much and possibly which kinds of data are stored. Discourage holding a bunch of stuff "just in case". And FFS, at least outlaw the required arbitration BS for data breaches. Let the bond or insurer pay out when it happens, then jack up their prices on the breached company until they cry.

pc86 9y ago
By "until they cry" I assume you mean "until they can no longer continue passing the costs directly to the consumer, at which point they simply go into bankruptcy and reincorporate 6 months later at the lower insurance rate?"
- ashark 9y ago
  1) if they have competitors, they can't do much "passing along to consumers" to begin with, and 2) I thought insurance companies were supposed to be really good at assessing risk, and markets are magically efficient and all that, so shouldn't the better insurers unravel such schemes? Plus it's not like losing, you know, brand recognition and such is nothing. Point is it should hurt a lot to leak personal data, and it's this or directly regulate (this sort of thing used to be the right-wing way of doing things, but now doing anything at all about these problems, no matter the mechanism, is "left", at least in the US—see also health care)
- abakker 9y ago
  If the data you hold as a business is so valuable that the insurable risk of loss is too expensive for your business, then ask, "do we really need to hold that data?" If your business needs to pass that on to consumers because you can't afford the hit to your margins, then consumers need to ask, "is [service/product] really worth that much to me?" The downside is that the most critical components of information which tie to identity itself, are the ones that businesses most commonly need to hold to verify identity. More challenging is that without a way to modify identity data (i.e. change your SSN), the insurable risk is huge because it needs to include a discounted cost of identity monitoring forever, and the cost of the individual losses that someone might encounter for the loss of that data. Then of course, if a person's identity is compromised more than once, how do you discount the responsibility across multiple careless parties? IMO it all comes down to never using immutable information (Name, DOB, etc) to firmly define identity online. That information should be for display purposes only. At the backend, we need an identity that is tolerant of change, and can easily be updated if it is ever lost. In reality this will probably mean that instead of an ID, we have ID probability, which would include photos, addresses, ID numbers, Credit card account access, and companies that needed to verify it would be able to evaluate how certain they were the identity was real, and to insure against mishandling of the individual components of information.
  - ashark 9y ago
    > The downside is that the most critical components of information which tie to identity itself, are the ones that businesses most commonly need to hold to verify identity. More challenging is that without a way to modify identity data (i.e. change your SSN), the insurable risk is huge because it needs to include a discounted cost of identity monitoring forever, and the cost of the individual losses that someone might encounter for the loss of that data. Then of course, if a person's identity is compromised more than once, how do you discount the responsibility across multiple careless parties? If it gets expensive enough, maybe banks and CC companies and such will finally get off their asses and fix the whole "identity theft" issue. That's a feature, not a bug. I think the US is too allergic to anything with even a whiff of "secure national ID" for us to let the government fix it, so this is the next best (or, better, depending on your perspective) option. I frankly don't care how we do it, but it's really stupid this is still a thing people have to worry about, and making it cheaper for the banks to fix it than not to fix it seems like the most politically viable solution.
- curun1r 9y ago
  One would hope that insurers would start proactively setting the rates for their policies based on several factors and not just in response to breaches and payouts. For instance, an insurers exposure would be greatly affected by the types of information collected, so they could offer a lower costs to a business that was only collecting email addresses than to one that collected many more types of PII. You'd also hope that insurers would start to give preferential rates to companies that complete (and resolve) periodic security audits from trusted auditors. The benefits of insurers getting involved is that they can de facto mandate these kinds of security audits and practices by making insurance policies unaffordable without them. And, unlike government regulation, the requirements from insurers can evolve rapidly over time in a way that's difficult for laws to evolve. Insurers will hire security experts to advise on best practices and each have their own ideas of what security means. If a business finds a single security practice onerous, they can shop for an insurer that doesn't require it.
deleted 9y ago
[deleted]
sbov 9y ago
What data about people would apply? What about public records? Note that if you own property, your name and address are already public.
- syshum 9y ago
  "Public Records" is part of the maximization problem The Government is more guilty than any business on collecting, hoarding, and making public all kinds of personal information about you. If the government wants to curb data breaches it needs to start cleaning its own house. 90% of "public data" should not be public at all

loeg 9y ago

The information has already been collected and breached, or will be breached eventually. Data minimalism isn't going to put the horse back in the barn, so to speak. (It may help anyone too young to have a credit card, and younger generations.) So we need to do something about identification not relying on knowledge factors for everyone currently over 16.