3 ms·

It's data breaches all the way down, and there's only so many hours in the day. I choose to worry about just two: * The OPM breach: https://www.opm.gov/cyberse

It's data breaches all the way down, and there's only so many hours in the day. I choose to worry about just two: * The OPM breach: https://www.opm.gov/cybersecurity/cybersecurity-incidents https://www.opm.gov/cybersecurity/cybersecurity-incidents * Equifax: https://www.consumer.ftc.gov/blog/2017/09/equifax-data-breach-what-do https://www.consumer.ftc.gov/blog/2017/09/equifax-data-breac... In both cases the amount of data leaked per person is huge, way more than just an email address or credit card number. And in both cases there was no way for customers to opt out of their data being gathered. Those two characteristics seem related. The most valuable data isn't going to be somewhere that is subject to regulations like GDPR. And it's going to be running on the same insecure stacks and practices as everything else we see. If we want to plug holes, these are the sorts of places where we need to begin. Facebook is a child's bagatelle in comparison. MyFitnessPal doesn't even register.

caseysoftware 9y ago
Good call. Those are the most devastating by far because the first is effectively a bad mail database while the second destroys most forms of identity proofing for all time. Though it's unfair calling the OPM incident a "breach" as management of the database was outsourced to an outsourcer to an outsourcer so the final party had full read/write access over it for potentially years. As I noted at the time, every clearance granted or denied during that period must be reviewed.[0] 0 - http://caseysoftware.com/blog/opm-background-check-hack-a-different-angle http://caseysoftware.com/blog/opm-background-check-hack-a-di... (I had a clearance previously so I was included in this one.)
jjeaff 9y ago
I agree. The media talked just as much about the Target POS breach as they did Equifax. But losing credit card numbers is merely an inconvenience. CC users aren't even liable. On the other hand, losing your SSN and other supporting details can be devestating.

caseysoftware 9y ago

Good call. Those are the most devastating by far because the first is effectively a bad mail database while the second destroys most forms of identity proofing for all time. Though it's unfair calling the OPM incident a "breach" as management of the database was outsourced to an outsourcer to an outsourcer so the final party had full read/write access over it for potentially years. As I noted at the time, every clearance granted or denied during that period must be reviewed.[0] 0 - http://caseysoftware.com/blog/opm-background-check-hack-a-different-angle http://caseysoftware.com/blog/opm-background-check-hack-a-di... (I had a clearance previously so I was included in this one.)

jjeaff 9y ago

I agree. The media talked just as much about the Target POS breach as they did Equifax. But losing credit card numbers is merely an inconvenience. CC users aren't even liable. On the other hand, losing your SSN and other supporting details can be devestating.