14 ms·

120M American Households Exposed In 'Massive' ConsumerView Database Leak

465 points by wglb 9y ago

maxxxxx 9y ago
The data is just way too spread between too many companies. Someone will screw up somewhen for sure. Not sure how to solve this. Make it illegal to store data and instead only allow access with permission for specific purposes?
- ams6110 9y ago
  The horse is out of the barn. We need to make the data itself worthless. There's no getting it back.
  - bogomipz 9y ago
    How would we go about making the data worthless?
    - freeflight 9y ago
      One, rather drastic, approach would be making the data of everybody freely available to everybody, think post-privacy society. At least that's how I originally imagined this Internet thing to play out as, too bad it took the exact opposite direction.
      - bllguo 9y ago
        I like drastic, because what else is going to spur the powers that be to revamp how we approach identification? Something dramatic like this is almost necessary at this point. Equifax was huge and yet what reforms have we seen? Is anything even in the pipeline?
        freeflight 9y ago
        I fear this will take the usual course of action: It's gonna get worse until something really bad and really large scale happens, only then will people realize the need to act, but then it's usually already way too late.
        murph-almighty 9y ago
        So Equifax?
        simias 9y ago
        Did the general public really feel the consequences of that data breach personally yet? Not to go all Godwin but when the parent mentioned "something really bad and really large scale" my mind immediately went to the holocaust and other genocides. Can you imagine a totalitarian regime having access to this type of tracking data? It's pretty chilling.
      - jay_kyburz 9y ago
        yeah, I'd prefer the data were simply out there, at least average people would know and understand what is known about themselves.
    - AnimalMuppet 9y ago
      As others have said on other comments on this article, everyone has to stop using that data (all of it) for purposes of verifying that you are who you claim to be. My initial thought was "good luck with that", but maybe, in an ironic sort of way, these breaches are going to force that to happen. "You say someone opened a credit card in my name, and you want me to pay for what they charged? What data did they use to open the account? Um, yeah, have you heard about the Experian breach? So you know that the entire internet has that data about me? Yeah, good luck collecting, suckers." If that holds up in court (at not too great expense for the party being sued to pay the debt that isn't theirs), then financial institutions (all of them) are going to learn very quickly not to rely on that information for anything.
      - ryandrake 9y ago
        If you're a bank, if someone opens an account in my name, it should be your problem, not mine. If you're going to tie something to my identity, you need to require more proof of identity than information that is practically public knowledge (social security numbers, addresses, former addresses, etc.).
      - bogomipz 9y ago
        >"Yeah, good luck collecting, suckers." They don't have to collect, they just ruin your credit and make your life difficult. That's what they do now.
        PeterisP 9y ago
        You can make it illegal for them to do so; many countries require lenders to ensure that they clear any marks on your credit if the claim is disputed and they can't prove it's you; saying "Bob took money from me and didn't give it back" is clearly libel if they can't prove it's true. You don't even have to go to court for that; you simply dispute it and either it goes away or they charge you with fraud if the prosecutor believes that they have solid evidence that it's really you and you're intentionally scamming them. There are options that have been tried, they're just difficult for USA to adopt because of reasons mostly tied to the weirdness of identity and IDs in USA.
- nothrabannosir 9y ago
  Let companies share and do whatever they want but put huge fines on data breaches. Make it a felony to hide, fail to report or otherwise lie about data breaches. Money if you fuck up, prison if you lie about it. that should align some incentives and get you a good way along. It will incentivise proper security measures, and help quench the thirst for data in the first place.
  - DoofusOfDeath 9y ago
    A problem in the U.S. with using criminal law to control wealthy corporations is the doctrine of "prosecutorial discretion".
  - maxxxxx 9y ago
    If no one went to jail for what Wells Fargo did with opening unauthorized accounts I don't have much hope that there will be meaningful fines for data breaches.
  - deleted 9y ago
    [deleted]
ams6110 9y ago
At this point the only reasonable conclusion is that all of your bio/demo, employment, residential history, medical history, insurance claims history, credit history, etc is exposed. These things are no longer valid for identity verification.
RcouF1uZ4gsC 9y ago
Personal data right now is considered an asset. It needs to be seen as a liability. Maybe the solution is a data tax. You pay a set amount every year for every piece of personal data you have. If you buy personal data from another company, you still have to pay the tax for the data you acquired. If you have a breach of data, your tax goes up for a period of 10 years. In addition, every piece of personal data needs to have provenance which must be tracked. There must be a way to track from when a consumer input the data all the way through. Fraud in regards to this provenance is punishable by jail time. If you have data that does not have provenance, the company will be severely fined and people will go to jail. In the event of any data breach, not only will the company that had the breach be taxed extra, all companies that provided the data to the company (which is in the provenance information for the data) that had the breach will also be punished with increased data taxes. EDIT: In addition, maybe require annual personal data reports. The reports should contain Amount of personal data. Amount of personal data last year. Data breaches. Amount of personal data acquired directly from consumers. Amount of personal data purchased and from whom at what prices. Amount of personal data sold and to whom for what price. This will be a filing to a government agency every year on penalty of perjury and be signed by all the board members and the c-suite. This will be publicly made available by the government. That way people can see what is happening with their data, and who is profiting off their data.
- drspacemonkey 9y ago
  Instead of a data tax, I like the idea of mandatory data insurance, with payouts to users whose data is leaked/stolen. If your company has shitty security, or a history of leaks, your data insurance provider will charge out the ass. The financial math has to clearly be on the side of it being more profitable to practice proactive security.
  - QAPereo 9y ago
    Just set a value on the data, a monetary value, and the rest will naturally emerge through insurance and due diligence by insurers.
  - RcouF1uZ4gsC 9y ago
jordonwii 9y ago
The linked article is not very good imo. It goes into almost no detail, despite including two directly contradictory statements: "Yet another cloud storage misconfiguration has exposed personally identifiable information (PII)" and "the data in question contained no names of any individuals or any other personal identifying information" Can we change this to link to the Forbes article referenced in the linked one? It goes into substantially more detail, including reconciling the researcher's claim with Experian's. https://www.forbes.com/sites/thomasbrewster/2017/12/19/120m-american-households-exposed-in-massive-consumerview-database-leak/#707af8c47961 https://www.forbes.com/sites/thomasbrewster/2017/12/19/120m-... edit: didn't even notice the substantially more click-baity headline "Every single American household" vs. "120 million American households".
- PantaloonFlames 9y ago
  The forbes article is good. The original linked article is so poorly written, I thought it was a sham. The Forbes article says that the US is one of the few countries that does not have laws requiring the protection of such information. But let me ask: what would a new law change about this particular incident? Unless the law specifically requires that someone go to jail, then the law will make no difference. The owner of the data didn't mean to expose it all. It just happened. We already know that when companies flout the laws, no person goes to jail. The company pays a fine and everyone continues doing what they were doing. The punishment is irrelevant. With this kind of repercussions, Laws are ineffective.
  - QAPereo 9y ago
    Set a value on the info, statutory value, and suddenly a breach can bankrupt you, you seek insurance, and the insurerers want due diligence of your infosec.
- danielvf 9y ago
  FYI, 120 million American households is only a few percent off from the being all American households. That part at least is fair.
Dowwie 9y ago
Does anyone know what happened to MIT's Enigma project? This is their white paper: http://web.media.mit.edu/~guyzys/data/ZNP15.pdf http://web.media.mit.edu/~guyzys/data/ZNP15.pdf
- bpicolo 9y ago
  https://enigma.co/ https://enigma.co/
mandazi 9y ago
>At issue is once again an Amazon Web Services S3 cloud storage bucket that was misconfigured and inadvertently left open to the public internet, where anyone with a connection online could have found it. I use S3 and I have noticed that by default it's locked down and secure and in order for it to be open you have to open it for the public. Maybe AWS could improve the way it can secure the S3 buckets by making it easier to whitelist access by IPs or some variant to this. Although I personally find it fairly straight forward to use in the projects I work on but it appears it may be difficult and my developers just open it up to the public so their apps can easily access it.
- eric_h 9y ago
  It is just _so_ easy to make the whole thing public vs what it takes for more granular privileges (though I do agree that it's pretty straight forward if you understand how to set bucket policies, etc.). It's really just a couple of clicks in the console - it's a classic usability vs. security problem.
- mcheshier 9y ago
  My biggest problem with S3 is the old multi-layered security model with bucket policies and ACLs. They need to update it to just use IAM like everything else.
  - kgilpin 9y ago
    IAM is also super hard to configure. I would like to see more sense of responsibility from AWS for these leaks rather than blaming the users. It’s bad usability.
    - ghaff 9y ago
      Oh please. AWS can get super-complicated but, especially with the latest console updates, you really have to try to make S3 buckets public. There are good reasons for public buckets; I use them. At this point if you're kicking people, it really is on the developer (or the management of their app dev organization) if they make S3 buckets public "accidentally."
makecheck 9y ago
All personal information sharing should now be purely digital and encryption-keyed. We have all of the protocols, interconnected networking and ubiquitous computing necessary to make it practical. The only “data” any organization should receive is an encrypted blob that is constructed using the key of the person who owns the data and the key of the entity that was directly given the data. Furthermore, the encoded blob should have a date of encoding and a duration of validity. In other words: “I, John Q. Public, authorize You, DataLosingMegaCorp, Inc., to receive This Blob, which is valid for 6 months or until either party revokes the key”. Other public systems in society should be upgraded to require additional layers of security. Want to send commercial snail mail to my home address? Great: please provide the postal service with a one-time authorization code that you received from me (after all, you are using an address given to you by me and not bought from somebody else, right?). Another nice feature would be for data to include bank deposit info for the data owner and bank withdrawl info for the data-receiving entity, where EVERY SINGLE TIME your data is decrypted you receive a cash deposit from the data-receiving entity. And make it sting, a lot: I want it to cost real dollars to use data (and of course, I can still revoke my key at any time if you still manage to do something stupid with my data).
- ThrustVectoring 9y ago
  A big problem with this is that a lot of data about you isn't owned by you. The fact that you took out credit card X on Y date and have paid the balance on time since then is owned by the credit card company you do business with (well, it belongs to you too, but businesses are more willing to trust Chase than you). This information has real business value from being a leading indicator and costly signal of your future propensity to repay debts.
  - CaptSpify 9y ago
    At the risk of speaking for OP: The point is that the data should be owned by me. Yeah, I get that it has value to other people, but I'm the one that has to deal with the fallout, not them. Just because something is useful to a business doesn't mean that they have the right to it. If they want information about me, they should be asking me, not some third party.
wkirby 9y ago
Apparently I take better care of user information on a hobby project running on localhost that will never see a remote server than these giant companies do with real life data.
modeless 9y ago
Apparently anyone who wants this data can simply purchase it from Experian. The leak doesn't change anything except the price.
- dboreham 9y ago
  Back in the day (20 years ago) you could buy a CD with everyone's name, address, phone number and so on..
  - ghaff 9y ago
    Lotus Marketplace cause quite a stir back in the day. Seems rather quaint today. https://en.wikipedia.org/wiki/Lotus_Marketplace https://en.wikipedia.org/wiki/Lotus_Marketplace My understanding is the information was readily available to businesses from other sources. It just popped up on people's radar because Lotus was such a high profile company at the time.
- jimmytucson 9y ago
  Bingo. Ironically, the party that got screwed here is Experian since your PII is their saleable asset. If you want to be mad, be mad about that, not the fact that somebody applied a publicly readable bucket policy to some data they paid tens of thousands of dollars for.
- JPKab 9y ago
  This. Well said.
JepZ 9y ago
Like a bank with an open safe in front of the bank holding all its customers treasures and files.
lgierth 9y ago
Here's the report from UpGuard, who found the breach: https://www.upguard.com/breaches/cloud-leak-alteryx https://www.upguard.com/breaches/cloud-leak-alteryx It has more detailed information about the dataset.
- pishpash 9y ago
  Exactly this. Data intermediaries should only be notaries.
perseusprime11 9y ago
Does it still make sense to shred our personal documents with our names and addresses? Given so many leaks, it may be more easy to get our information online than going through our garbage.
- AnimalMuppet 9y ago
  If I don't shred it, I usually dump it into a particular trash can. The bag from that trash can is the one I usually use for cleaning out the cat litter. If someone wants to steal it from my trash can, it may be possible, but they're going to earn it.
zouhair 9y ago
Another day, another leak, another mass shooting. This is starting to be daily occurrence in the US.
beedogs 9y ago
Maybe companies like this just shouldn't be allowed to store data on people anymore. It's becoming clear that none of them know how to keep it from being stolen. I reckon most people don't even know they're affected by this.
microcolonel 9y ago
Glad all of this stuff is happening before I move to the U.S.
21 9y ago
My reading of this is that anyone who "just want's to see the world burn" needs to pay $40k to Experian and then post this data on the web.
- infinite8s 9y ago
  I think the data probably comes with a license that you can't redistribute it.
ChuckMcM 9y ago
Sigh, Amazon S3 bucket scavenging is today's version of 'war dialing'
hashkb 9y ago
> He found the data was sitting in an Amazon Web Services storage "bucket," left open to anyone with an account, This is hard to believe. S3 bucket names are unique. I can't make a bucket named `bucket`; I'd have to call it `dashkb-bucket` or something (a common convention is to prefix with your company's domain)... anyway... The point is: for the bucket to be named `bucket` Alteryx must have had one of the very first AWS accounts, and from there isn't it reasonable to assume this bucket has been exposed for many years?
- egypturnash 9y ago
  This sentence is not saying that "bucket" is the name of the bucket. It is saying that the data was in a thing that Amazon Web Services provides, which AWS calls a "bucket". Most people who are not web developers don’t even know Amazon Web Services is a thing, much less the cute names of any of their services.
xor1 9y ago
I really want to see the information relevant to me, assuming I'm in the leak. Just to see how accurate it is.
wcr3 9y ago
'Massive'
akane 9y ago
On a related note, here's an open-source project I created that you can use to check your own S3 buckets: https://github.com/ankane/s3tk https://github.com/ankane/s3tk
mrb 9y ago
The headline might as well say "ALL households exposed". The number of households in the US is 126M.
Pokepokalypse 9y ago
If everyone is exposed, no one is. ¯\_(ツ)_/¯
TheYcMaster 9y ago
I imagine this scenario now in EU, where the Smart Meter Gateway will enter millions of households, tracking the electricity consumption. Where goes this data? Who will use this information?
- dsfyu404ed 9y ago
  Somewhere there is a law enforcement organization that's drooling over the thought of automatically generating a list of suspected grow-ops by cross referencing power usage with marketing demographic information and automatically applying for a search warrant. They'll probably stop doing it after they kick down the door of a day-care in a rich neighborhood and only find hot glue guns and those beads you fuse with an iron.
  - jacquesm 9y ago
    That's why savvy grow-ops bypass the meter.
aptsurdist 9y ago
Class action lawsuit? How is it okay that this information is even available from Experian in the first place? I don't think anyone opted in to this. And I don't think there is any obvious way to opt out. And Experian is not just some data tracking company watching your behavior on a website; they're supposed to be protecting our credit system. Do they obtain some of this information through special privileges because they're a pseudo-official credit score agency? If so, is this grounds for a class action lawsuit? (As others have argued, this data is legally available through Experian, it just normally isn't free. https://www.experian.com/assets/dataselect/brochures/consumerview.pdf https://www.experian.com/assets/dataselect/brochures/consume...)
- FeteCommuniste 9y ago
  And they even have us all classified into consumer categories (and sub-categories!) with snappy little names: https://www.experian.com/assets/marketing-services/brochures/mosaic-brochure.pdf https://www.experian.com/assets/marketing-services/brochures... "Blue Sky Boomers," "Significant Singles," "Pastoral Pride" (subgroups: "True Grit Americans," "Countrified Pragmatics," "Rural Southern Bliss," "Touch of Tradition").
Shivetya 9y ago
I would not mind regulation requiring such assemblers have to purchase insurance which provides payouts to those who are damaged by such leaks.
glitcher 9y ago
How is it that addresses and phone numbers are not considered personal identifying information??? Forgetting for a moment the fact that with even a few data points on someone it is getting easier and easier to cross reference other data sources and de-anonymize almost anything - but address and phone numbers are so directly and easily tied to real people this seems like a massive oversight in current regulations on "personal identifying information".
yakt 9y ago
So what is the right order LEAK-DISCUSS-FORGET-SUFFER-REPEAT?

465 points by wglb 9y ago

The data is just way too spread between too many companies. Someone will screw up somewhen for sure. Not sure how to solve this. Make it illegal to store data and instead only allow access with permission for specific purposes?

ams6110 9y ago
The horse is out of the barn. We need to make the data itself worthless. There's no getting it back.
- bogomipz 9y ago
  How would we go about making the data worthless?
  - freeflight 9y ago
    One, rather drastic, approach would be making the data of everybody freely available to everybody, think post-privacy society. At least that's how I originally imagined this Internet thing to play out as, too bad it took the exact opposite direction.
    - bllguo 9y ago
      I like drastic, because what else is going to spur the powers that be to revamp how we approach identification? Something dramatic like this is almost necessary at this point. Equifax was huge and yet what reforms have we seen? Is anything even in the pipeline?
      - freeflight 9y ago
        I fear this will take the usual course of action: It's gonna get worse until something really bad and really large scale happens, only then will people realize the need to act, but then it's usually already way too late.
        murph-almighty 9y ago
        So Equifax?
        simias 9y ago
        Did the general public really feel the consequences of that data breach personally yet? Not to go all Godwin but when the parent mentioned "something really bad and really large scale" my mind immediately went to the holocaust and other genocides. Can you imagine a totalitarian regime having access to this type of tracking data? It's pretty chilling.
    - jay_kyburz 9y ago
      yeah, I'd prefer the data were simply out there, at least average people would know and understand what is known about themselves.
  - AnimalMuppet 9y ago
    As others have said on other comments on this article, everyone has to stop using that data (all of it) for purposes of verifying that you are who you claim to be. My initial thought was "good luck with that", but maybe, in an ironic sort of way, these breaches are going to force that to happen. "You say someone opened a credit card in my name, and you want me to pay for what they charged? What data did they use to open the account? Um, yeah, have you heard about the Experian breach? So you know that the entire internet has that data about me? Yeah, good luck collecting, suckers." If that holds up in court (at not too great expense for the party being sued to pay the debt that isn't theirs), then financial institutions (all of them) are going to learn very quickly not to rely on that information for anything.
    - ryandrake 9y ago
      If you're a bank, if someone opens an account in my name, it should be your problem, not mine. If you're going to tie something to my identity, you need to require more proof of identity than information that is practically public knowledge (social security numbers, addresses, former addresses, etc.).
    - bogomipz 9y ago
      >"Yeah, good luck collecting, suckers." They don't have to collect, they just ruin your credit and make your life difficult. That's what they do now.
      - PeterisP 9y ago
        You can make it illegal for them to do so; many countries require lenders to ensure that they clear any marks on your credit if the claim is disputed and they can't prove it's you; saying "Bob took money from me and didn't give it back" is clearly libel if they can't prove it's true. You don't even have to go to court for that; you simply dispute it and either it goes away or they charge you with fraud if the prosecutor believes that they have solid evidence that it's really you and you're intentionally scamming them. There are options that have been tried, they're just difficult for USA to adopt because of reasons mostly tied to the weirdness of identity and IDs in USA.
nothrabannosir 9y ago
Let companies share and do whatever they want but put huge fines on data breaches. Make it a felony to hide, fail to report or otherwise lie about data breaches. Money if you fuck up, prison if you lie about it. that should align some incentives and get you a good way along. It will incentivise proper security measures, and help quench the thirst for data in the first place.
- DoofusOfDeath 9y ago
  A problem in the U.S. with using criminal law to control wealthy corporations is the doctrine of "prosecutorial discretion".
- maxxxxx 9y ago
  If no one went to jail for what Wells Fargo did with opening unauthorized accounts I don't have much hope that there will be meaningful fines for data breaches.
- deleted 9y ago
  [deleted]

ams6110 9y ago

At this point the only reasonable conclusion is that all of your bio/demo, employment, residential history, medical history, insurance claims history, credit history, etc is exposed. These things are no longer valid for identity verification.

RcouF1uZ4gsC 9y ago

Personal data right now is considered an asset. It needs to be seen as a liability. Maybe the solution is a data tax. You pay a set amount every year for every piece of personal data you have. If you buy personal data from another company, you still have to pay the tax for the data you acquired. If you have a breach of data, your tax goes up for a period of 10 years. In addition, every piece of personal data needs to have provenance which must be tracked. There must be a way to track from when a consumer input the data all the way through. Fraud in regards to this provenance is punishable by jail time. If you have data that does not have provenance, the company will be severely fined and people will go to jail. In the event of any data breach, not only will the company that had the breach be taxed extra, all companies that provided the data to the company (which is in the provenance information for the data) that had the breach will also be punished with increased data taxes. EDIT: In addition, maybe require annual personal data reports. The reports should contain Amount of personal data. Amount of personal data last year. Data breaches. Amount of personal data acquired directly from consumers. Amount of personal data purchased and from whom at what prices. Amount of personal data sold and to whom for what price. This will be a filing to a government agency every year on penalty of perjury and be signed by all the board members and the c-suite. This will be publicly made available by the government. That way people can see what is happening with their data, and who is profiting off their data.

drspacemonkey 9y ago
Instead of a data tax, I like the idea of mandatory data insurance, with payouts to users whose data is leaked/stolen. If your company has shitty security, or a history of leaks, your data insurance provider will charge out the ass. The financial math has to clearly be on the side of it being more profitable to practice proactive security.
- QAPereo 9y ago
  Just set a value on the data, a monetary value, and the rest will naturally emerge through insurance and due diligence by insurers.
- RcouF1uZ4gsC 9y ago

jordonwii 9y ago

The linked article is not very good imo. It goes into almost no detail, despite including two directly contradictory statements: "Yet another cloud storage misconfiguration has exposed personally identifiable information (PII)" and "the data in question contained no names of any individuals or any other personal identifying information" Can we change this to link to the Forbes article referenced in the linked one? It goes into substantially more detail, including reconciling the researcher's claim with Experian's. https://www.forbes.com/sites/thomasbrewster/2017/12/19/120m-american-households-exposed-in-massive-consumerview-database-leak/#707af8c47961 https://www.forbes.com/sites/thomasbrewster/2017/12/19/120m-... edit: didn't even notice the substantially more click-baity headline "Every single American household" vs. "120 million American households".

PantaloonFlames 9y ago
The forbes article is good. The original linked article is so poorly written, I thought it was a sham. The Forbes article says that the US is one of the few countries that does not have laws requiring the protection of such information. But let me ask: what would a new law change about this particular incident? Unless the law specifically requires that someone go to jail, then the law will make no difference. The owner of the data didn't mean to expose it all. It just happened. We already know that when companies flout the laws, no person goes to jail. The company pays a fine and everyone continues doing what they were doing. The punishment is irrelevant. With this kind of repercussions, Laws are ineffective.
- QAPereo 9y ago
  Set a value on the info, statutory value, and suddenly a breach can bankrupt you, you seek insurance, and the insurerers want due diligence of your infosec.
danielvf 9y ago
FYI, 120 million American households is only a few percent off from the being all American households. That part at least is fair.

Dowwie 9y ago

Does anyone know what happened to MIT's Enigma project? This is their white paper: http://web.media.mit.edu/~guyzys/data/ZNP15.pdf http://web.media.mit.edu/~guyzys/data/ZNP15.pdf

bpicolo 9y ago
https://enigma.co/ https://enigma.co/

mandazi 9y ago

>At issue is once again an Amazon Web Services S3 cloud storage bucket that was misconfigured and inadvertently left open to the public internet, where anyone with a connection online could have found it. I use S3 and I have noticed that by default it's locked down and secure and in order for it to be open you have to open it for the public. Maybe AWS could improve the way it can secure the S3 buckets by making it easier to whitelist access by IPs or some variant to this. Although I personally find it fairly straight forward to use in the projects I work on but it appears it may be difficult and my developers just open it up to the public so their apps can easily access it.

eric_h 9y ago
It is just _so_ easy to make the whole thing public vs what it takes for more granular privileges (though I do agree that it's pretty straight forward if you understand how to set bucket policies, etc.). It's really just a couple of clicks in the console - it's a classic usability vs. security problem.
mcheshier 9y ago
My biggest problem with S3 is the old multi-layered security model with bucket policies and ACLs. They need to update it to just use IAM like everything else.
- kgilpin 9y ago
  IAM is also super hard to configure. I would like to see more sense of responsibility from AWS for these leaks rather than blaming the users. It’s bad usability.
  - ghaff 9y ago
    Oh please. AWS can get super-complicated but, especially with the latest console updates, you really have to try to make S3 buckets public. There are good reasons for public buckets; I use them. At this point if you're kicking people, it really is on the developer (or the management of their app dev organization) if they make S3 buckets public "accidentally."

makecheck 9y ago

All personal information sharing should now be purely digital and encryption-keyed. We have all of the protocols, interconnected networking and ubiquitous computing necessary to make it practical. The only “data” any organization should receive is an encrypted blob that is constructed using the key of the person who owns the data and the key of the entity that was directly given the data. Furthermore, the encoded blob should have a date of encoding and a duration of validity. In other words: “I, John Q. Public, authorize You, DataLosingMegaCorp, Inc., to receive This Blob, which is valid for 6 months or until either party revokes the key”. Other public systems in society should be upgraded to require additional layers of security. Want to send commercial snail mail to my home address? Great: please provide the postal service with a one-time authorization code that you received from me (after all, you are using an address given to you by me and not bought from somebody else, right?). Another nice feature would be for data to include bank deposit info for the data owner and bank withdrawl info for the data-receiving entity, where EVERY SINGLE TIME your data is decrypted you receive a cash deposit from the data-receiving entity. And make it sting, a lot: I want it to cost real dollars to use data (and of course, I can still revoke my key at any time if you still manage to do something stupid with my data).

ThrustVectoring 9y ago
A big problem with this is that a lot of data about you isn't owned by you. The fact that you took out credit card X on Y date and have paid the balance on time since then is owned by the credit card company you do business with (well, it belongs to you too, but businesses are more willing to trust Chase than you). This information has real business value from being a leading indicator and costly signal of your future propensity to repay debts.
- CaptSpify 9y ago
  At the risk of speaking for OP: The point is that the data should be owned by me. Yeah, I get that it has value to other people, but I'm the one that has to deal with the fallout, not them. Just because something is useful to a business doesn't mean that they have the right to it. If they want information about me, they should be asking me, not some third party.

wkirby 9y ago

Apparently I take better care of user information on a hobby project running on localhost that will never see a remote server than these giant companies do with real life data.

modeless 9y ago

Apparently anyone who wants this data can simply purchase it from Experian. The leak doesn't change anything except the price.

dboreham 9y ago
Back in the day (20 years ago) you could buy a CD with everyone's name, address, phone number and so on..
- ghaff 9y ago
  Lotus Marketplace cause quite a stir back in the day. Seems rather quaint today. https://en.wikipedia.org/wiki/Lotus_Marketplace https://en.wikipedia.org/wiki/Lotus_Marketplace My understanding is the information was readily available to businesses from other sources. It just popped up on people's radar because Lotus was such a high profile company at the time.
jimmytucson 9y ago
Bingo. Ironically, the party that got screwed here is Experian since your PII is their saleable asset. If you want to be mad, be mad about that, not the fact that somebody applied a publicly readable bucket policy to some data they paid tens of thousands of dollars for.
JPKab 9y ago
This. Well said.

JepZ 9y ago

Like a bank with an open safe in front of the bank holding all its customers treasures and files.

lgierth 9y ago

Here's the report from UpGuard, who found the breach: https://www.upguard.com/breaches/cloud-leak-alteryx https://www.upguard.com/breaches/cloud-leak-alteryx It has more detailed information about the dataset.

pishpash 9y ago
Exactly this. Data intermediaries should only be notaries.

perseusprime11 9y ago

Does it still make sense to shred our personal documents with our names and addresses? Given so many leaks, it may be more easy to get our information online than going through our garbage.

AnimalMuppet 9y ago
If I don't shred it, I usually dump it into a particular trash can. The bag from that trash can is the one I usually use for cleaning out the cat litter. If someone wants to steal it from my trash can, it may be possible, but they're going to earn it.

zouhair 9y ago

Another day, another leak, another mass shooting. This is starting to be daily occurrence in the US.

beedogs 9y ago

Maybe companies like this just shouldn't be allowed to store data on people anymore. It's becoming clear that none of them know how to keep it from being stolen. I reckon most people don't even know they're affected by this.

microcolonel 9y ago

Glad all of this stuff is happening before I move to the U.S.

21 9y ago

My reading of this is that anyone who "just want's to see the world burn" needs to pay $40k to Experian and then post this data on the web.

infinite8s 9y ago
I think the data probably comes with a license that you can't redistribute it.

ChuckMcM 9y ago

Sigh, Amazon S3 bucket scavenging is today's version of 'war dialing'

hashkb 9y ago

> He found the data was sitting in an Amazon Web Services storage "bucket," left open to anyone with an account, This is hard to believe. S3 bucket names are unique. I can't make a bucket named `bucket`; I'd have to call it `dashkb-bucket` or something (a common convention is to prefix with your company's domain)... anyway... The point is: for the bucket to be named `bucket` Alteryx must have had one of the very first AWS accounts, and from there isn't it reasonable to assume this bucket has been exposed for many years?

egypturnash 9y ago
This sentence is not saying that "bucket" is the name of the bucket. It is saying that the data was in a thing that Amazon Web Services provides, which AWS calls a "bucket". Most people who are not web developers don’t even know Amazon Web Services is a thing, much less the cute names of any of their services.

xor1 9y ago

I really want to see the information relevant to me, assuming I'm in the leak. Just to see how accurate it is.

wcr3 9y ago

'Massive'

akane 9y ago

On a related note, here's an open-source project I created that you can use to check your own S3 buckets: https://github.com/ankane/s3tk https://github.com/ankane/s3tk

mrb 9y ago

The headline might as well say "ALL households exposed". The number of households in the US is 126M.

Pokepokalypse 9y ago

If everyone is exposed, no one is. ¯\_(ツ)_/¯

TheYcMaster 9y ago

I imagine this scenario now in EU, where the Smart Meter Gateway will enter millions of households, tracking the electricity consumption. Where goes this data? Who will use this information?

dsfyu404ed 9y ago
Somewhere there is a law enforcement organization that's drooling over the thought of automatically generating a list of suspected grow-ops by cross referencing power usage with marketing demographic information and automatically applying for a search warrant. They'll probably stop doing it after they kick down the door of a day-care in a rich neighborhood and only find hot glue guns and those beads you fuse with an iron.
- jacquesm 9y ago
  That's why savvy grow-ops bypass the meter.

aptsurdist 9y ago

Class action lawsuit? How is it okay that this information is even available from Experian in the first place? I don't think anyone opted in to this. And I don't think there is any obvious way to opt out. And Experian is not just some data tracking company watching your behavior on a website; they're supposed to be protecting our credit system. Do they obtain some of this information through special privileges because they're a pseudo-official credit score agency? If so, is this grounds for a class action lawsuit? (As others have argued, this data is legally available through Experian, it just normally isn't free. https://www.experian.com/assets/dataselect/brochures/consumerview.pdf https://www.experian.com/assets/dataselect/brochures/consume...)

FeteCommuniste 9y ago
And they even have us all classified into consumer categories (and sub-categories!) with snappy little names: https://www.experian.com/assets/marketing-services/brochures/mosaic-brochure.pdf https://www.experian.com/assets/marketing-services/brochures... "Blue Sky Boomers," "Significant Singles," "Pastoral Pride" (subgroups: "True Grit Americans," "Countrified Pragmatics," "Rural Southern Bliss," "Touch of Tradition").

Shivetya 9y ago

I would not mind regulation requiring such assemblers have to purchase insurance which provides payouts to those who are damaged by such leaks.

glitcher 9y ago

How is it that addresses and phone numbers are not considered personal identifying information??? Forgetting for a moment the fact that with even a few data points on someone it is getting easier and easier to cross reference other data sources and de-anonymize almost anything - but address and phone numbers are so directly and easily tied to real people this seems like a massive oversight in current regulations on "personal identifying information".

yakt 9y ago

So what is the right order LEAK-DISCUSS-FORGET-SUFFER-REPEAT?