6 ms·

At this point I am operating on the assumption that ALL businesses that have my data are going to inadvertently leak it at some point, and thus I am attemtping

At this point I am operating on the assumption that ALL businesses that have my data are going to inadvertently leak it at some point, and thus I am attemtping to provide individual companies with as little information about me as possible. The toughest ones here are my online banking and my online health portal, but other than that, I have gotten pretty picky about what information I give any company.

Yhippa 8y ago
If they get your data from brokers they may be building comprehensive profiles about you without your explicit permission.
beefsack 8y ago
This is a healthy mindset to have. I feel that for every company that self-reports a leak, there are multiple other companies that have leaked your data and either haven't discovered the breach, refuse to disclose it, or flat out sold your data to the highest bidder.
- SOLAR_FIELDS 8y ago
  I’m even more worried about the ones that don’t have the facilities to even detect and know they’ve been breached.
- spydum 8y ago
  You would be correct. In the US, which I might remind you, does not have a national law on the books regarding data breach notification. Even at the state levels, it’s varies pretty wildly on top of, most notifications are only required if there is evidence. So here is the challenge: what if I keep no logs, and have terrible security monitoring capability? If I am notified or discover a critical vulnerability on my own, but have inadequate logs to show or detect if it was exploited... am I required to notify? I have been told no (I fervently disagreed; I think suspected breaches, or critical vulnerabilities which may lead to breaches but were inconclusive should still require notification).
  - jwr 8y ago
    Still, I would have thought it is good practice to notify your users if you leak their data to thieves. Quora did the right thing and should be applauded. As a counterexample, it seems that Newegg had a massive breach (thieves installed JavaScript that skimmed credit card numbers for weeks) in August, and even though my credit card was likely stolen, I hever heard about it from Newegg.
    - monetus 8y ago
      How did you find out they did that? Just following tech news?
      - jwr 8y ago
        Yes, see for example https://techcrunch.com/2018/09/19/newegg-credit-card-data-breach/ https://techcrunch.com/2018/09/19/newegg-credit-card-data-br...
    - bigtunacan 8y ago
      Not sure why you didn't hear from Newegg, but they did send out a mass email notification with details of the breach.
      - mtone 8y ago
        I somehow got their email a week or so after the event, and after my card's fraud prevention called for suspicious activity, reverted the transactions and cancelled my card. The bank official was not aware of the leak.
      - jwr 8y ago
        They did? I never got anything from them. And I was definitely within the time window.
  - pgrote 8y ago
    >In the US, which I might remind you, does not have a national law on the books regarding data breach notification. Our federal government is beholden to corporations, so I don't see any legislation ever happening to punish nor place a regulatory significance on breaches. If the Equifax debacle didn't move the needle, nothing will. How they didn't get a death penalty for not protecting one of the supports of our financial system I will never know. As the parent said, I've just assumed all my data will be breached eventually. When it occurs I dutifully sign up for the monitoring offered and make sure to review things on a monthly basis. Your comment on breach notification is spot on. WISH.COM has suffered down line breaches in their process and it is easy to prove by the use of virtual credit card numbers ... numbers that are generated and used at only one site. They have been silent when it is reported to them.
- deleted 8y ago
  [deleted]
aviv 8y ago
I have an email address that I've only ever used as my AWS account email since many years ago. Somehow I started getting spam on it last year. It is not an address anyone could guess or somehow generate based on other data points such as name or otherwise.
- hkai 8y ago
  I am using a separate email for each website, using the catch-all email feature. It helped me find out a couple of local companies that are selling my data to spammers.
- bhauer 8y ago
  Many of us who operate our own mail services use a unique email address for every web service we use. You'd be surprised how many of these unique email addresses I've received spam at (and have subsequently blackholed). I would estimate less than 50% of the associated services ever report a data breach event. I figure either there has been an unreported breach or, possibly more likely, the service sold their userlist either directly to spammers or sold it to another group who was themselves breached. The upside, though, is that blackholing an address used for a single service is super simple and satisfying.
  - scomp 8y ago
    Do you have any more info on running your own mail server? I looked at doing so but was promptly steered away because of blacklisting, servers that allow it and redundancy.
    - yerasame 8y ago
      I'm not sure what the up or downsides would be, but I personally just have all mail sent to *@mydomain.tld forwarded to a single email address. This way I can give each service a unique email address, while preserving the ability to divine whether a particular address has been lost or stolen, by looking at the sent to field. Well, there's the obvious comfort of having all your mail in one place -- and all the obvious disadvantages that entails, I suppose.
anonytrary 8y ago
This mindset reminds me of the following "laws": Anything that can go wrong, will go wrong [0]. Anything that's isn't disallowed by quantum mechanics, will eventually happen [1]. So, if businesses made it cryptographically impossible to leak data, maybe it wouldn't happen, assuming it is even possible to make it impossible... [0] https://en.wikiquote.org/wiki/Murphy%27s_law https://en.wikiquote.org/wiki/Murphy%27s_law [1] https://en.wikipedia.org/wiki/Totalitarian_principle https://en.wikipedia.org/wiki/Totalitarian_principle
- anticensor 8y ago
  Anything can go wrong, will go wrong in the worst possible moment (Sod's law).
rinze 8y ago
Data is binary: it has either been already leaked, or not yet.
Pmop 8y ago
That being said, I wonder if it's a good idea to extend KeePass to generate full credentials for given website.
h1d 8y ago
You wouldn't know where the data goes to anyway even without any unintentional leaks. No need to provide more than necessary.
wpietri 8y ago
Yeah, I tag every email address I give to a vendor, and I have for years. It has helped me discover a number of breaches. The address I gave Quora isn't in the hands of spammers yet, which is a mildly good sign. But normally it takes a while for an address to get out to the bottom-feeders, so we'll see.
- halvardssm 8y ago
  > Yeah, I tag every email address I give to a vendor, and I have for years. It has helped me discover a number of breaches. Can you go into detail on this? What exactly do you mean by tagging? Just wondering in case I want to do the same.
  - wpietri 8y ago
    There are a few ways to do it, but I use what is known as subaddressing: https://tools.ietf.org/html/rfc5233 https://tools.ietf.org/html/rfc5233
jedberg 8y ago
Luckily your bank and your health provider probably have decent security, because those two industries face extra heavy fines for breaches.
- harshreality 8y ago
  Yes, heavily regulated banks and medical providers have wonderful security. You can see that they do whenever they require punctuation (but not spaces or $) in the password, and demand an 8 character password (but reject anything over 16 or 24 characters). /sarcasm I especially like financial companies that have you login by using symantec VIP[1] which you append to your password. There's no way anyone thought that was a good idea. They did it that way because they had a worthless legacy authentication stack they couldn't rewrite, didn't understand 2FA well enough to implement it themselves, went with Symantec because "nobody ever got fired for contracting $importantfunction to $bigcompany", and the only way they could shoehorn any 2FA auth into their login flow was to concatenate it with the password. [1] If you haven't had the pleasure of using it, it's a proprietary 2FA app that has a single seed per app install, shared between the app and symantec's database. It generates 6 digit codes that make it look similar to standard TOTP, but it's not TOTP. If you need to use it for multiple websites, you give them all the same seed hash (displayed by the app) which they use to synchronize your auth credentials with your account at symantec. IOW, it doesn't scale securely. There's also no way to have a backup 2FA device with this system; at least the two companies I've used it for haven't let me set up my account with two VIP apps on two different devices. Since normally you'll only have a single 2FA device using this Symantec VIP service, that means you have to go through a manual, insecure identity verification process to get back into your account if your one Symantec VIP device gets lost or broken.
  - closeparen 8y ago
    Heavily regulated companies have a lot of Microsoft Word paperwork to fill out and months long approval cycles to wait through to get any work done, but even nastier, more bug- and vulnerability-riddled legacy codebases than the rest. Security is inextricable from software quality. Not exactly something EHR systems are known for.
gymshoes 8y ago
Brian Krebs recently posted about this:https://krebsonsecurity.com/2018/12/what-the-marriott-breach-says-about-security/ https://krebsonsecurity.com/2018/12/what-the-marriott-breach...
GaryNumanVevo 8y ago
The only way to independently verify a leak is to have a third party create a couple of user accounts with unique passwords and setup a corresponding gmail / facebook honeypot account which would alert them to logins. If my quoraAcct2 password ever gets hacked and used to login to my fake gmail or facebook account, I know that quora was compromised. Works with any site.

Yhippa 8y ago

If they get your data from brokers they may be building comprehensive profiles about you without your explicit permission.

beefsack 8y ago

This is a healthy mindset to have. I feel that for every company that self-reports a leak, there are multiple other companies that have leaked your data and either haven't discovered the breach, refuse to disclose it, or flat out sold your data to the highest bidder.

SOLAR_FIELDS 8y ago
I’m even more worried about the ones that don’t have the facilities to even detect and know they’ve been breached.
spydum 8y ago
You would be correct. In the US, which I might remind you, does not have a national law on the books regarding data breach notification. Even at the state levels, it’s varies pretty wildly on top of, most notifications are only required if there is evidence. So here is the challenge: what if I keep no logs, and have terrible security monitoring capability? If I am notified or discover a critical vulnerability on my own, but have inadequate logs to show or detect if it was exploited... am I required to notify? I have been told no (I fervently disagreed; I think suspected breaches, or critical vulnerabilities which may lead to breaches but were inconclusive should still require notification).
- jwr 8y ago
  Still, I would have thought it is good practice to notify your users if you leak their data to thieves. Quora did the right thing and should be applauded. As a counterexample, it seems that Newegg had a massive breach (thieves installed JavaScript that skimmed credit card numbers for weeks) in August, and even though my credit card was likely stolen, I hever heard about it from Newegg.
  - monetus 8y ago
    How did you find out they did that? Just following tech news?
    - jwr 8y ago
      Yes, see for example https://techcrunch.com/2018/09/19/newegg-credit-card-data-breach/ https://techcrunch.com/2018/09/19/newegg-credit-card-data-br...
  - bigtunacan 8y ago
    Not sure why you didn't hear from Newegg, but they did send out a mass email notification with details of the breach.
    - mtone 8y ago
      I somehow got their email a week or so after the event, and after my card's fraud prevention called for suspicious activity, reverted the transactions and cancelled my card. The bank official was not aware of the leak.
    - jwr 8y ago
      They did? I never got anything from them. And I was definitely within the time window.
- pgrote 8y ago
  >In the US, which I might remind you, does not have a national law on the books regarding data breach notification. Our federal government is beholden to corporations, so I don't see any legislation ever happening to punish nor place a regulatory significance on breaches. If the Equifax debacle didn't move the needle, nothing will. How they didn't get a death penalty for not protecting one of the supports of our financial system I will never know. As the parent said, I've just assumed all my data will be breached eventually. When it occurs I dutifully sign up for the monitoring offered and make sure to review things on a monthly basis. Your comment on breach notification is spot on. WISH.COM has suffered down line breaches in their process and it is easy to prove by the use of virtual credit card numbers ... numbers that are generated and used at only one site. They have been silent when it is reported to them.
deleted 8y ago
[deleted]

aviv 8y ago

I have an email address that I've only ever used as my AWS account email since many years ago. Somehow I started getting spam on it last year. It is not an address anyone could guess or somehow generate based on other data points such as name or otherwise.

hkai 8y ago
I am using a separate email for each website, using the catch-all email feature. It helped me find out a couple of local companies that are selling my data to spammers.
bhauer 8y ago
Many of us who operate our own mail services use a unique email address for every web service we use. You'd be surprised how many of these unique email addresses I've received spam at (and have subsequently blackholed). I would estimate less than 50% of the associated services ever report a data breach event. I figure either there has been an unreported breach or, possibly more likely, the service sold their userlist either directly to spammers or sold it to another group who was themselves breached. The upside, though, is that blackholing an address used for a single service is super simple and satisfying.
- scomp 8y ago
  Do you have any more info on running your own mail server? I looked at doing so but was promptly steered away because of blacklisting, servers that allow it and redundancy.
  - yerasame 8y ago
    I'm not sure what the up or downsides would be, but I personally just have all mail sent to *@mydomain.tld forwarded to a single email address. This way I can give each service a unique email address, while preserving the ability to divine whether a particular address has been lost or stolen, by looking at the sent to field. Well, there's the obvious comfort of having all your mail in one place -- and all the obvious disadvantages that entails, I suppose.

anonytrary 8y ago

This mindset reminds me of the following "laws": Anything that can go wrong, will go wrong [0]. Anything that's isn't disallowed by quantum mechanics, will eventually happen [1]. So, if businesses made it cryptographically impossible to leak data, maybe it wouldn't happen, assuming it is even possible to make it impossible... [0] https://en.wikiquote.org/wiki/Murphy%27s_law https://en.wikiquote.org/wiki/Murphy%27s_law [1] https://en.wikipedia.org/wiki/Totalitarian_principle https://en.wikipedia.org/wiki/Totalitarian_principle

anticensor 8y ago
Anything can go wrong, will go wrong in the worst possible moment (Sod's law).

rinze 8y ago

Data is binary: it has either been already leaked, or not yet.

Pmop 8y ago

That being said, I wonder if it's a good idea to extend KeePass to generate full credentials for given website.

h1d 8y ago

You wouldn't know where the data goes to anyway even without any unintentional leaks. No need to provide more than necessary.

wpietri 8y ago

Yeah, I tag every email address I give to a vendor, and I have for years. It has helped me discover a number of breaches. The address I gave Quora isn't in the hands of spammers yet, which is a mildly good sign. But normally it takes a while for an address to get out to the bottom-feeders, so we'll see.

halvardssm 8y ago
> Yeah, I tag every email address I give to a vendor, and I have for years. It has helped me discover a number of breaches. Can you go into detail on this? What exactly do you mean by tagging? Just wondering in case I want to do the same.
- wpietri 8y ago
  There are a few ways to do it, but I use what is known as subaddressing: https://tools.ietf.org/html/rfc5233 https://tools.ietf.org/html/rfc5233

jedberg 8y ago

Luckily your bank and your health provider probably have decent security, because those two industries face extra heavy fines for breaches.

harshreality 8y ago
Yes, heavily regulated banks and medical providers have wonderful security. You can see that they do whenever they require punctuation (but not spaces or $) in the password, and demand an 8 character password (but reject anything over 16 or 24 characters). /sarcasm I especially like financial companies that have you login by using symantec VIP[1] which you append to your password. There's no way anyone thought that was a good idea. They did it that way because they had a worthless legacy authentication stack they couldn't rewrite, didn't understand 2FA well enough to implement it themselves, went with Symantec because "nobody ever got fired for contracting $importantfunction to $bigcompany", and the only way they could shoehorn any 2FA auth into their login flow was to concatenate it with the password. [1] If you haven't had the pleasure of using it, it's a proprietary 2FA app that has a single seed per app install, shared between the app and symantec's database. It generates 6 digit codes that make it look similar to standard TOTP, but it's not TOTP. If you need to use it for multiple websites, you give them all the same seed hash (displayed by the app) which they use to synchronize your auth credentials with your account at symantec. IOW, it doesn't scale securely. There's also no way to have a backup 2FA device with this system; at least the two companies I've used it for haven't let me set up my account with two VIP apps on two different devices. Since normally you'll only have a single 2FA device using this Symantec VIP service, that means you have to go through a manual, insecure identity verification process to get back into your account if your one Symantec VIP device gets lost or broken.
- closeparen 8y ago
  Heavily regulated companies have a lot of Microsoft Word paperwork to fill out and months long approval cycles to wait through to get any work done, but even nastier, more bug- and vulnerability-riddled legacy codebases than the rest. Security is inextricable from software quality. Not exactly something EHR systems are known for.

gymshoes 8y ago

Brian Krebs recently posted about this:https://krebsonsecurity.com/2018/12/what-the-marriott-breach-says-about-security/ https://krebsonsecurity.com/2018/12/what-the-marriott-breach...

GaryNumanVevo 8y ago

The only way to independently verify a leak is to have a third party create a couple of user accounts with unique passwords and setup a corresponding gmail / facebook honeypot account which would alert them to logins. If my quoraAcct2 password ever gets hacked and used to login to my fake gmail or facebook account, I know that quora was compromised. Works with any site.