7 ms·

It's interesting that we consider this a leak only when the marketing firm loses the data. If we lived in a just society we would consider it a leak once the ma

It's interesting that we consider this a leak only when the marketing firm loses the data. If we lived in a just society we would consider it a leak once the marketing firm got the data.

JoeAltmaier 8y ago
And what really changed? They used to sell the data, right? Now everybody has it (instead of only a percent). Is that worse?
- cmpb 8y ago
  This is pretty much where I’m at as well, on this issue. I only wish there were social security numbers contained in the breach so that we could stop considering them as personally identifiable info.
  - seandougall 8y ago
    I agree with your meaning, and I think it goes beyond that. SSNs really are PII by definition; what we need to do is stop pretending that we can use any kind of PII in general as a form of authentication. Whether it's SSN, mother's maiden name, or any of these inane "security questions" that (thank goodness) finally seem to be receding from their peak, we need to move away from the fundamentally broken "tell me something about yourself that only you would know" model of authentication.
    - cmpb 8y ago
      Agreed. Thank you for formalizing that ideal more coherently.
dbllxr 8y ago
more sad than interesting because we normally don't know when and which firm(s) got our data. I never heard of this company until today.
CiPHPerCoder 8y ago
It's a leak because there wasn't an invoice attached to what would otherwise be business as usual: the data being obtained by sketchy third parties.
- hugi 8y ago
  Marketing companies are sketchy third parties.
  - CiPHPerCoder 8y ago
    That was a significant component of my point.
mtgx 8y ago
I've been a proponent of this idea: Make companies "super-liable" for any data beyond the data they (actually) need for the functioning of the service that is stolen in a data breach from their servers. This would hopefully not just encourage more companies to believe that data is "toxic" [1] and treat it as a liability, not as an asset, but it would also encourage them to adopt end-to-end encryption in as many types of services as possible (and eventually stuff like homomorphic encryption or any form of encryption that doesn't give the company itself and hackers direct access to the data). [1] - https://www.schneier.com/blog/archives/2016/03/data_is_a_toxic.html https://www.schneier.com/blog/archives/2016/03/data_is_a_tox...
- 18pfsmt 8y ago
  The data in this case is their only asset. They are a data broker, and their entire existence is predicated on the idea that this data is valuable to them. I think we need to teach people that their data is valuable, likely dangerous in the hands of others, and not to spew it all over the web. Kinda like we did before FB convinced everybody to use their real names.
  - grasshopperpurp 8y ago
    >The data in this case is their only asset. They are a data broker, and their entire existence is predicated on the idea that this data is valuable to them. Other than them, who cares? If you want to put people in harm's way, you should accept the consequences when harm occurs. >I think we need to teach people that their data is valuable, likely dangerous in the hands of others, and not to spew it all over the web. Kinda like we did before FB convinced everybody to use their real names. No, it's much easier to hold the companies accountable, and they should be held accountable. No company that suffers a "data breach" should have the resources to exist after the breach. Society should punish them out of existence, because they are known cancers.
- astura 8y ago
  Considering that their entire business model is "selling this data" then this data is actually needed for the functioning of the service.
un-devmox 8y ago
> It's interesting that we consider this a leak only when the marketing firm loses the data. We don't consider this a leak when the marketing firm loses its data. It's only a leak when we find out that the marketing firm has lost control of its data.

It's interesting that we consider this a leak only when the marketing firm loses the data. If we lived in a just society we would consider it a leak once the marketing firm got the data.

JoeAltmaier 8y ago

And what really changed? They used to sell the data, right? Now everybody has it (instead of only a percent). Is that worse?

cmpb 8y ago
This is pretty much where I’m at as well, on this issue. I only wish there were social security numbers contained in the breach so that we could stop considering them as personally identifiable info.
- seandougall 8y ago
  I agree with your meaning, and I think it goes beyond that. SSNs really are PII by definition; what we need to do is stop pretending that we can use any kind of PII in general as a form of authentication. Whether it's SSN, mother's maiden name, or any of these inane "security questions" that (thank goodness) finally seem to be receding from their peak, we need to move away from the fundamentally broken "tell me something about yourself that only you would know" model of authentication.
  - cmpb 8y ago
    Agreed. Thank you for formalizing that ideal more coherently.

dbllxr 8y ago

more sad than interesting because we normally don't know when and which firm(s) got our data. I never heard of this company until today.

CiPHPerCoder 8y ago

It's a leak because there wasn't an invoice attached to what would otherwise be business as usual: the data being obtained by sketchy third parties.

hugi 8y ago
Marketing companies are sketchy third parties.
- CiPHPerCoder 8y ago
  That was a significant component of my point.

mtgx 8y ago

I've been a proponent of this idea: Make companies "super-liable" for any data beyond the data they (actually) need for the functioning of the service that is stolen in a data breach from their servers. This would hopefully not just encourage more companies to believe that data is "toxic" [1] and treat it as a liability, not as an asset, but it would also encourage them to adopt end-to-end encryption in as many types of services as possible (and eventually stuff like homomorphic encryption or any form of encryption that doesn't give the company itself and hackers direct access to the data). [1] - https://www.schneier.com/blog/archives/2016/03/data_is_a_toxic.html https://www.schneier.com/blog/archives/2016/03/data_is_a_tox...

18pfsmt 8y ago
The data in this case is their only asset. They are a data broker, and their entire existence is predicated on the idea that this data is valuable to them. I think we need to teach people that their data is valuable, likely dangerous in the hands of others, and not to spew it all over the web. Kinda like we did before FB convinced everybody to use their real names.
- grasshopperpurp 8y ago
  >The data in this case is their only asset. They are a data broker, and their entire existence is predicated on the idea that this data is valuable to them. Other than them, who cares? If you want to put people in harm's way, you should accept the consequences when harm occurs. >I think we need to teach people that their data is valuable, likely dangerous in the hands of others, and not to spew it all over the web. Kinda like we did before FB convinced everybody to use their real names. No, it's much easier to hold the companies accountable, and they should be held accountable. No company that suffers a "data breach" should have the resources to exist after the breach. Society should punish them out of existence, because they are known cancers.
astura 8y ago
Considering that their entire business model is "selling this data" then this data is actually needed for the functioning of the service.

un-devmox 8y ago

> It's interesting that we consider this a leak only when the marketing firm loses the data. We don't consider this a leak when the marketing firm loses its data. It's only a leak when we find out that the marketing firm has lost control of its data.