8 ms·

Wow. If this had happened a couple years ago, before they made all the anonymous entries truly anonymous, this would have been really ugly. It's a valuable les

Wow. If this had happened a couple years ago, before they made all the anonymous entries truly anonymous, this would have been really ugly. It's a valuable lesson in "don't keep data you don't need". EDIT: A little backstory for non-Quorans. Until early 2017, anonymous Quora answers and comments were anonymous to the public but not actually anonymous in the database (they were still "your" entries). In early 2017 they (presciently) made all this content fully anonymous, even in the database.

aviv 8y ago
No, the lesson is: "don't give companies data they don't need".
- davej 8y ago
  > No Both are valid lessons. One is from the businesses perspective and one is from the user's perspective.
  - aviv 8y ago
    True, agree with that
npunt 8y ago
Their doc says: > Is content posted anonymously still secure? > Yes. Anonymous content cannot be connected to user accounts, so content posted anonymously is still secure. https://help.quora.com/hc/en-us/articles/360020212652 https://help.quora.com/hc/en-us/articles/360020212652
- deleted 8y ago
  [deleted]
anonytrary 8y ago
> It's a valuable lesson in "don't keep data you don't need". Unfortunately, though, most companies operate under the "keep data you might eventually need" principle.
- jwr 8y ago
  Not anymore, at least in Europe. The GDPR began to move things in the right direction.
  - asdff 8y ago
    And based on the bellyaching from tech companies from that piece of legislation, it will remain in Europe.
quotemstr 8y ago
Retroactively, right?
- codezero 8y ago
  I worked at Quora, but left before this change was made, but I believe it was totally retroactive, mainly because I got emails with information about my previous anonymous answers and a deadline to get the one-time link. Now... if the emails were logged and in the exploited database, then all bets are off, but there's no indication that happened at all. There are about a hundred other things about this that give me anxiety, but Quora is run by extremely competent people (engineering and otherwise), so I am pretty confident about their ability to be transparent and to know the extent of any issue. This entire thing is really shitty for everyone involved, but given Quora's tenure (almost nine years!) that this is the first breach is pretty amazing, and that they've done so much work to make it less of a problem is great. None of the above is meant to diminish the general dissatisfaction others are expressing here.
  - throwaway66666 8y ago
    >given Quora's tenure (almost nine years!) that this is the first breach is pretty amazing I am sorry but this is #ShitHackerNewsSays worthy. Let me fix it for you >given Equifax's tenure (almost 119 years! Since 1899) that this is the first breach is pretty amazing Better now? Downvote me if you want, but there are no pats in the back for having PII leaks, no matter the years.
    - argonaut 8y ago
      There have been at least 5 different breaches (of varying impact) at Equifax in the recent past several years. (https://en.wikipedia.org/wiki/Equifax https://en.wikipedia.org/wiki/Equifax) Another set of 5 data breaches at Equifax dating back to 2013 (some but not all of these overlap with the Wikipedia reference) (https://www.forbes.com/sites/thomasbrewster/2017/09/08/equifax-data-breach-history/#6c747d40677c https://www.forbes.com/sites/thomasbrewster/2017/09/08/equif...) I would not be surprised if Equifax has been "breached" more than a hundred times over its history. Do your research.
SilasX 8y ago
Weren't there some cases where people had made anonymous answers but there was a way to find out that they had written such an answer?
mhh__ 8y ago
"Don't keep data you don't need" is actually ~illegal (IANAL, obviously) in the UK.

aviv 8y ago

No, the lesson is: "don't give companies data they don't need".

davej 8y ago
> No Both are valid lessons. One is from the businesses perspective and one is from the user's perspective.
- aviv 8y ago
  True, agree with that

npunt 8y ago

Their doc says: > Is content posted anonymously still secure? > Yes. Anonymous content cannot be connected to user accounts, so content posted anonymously is still secure. https://help.quora.com/hc/en-us/articles/360020212652 https://help.quora.com/hc/en-us/articles/360020212652

deleted 8y ago
[deleted]

anonytrary 8y ago

> It's a valuable lesson in "don't keep data you don't need". Unfortunately, though, most companies operate under the "keep data you might eventually need" principle.

jwr 8y ago
Not anymore, at least in Europe. The GDPR began to move things in the right direction.
- asdff 8y ago
  And based on the bellyaching from tech companies from that piece of legislation, it will remain in Europe.

quotemstr 8y ago

Retroactively, right?

codezero 8y ago
I worked at Quora, but left before this change was made, but I believe it was totally retroactive, mainly because I got emails with information about my previous anonymous answers and a deadline to get the one-time link. Now... if the emails were logged and in the exploited database, then all bets are off, but there's no indication that happened at all. There are about a hundred other things about this that give me anxiety, but Quora is run by extremely competent people (engineering and otherwise), so I am pretty confident about their ability to be transparent and to know the extent of any issue. This entire thing is really shitty for everyone involved, but given Quora's tenure (almost nine years!) that this is the first breach is pretty amazing, and that they've done so much work to make it less of a problem is great. None of the above is meant to diminish the general dissatisfaction others are expressing here.
- throwaway66666 8y ago
  >given Quora's tenure (almost nine years!) that this is the first breach is pretty amazing I am sorry but this is #ShitHackerNewsSays worthy. Let me fix it for you >given Equifax's tenure (almost 119 years! Since 1899) that this is the first breach is pretty amazing Better now? Downvote me if you want, but there are no pats in the back for having PII leaks, no matter the years.
  - argonaut 8y ago
    There have been at least 5 different breaches (of varying impact) at Equifax in the recent past several years. (https://en.wikipedia.org/wiki/Equifax https://en.wikipedia.org/wiki/Equifax) Another set of 5 data breaches at Equifax dating back to 2013 (some but not all of these overlap with the Wikipedia reference) (https://www.forbes.com/sites/thomasbrewster/2017/09/08/equifax-data-breach-history/#6c747d40677c https://www.forbes.com/sites/thomasbrewster/2017/09/08/equif...) I would not be surprised if Equifax has been "breached" more than a hundred times over its history. Do your research.

SilasX 8y ago

Weren't there some cases where people had made anonymous answers but there was a way to find out that they had written such an answer?

mhh__ 8y ago

"Don't keep data you don't need" is actually ~illegal (IANAL, obviously) in the UK.