9 ms·

Ask HN: So what if my personal information gets stolen?

84 points by 321yawaworht 8y ago

Are there any real consequences to having your data leaked in a breach? If yes, what? Assuming not passwords. Things like name, address, passport number, etc.

nvusuvu 8y ago
Identity theft.
- 321yawaworht 8y ago
  How prevalent is it? Any examples when a breach has had a real, significantly damaging impact on an average person?
  - BjoernKW 8y ago
    I don’t have any recent examples at hand right now but there absolutely have been cases of identity theft in the UK and the US (particularly given the importance attributed to social security numbers there).
  - vonseel 8y ago
    I think that depends on how you define "significant damaging impact". Surely, somewhere some victim of identity theft has suffered vast financial losses without recoup. Surely, many victims of identity theft have a harder time getting approved for loans, leases, or even government clearances and background checks. These things are explainable, but isn't the fact that a person has to deal with this for the rest of their life (or at least 10-15 years following an identity theft event) enough of a problem that you would say it has caused a person "significant, damaging impact"?
  - scarface74 8y ago
    I’ve known someone who actually went to jail after her identity was stolen and someone was writing bad checks in her name. She was already going through all of the legal process to get everything cleared up but she had warrants against her that she didn’t know about. Now she doesn’t leave home without police reports and documentation that she has been the victim of identity theft.
  - querious 8y ago
    These guys are saying something like 17M thefts in 2017, which to me is a bit concerning and almost incredible, even if they’re off by a factor of 2. I mean, it’s not the end of the world if someone assumes my identity but it certainly seems like a monumental hassle to deal with and almost certainly bound to cost several thousand dollars. https://www.javelinstrategy.com/press-release/identity-fraud-hits-all-time-high-167-million-us-victims-2017-according-new-javelin https://www.javelinstrategy.com/press-release/identity-fraud...
  - docker_up 8y ago
    Extremely prevalent. Identity theft is one of the biggest forms of theft in the US. Things like fake income tax refunds is one of the fastest growing financial crimes in the last few years.
  - menzoic 8y ago
    https://archives.fbi.gov/archives/news/stories/2008/march/housestealing_032508 https://archives.fbi.gov/archives/news/stories/2008/march/ho...
auslegung 8y ago
It depends on what you mean by 'etc'. The problem might not be in a single leak, but with enough leaks people can get access to all kinds of PII (personally identifiable information). It's important to me that my physical address not leak, I don't want people or packages showing up that I didn't ask to show up. If your important numbers (in the US that's passport, social security, and driver license) get leaked, it becomes easier and easier for someone to commit identity theft and open credit cards in your name which you will have will have to pay with either money or a lot of time proving it wasn't really you. Or they can get traffic tickets in your name which will become a warrant for you. And if they know enough about you (address, likes and dislikes, etc), it becomes much easier to socially hack (https://en.wikipedia.org/wiki/Social_hacking https://en.wikipedia.org/wiki/Social_hacking) you. Any security is only as strong as its weakest link, and social hacking has been used to get access to people's bank account, email address (doesn't sound scary but if someone has access to your email, they likely have access to all of your accounts because they can trigger a password reset, intercept it, set a new password, then lock you out), and a lot of other things.
- totesraunch 8y ago
  Your address is a matter of public record. Obviously one should be much more worried about SSN, passport numbers, and other government issued UIDs.
- imgabe 8y ago
  > It's important to me that my physical address not leak, I don't want people or packages showing up that I didn't ask to show up. What is the likelihood of being a target of this? Are there people out there that you expect might want to mail you an unexpected package or stalk you at your home? I get that there are people who have stalkers and such, but for the average, random person, what is the likelihood a criminal is going to pick their name and address out of some leaked information and...what? Mail them a bomb? Travel from Estonia or wherever the hacker lives to burgle a house in the US? Why? There's no point to doing that.
  - quanticle 8y ago
aaron695 8y ago
I've never heard of identity theft. If anyone wants to claim this I'd want evidence, not hand waving. But - Like Ashley Madison? Medical records? Tax records. These have all had real life consequences for people. North Korean defectors had their details stolen the other day. Like a email address to a site you comment on, so now it publically ties your comments to the real you? Go on? If your question is around identity theft which I think it really is, then I'd need to see proof, else the fear the NPCs have is actually what does the damage. (Also never heard of a domestic incident from a mass breach of addresses, I'd need proof to believe it, but it is enough to legitimately have to move house, so consequences) (Passwords / unsalted/salted password hashes is of course the real killer, this has screwed a lot of people, but you've excluded this.)
hahabrew 8y ago
when and where the info comes from is important. someone could, over time assemble a dynamic probability schedule of your physical location, this is not good if you are physically meek, extremely rich or integral to government or industry, AKA kidknapping or worse
- imgabe 8y ago
  Unless you are in the 0.1% it is very unlikely that the effort required to do that and kidnap you is going to be worthwhile.
  - hahabrew 8y ago
    oh im sorry what i was suggesting is hard to do? how about pervs and thier motivations.
    - imgabe 8y ago
      It's not only hard, it's completely unnecessary. Most people are assaulted by someone they know in real life. You don't need gigabytes of data and a "dynamic probability schedule" to figure out that someone is at work during the day and at home in the evening, and they probably take one of 2 or 3 convenient routes to move between the two. If they actually know their target, they might even know something more like "they have a yoga class on Wednesday evening". For a second, pretend you're one of these "pervs" you're worried about. Are you going to randomly pick a name out of a data dump from Marriott's database, and try to correlate that with other leaked data to figure out the likelihood of this person you've never seen standing on a particular corner at 5:37pm on November 3rd? Or are you going to say "Sharon from accounting smells nice, I'm going to follow her home after work"? I think the latter is something more reasonable to worry about.
      - hahabrew 8y ago
        cyber stalking is very real, very prevalent, and made even easier than it intrinsically is, by irresponsible PII use and meta analysis, stalkers did this in thier head, or spent time pouring over phonebooks and dumpster documents. just ask any women that care to be here about thier experiences and a different world will be known to you
tejtm 8y ago
Some criminal could commit fraud if they can find a mark stupid enough to fall for their tricks. If said stupid mark is lawered up enough, they will try to fob their failure to do their due diligence off on anyone they can including you with the imaginary crime of "having your identity stolen" as if such a thing was even possible. Which is more plausible? a) I am not me anymore because my identity is stolen. b) Criminals stole from someone else. (likely leveraging their expectation of profit using the information available on absolutely everyone either from 'legitimate' brokers or shady darkweb stuff; not that I can't tell the difference)
docker_up 8y ago
House stealing: https://archives.fbi.gov/archives/news/stories/2008/march/housestealing_032508 https://archives.fbi.gov/archives/news/stories/2008/march/ho... Thrown in jail: https://www.marketwatch.com/story/how-being-an-id-theft-victim-could-land-you-in-jail-2014-02-19 https://www.marketwatch.com/story/how-being-an-id-theft-vict...
- maroonblazer 8y ago
  What's the likelihood of either of these happening? Neither of the links provide any data on incidence of ID theft leading to house stealing or being thrown in jail, which leads me to believe it's probably extremely low. Happy to be shown otherwise though.
  - warent 8y ago
    It's non-zero. Does it matter by how much? Why increase your surface area of attack if it can be prevented?
    - ivanmaeder 8y ago
      Not to nitpick but I think it matters by how much the risk increases if you're trying to compare it to a potential benefit. I'd also say that the risk doesn't begin at zero. E.g., businesses, employers, schools, other orgs, family, partners, friends, colleagues, etc already have a lot of our personal data, and however small the risk is, it's real and worth consideration. We actually consider these risk/benefit scenarios all the time in everyday life. E.g., - We might surrender too much information when presented with the chance to win something in a draw; or give up some non-relevant personal information in a signup form just because the field is mandatory - Amazon, Apple, etc keep our credit card numbers; Monzo, TransferWise, etc our bank account numbers—but we're happy with that because of the convenience (or because there's no other way to do business with them) - You might have personal documentation saved on iCloud, Google Drive, Dropbox, etc because you want easy access to it; similarly with passwords and services like 1Password
    - Shish2k 8y ago
loteck 8y ago
If you're that curious, go ahead and post all of your PII in this thread and find out what happens. Something tells me you won't. The reason you won't, is the answer to your question.
- alanbernstein 8y ago
  Not a very useful answer; presumably OP doesn't know the reason.
  - nokya 8y ago
    Well, there is only one way to know if he/she will guess the reason :)
miguelrochefort 8y ago
As long as people will think that privacy is a normal thing to seek, we'll keep using personal information and secrets as authentication methods, and those whose data leaks will suffer the consequences. What we should do is think about the post-privacy world, where all data is available to everyone. We won't be able to keep secrets and passwords anymore, but we won't have to secure them either, as we will have better authentication methods. No more paranoia, encryption, or fear of data leaks. It blows my mind how few people are willing to concede the benefits of transparency, even if they're not willing to fully endorse it.
- dahart 8y ago
  > What we should do is think about the post-privacy world, where all data is available to everyone. Either I don't fully understand what you're suggesting, or you don't fully understand what you're suggesting. ;) Right to privacy is part of the Universal Declaration of Human Rights for good reasons. Violations and abuses of privacy have done a lot of damage to a lot of people throughout history. So what does authentication even mean to you if all data is available to everyone? Why would you still need to authenticate? Do you think it's a good idea for me & everyone else to see your bank balance? Personal emails? Personnel reviews at work? Letters to your girlfriend? Late night browsing habits? Purchase history? All your photos along with the video feed from your phone? I don't see privacy ever not being a normal and reasonable thing to seek, not to mention rather important for developing democracies and as some protection against government abuses. https://en.m.wikipedia.org/wiki/Right_to_privacy https://en.m.wikipedia.org/wiki/Right_to_privacy https://en.m.wikipedia.org/wiki/Nothing_to_hide_argument https://en.m.wikipedia.org/wiki/Nothing_to_hide_argument
  - miguelrochefort 8y ago
    I suggest that a right to privacy is a mistake. It shouldn't exist. Unsustainability: It will only become more difficult to keep secrets as technology improves. Imagine cameras that can see through walls and drones the size of a fly. Unenforceability: How do you make people forget information on demand? How do you delete data from the internet? Inefficiency: We waste a lot of resources securing data. We waste a lot of resources requesting data. Allowing data to flow naturally would be more efficient. I think it's a good idea to let "everyone else see [my] bank balance[.] Personal emails[.] Personnel reviews at work[.] Letters to [my] girlfriend[.] Late night browsing habits[.] Purchase history[.] All [my] photos along with the video feed from [my] phone[.]" However, I think it would be unfair to make the life of one person transparent in a society where the social and technical expectation is to keep secrets, although I think it would be better to make everyone's lives transparent in a society where transparency is supported. I think the transition to a transparent society is inevitable. I also think that the later we prepare for the transition the more people will suffer. This is why I bring up the subject and encourage people to think about it. David Brin explains it much better in his book: https://en.wikipedia.org/wiki/The_Transparent_Society https://en.wikipedia.org/wiki/The_Transparent_Society
publicarray 8y ago
Possible target for spear phishing (easier to social engineer when more information about a target is public). Account take-over if the password was used elsewhere (credential stuffing). Become a target for Extortion or Blackmail: https://www.troyhunt.com/the-opportunistic-and-empty-threat-that/ https://www.troyhunt.com/the-opportunistic-and-empty-threat-... Edit: Some companies still use birth dates, security questions or social security numbers for identification. If the information is public, any one can identify as that person via a phone call. https://krebsonsecurity.com/?s=SMS&x=10&y=14 https://krebsonsecurity.com/?s=SMS&x=10&y=14 https://krebsonsecurity.com/2018/10/voice-phishing-scams-are-getting-more-clever/ https://krebsonsecurity.com/2018/10/voice-phishing-scams-are... https://krebsonsecurity.com/2018/08/hanging-up-on-mobile-in-the-name-of-security/ https://krebsonsecurity.com/2018/08/hanging-up-on-mobile-in-...
xupybd 8y ago
I get scam calls a couple times a month. They know my name number and profession. It’s really annoying.
ghidra 8y ago
someone could login to HN as you and downvote everyone for no reason so they figure out what login is doing it and ban your a$$ that would be a hard hit to all the high karma types that were fubard like that
badestrand 8y ago
It is quite interesting that everyone is so alert about privacy now and hates Facebook and Google and just ten years ago people willingly published their address and phone number in a phone book for everyone to see. Also in Germany the cities sell every citizens' personal data and nobody cares. It is quite hipocritical.
- mch82 8y ago
  Most people didn’t understand why privacy mattered. People are slowly learning the value of privacy through personal experience and the stories of others.
the8472 8y ago
It does not even take a breach. All it takes is the database to exist and a change in administration. And the database does not even have to be in the government's hands for them to use it. https://www.abc.net.au/radionational/programs/rearvision/the-dark-side-of-census-collections/7860908 https://www.abc.net.au/radionational/programs/rearvision/the...
Kiro 8y ago
In many countries name, address, social security number etc are all public information so really depends on where you live.
- bookofjoe 8y ago
  "Would you be happy to have your tax return displayed for everyone to see? In Norway, no one can disguise their earnings, as every citizen's is made available for everyone else in the country to inspect. Workers can see what their colleagues earn and neighbours can snoop on how much the people next door make — all legally and online. On a date every year in October, just after midnight, Norwegian citizens' annual tax returns are posted online — and the country's Norwegian newspapers leap to produce top ten lists of the country's highest earners, the incomes and taxes paid by the political and cultural elites, celebrities and sportspeople. https://www.theguardian.com/money/blog/2016/apr/11/when-it-comes-to-tax-transparency-norway-leads-the-field https://www.theguardian.com/money/blog/2016/apr/11/when-it-c...
capitol_ 8y ago
There is also a herd immunity effect, if it's easy to compile a large database with everyone's personal data and political beliefs, then it's also easy to launch micro-targeting campaigns where you give political ads with messages that are tailored to the narrow segment of the population that the person viewing the ad is in.
indigochill 8y ago
I suspect blackmail is going to see a rise as more information like this gets leaked. It goes like this: "Hi, <insert name here>. I know all about you. For instance, <insert the piece of personal information you have>. Wire me <insert large sum here> or I'll publish your browser history (or credit card statements, or anything else that sounds sufficiently compromising among some segment of the population)." Against any particular target, this may not be effective if they don't care about the leverage you claim to have or call your bluff. However, since you have a data dump you can send this to every single affected individual and you'll get at least some bites.
- stevewillows 8y ago
  >"Hi, <insert name here>. I know all about you. Did you receive that in an email recently? I've already deleted it, but I got almost that exact email in my spam on my junk mail account the other day. They were clearly working off of the Adobe password leak. They quoted my old password in the email and gave the same ol', 'I will email a list of your perverted pornographic interests to your family and employer' Like you said, they cast a wide net in hopes of catching a few fish. That being said, asking for BTC seems to really narrow the pool to folks who, I assume, would be less likely to fall for this scam.
  - oth001 8y ago
    I know someone who got an email just like that as well.
pritambarhate 8y ago
There is a very good podcast episode on IRS Tax Refund fraud using identity theft: https://darknetdiaries.com/episode/26/ https://darknetdiaries.com/episode/26/ BTW, Darknet Diaries is very informative and entertaining podcast. Highly recommended!
anewguy9000 8y ago
I'm astonished to see things like blackmail and fear of a break-in near the top of the list.. really? the most likely and damaging outcome is identity theft -- the consequence of which is damaged credit which is difficult to fix
rjkennedy98 8y ago
The biggest hacks have been by governments. They aren't looking to steal your credit card, they are interested in espionage on a large scale. OPM and Equifax were likelt state-sponsored hacks. My guess is they are looking for government and corporate individuals to target. You probably don't need to worry about the hack affecting you directly, but it is affecting you in ways you probably can't imagine.
throwaway209381 8y ago
Yes, criminals do not have your best interest in mind.
coldtea 8y ago
What about your tax returns? Your browser history? Mails to your boyfriend/girlfriend? Those agree comments in about your brother or boss sent to someone else? The source code to your side project? Your half-finished novel? Work-related files? Your IM chats? Your full contact list and their numbers? Your purchase history? Photos?
Spooky23 8y ago
It all depends who gets the information and if they go after you. My parents had a criminal gang compromise their information and open up a savings account in their name. They then initiated ACH transfers from their legit accounts and filed a fraudulent income tax return in their name, to the tune of $50k refund. The only reason they did not get away with it is that the online bank sent a gift to the house and my parents knew people from their careers that could get the attention of law enforcement quickly. Their bank suggested that a relative probably stole their bank credentials and that it was “nothing to worry about”.

84 points by 321yawaworht 8y ago

Are there any real consequences to having your data leaked in a breach? If yes, what? Assuming not passwords. Things like name, address, passport number, etc.

nvusuvu 8y ago

Identity theft.

321yawaworht 8y ago
How prevalent is it? Any examples when a breach has had a real, significantly damaging impact on an average person?
- BjoernKW 8y ago
  I don’t have any recent examples at hand right now but there absolutely have been cases of identity theft in the UK and the US (particularly given the importance attributed to social security numbers there).
- vonseel 8y ago
  I think that depends on how you define "significant damaging impact". Surely, somewhere some victim of identity theft has suffered vast financial losses without recoup. Surely, many victims of identity theft have a harder time getting approved for loans, leases, or even government clearances and background checks. These things are explainable, but isn't the fact that a person has to deal with this for the rest of their life (or at least 10-15 years following an identity theft event) enough of a problem that you would say it has caused a person "significant, damaging impact"?
- scarface74 8y ago
  I’ve known someone who actually went to jail after her identity was stolen and someone was writing bad checks in her name. She was already going through all of the legal process to get everything cleared up but she had warrants against her that she didn’t know about. Now she doesn’t leave home without police reports and documentation that she has been the victim of identity theft.
- querious 8y ago
  These guys are saying something like 17M thefts in 2017, which to me is a bit concerning and almost incredible, even if they’re off by a factor of 2. I mean, it’s not the end of the world if someone assumes my identity but it certainly seems like a monumental hassle to deal with and almost certainly bound to cost several thousand dollars. https://www.javelinstrategy.com/press-release/identity-fraud-hits-all-time-high-167-million-us-victims-2017-according-new-javelin https://www.javelinstrategy.com/press-release/identity-fraud...
- docker_up 8y ago
  Extremely prevalent. Identity theft is one of the biggest forms of theft in the US. Things like fake income tax refunds is one of the fastest growing financial crimes in the last few years.
- menzoic 8y ago
  https://archives.fbi.gov/archives/news/stories/2008/march/housestealing_032508 https://archives.fbi.gov/archives/news/stories/2008/march/ho...

auslegung 8y ago

It depends on what you mean by 'etc'. The problem might not be in a single leak, but with enough leaks people can get access to all kinds of PII (personally identifiable information). It's important to me that my physical address not leak, I don't want people or packages showing up that I didn't ask to show up. If your important numbers (in the US that's passport, social security, and driver license) get leaked, it becomes easier and easier for someone to commit identity theft and open credit cards in your name which you will have will have to pay with either money or a lot of time proving it wasn't really you. Or they can get traffic tickets in your name which will become a warrant for you. And if they know enough about you (address, likes and dislikes, etc), it becomes much easier to socially hack (https://en.wikipedia.org/wiki/Social_hacking https://en.wikipedia.org/wiki/Social_hacking) you. Any security is only as strong as its weakest link, and social hacking has been used to get access to people's bank account, email address (doesn't sound scary but if someone has access to your email, they likely have access to all of your accounts because they can trigger a password reset, intercept it, set a new password, then lock you out), and a lot of other things.

totesraunch 8y ago
Your address is a matter of public record. Obviously one should be much more worried about SSN, passport numbers, and other government issued UIDs.
imgabe 8y ago
> It's important to me that my physical address not leak, I don't want people or packages showing up that I didn't ask to show up. What is the likelihood of being a target of this? Are there people out there that you expect might want to mail you an unexpected package or stalk you at your home? I get that there are people who have stalkers and such, but for the average, random person, what is the likelihood a criminal is going to pick their name and address out of some leaked information and...what? Mail them a bomb? Travel from Estonia or wherever the hacker lives to burgle a house in the US? Why? There's no point to doing that.
- quanticle 8y ago

aaron695 8y ago

I've never heard of identity theft. If anyone wants to claim this I'd want evidence, not hand waving. But - Like Ashley Madison? Medical records? Tax records. These have all had real life consequences for people. North Korean defectors had their details stolen the other day. Like a email address to a site you comment on, so now it publically ties your comments to the real you? Go on? If your question is around identity theft which I think it really is, then I'd need to see proof, else the fear the NPCs have is actually what does the damage. (Also never heard of a domestic incident from a mass breach of addresses, I'd need proof to believe it, but it is enough to legitimately have to move house, so consequences) (Passwords / unsalted/salted password hashes is of course the real killer, this has screwed a lot of people, but you've excluded this.)

hahabrew 8y ago

when and where the info comes from is important. someone could, over time assemble a dynamic probability schedule of your physical location, this is not good if you are physically meek, extremely rich or integral to government or industry, AKA kidknapping or worse

imgabe 8y ago
Unless you are in the 0.1% it is very unlikely that the effort required to do that and kidnap you is going to be worthwhile.
- hahabrew 8y ago
  oh im sorry what i was suggesting is hard to do? how about pervs and thier motivations.
  - imgabe 8y ago
    It's not only hard, it's completely unnecessary. Most people are assaulted by someone they know in real life. You don't need gigabytes of data and a "dynamic probability schedule" to figure out that someone is at work during the day and at home in the evening, and they probably take one of 2 or 3 convenient routes to move between the two. If they actually know their target, they might even know something more like "they have a yoga class on Wednesday evening". For a second, pretend you're one of these "pervs" you're worried about. Are you going to randomly pick a name out of a data dump from Marriott's database, and try to correlate that with other leaked data to figure out the likelihood of this person you've never seen standing on a particular corner at 5:37pm on November 3rd? Or are you going to say "Sharon from accounting smells nice, I'm going to follow her home after work"? I think the latter is something more reasonable to worry about.
    - hahabrew 8y ago
      cyber stalking is very real, very prevalent, and made even easier than it intrinsically is, by irresponsible PII use and meta analysis, stalkers did this in thier head, or spent time pouring over phonebooks and dumpster documents. just ask any women that care to be here about thier experiences and a different world will be known to you

tejtm 8y ago

Some criminal could commit fraud if they can find a mark stupid enough to fall for their tricks. If said stupid mark is lawered up enough, they will try to fob their failure to do their due diligence off on anyone they can including you with the imaginary crime of "having your identity stolen" as if such a thing was even possible. Which is more plausible? a) I am not me anymore because my identity is stolen. b) Criminals stole from someone else. (likely leveraging their expectation of profit using the information available on absolutely everyone either from 'legitimate' brokers or shady darkweb stuff; not that I can't tell the difference)

docker_up 8y ago

House stealing: https://archives.fbi.gov/archives/news/stories/2008/march/housestealing_032508 https://archives.fbi.gov/archives/news/stories/2008/march/ho... Thrown in jail: https://www.marketwatch.com/story/how-being-an-id-theft-victim-could-land-you-in-jail-2014-02-19 https://www.marketwatch.com/story/how-being-an-id-theft-vict...

maroonblazer 8y ago
What's the likelihood of either of these happening? Neither of the links provide any data on incidence of ID theft leading to house stealing or being thrown in jail, which leads me to believe it's probably extremely low. Happy to be shown otherwise though.
- warent 8y ago
  It's non-zero. Does it matter by how much? Why increase your surface area of attack if it can be prevented?
  - ivanmaeder 8y ago
    Not to nitpick but I think it matters by how much the risk increases if you're trying to compare it to a potential benefit. I'd also say that the risk doesn't begin at zero. E.g., businesses, employers, schools, other orgs, family, partners, friends, colleagues, etc already have a lot of our personal data, and however small the risk is, it's real and worth consideration. We actually consider these risk/benefit scenarios all the time in everyday life. E.g., - We might surrender too much information when presented with the chance to win something in a draw; or give up some non-relevant personal information in a signup form just because the field is mandatory - Amazon, Apple, etc keep our credit card numbers; Monzo, TransferWise, etc our bank account numbers—but we're happy with that because of the convenience (or because there's no other way to do business with them) - You might have personal documentation saved on iCloud, Google Drive, Dropbox, etc because you want easy access to it; similarly with passwords and services like 1Password
  - Shish2k 8y ago

loteck 8y ago

If you're that curious, go ahead and post all of your PII in this thread and find out what happens. Something tells me you won't. The reason you won't, is the answer to your question.

alanbernstein 8y ago
Not a very useful answer; presumably OP doesn't know the reason.
- nokya 8y ago
  Well, there is only one way to know if he/she will guess the reason :)

miguelrochefort 8y ago

As long as people will think that privacy is a normal thing to seek, we'll keep using personal information and secrets as authentication methods, and those whose data leaks will suffer the consequences. What we should do is think about the post-privacy world, where all data is available to everyone. We won't be able to keep secrets and passwords anymore, but we won't have to secure them either, as we will have better authentication methods. No more paranoia, encryption, or fear of data leaks. It blows my mind how few people are willing to concede the benefits of transparency, even if they're not willing to fully endorse it.

dahart 8y ago
> What we should do is think about the post-privacy world, where all data is available to everyone. Either I don't fully understand what you're suggesting, or you don't fully understand what you're suggesting. ;) Right to privacy is part of the Universal Declaration of Human Rights for good reasons. Violations and abuses of privacy have done a lot of damage to a lot of people throughout history. So what does authentication even mean to you if all data is available to everyone? Why would you still need to authenticate? Do you think it's a good idea for me & everyone else to see your bank balance? Personal emails? Personnel reviews at work? Letters to your girlfriend? Late night browsing habits? Purchase history? All your photos along with the video feed from your phone? I don't see privacy ever not being a normal and reasonable thing to seek, not to mention rather important for developing democracies and as some protection against government abuses. https://en.m.wikipedia.org/wiki/Right_to_privacy https://en.m.wikipedia.org/wiki/Right_to_privacy https://en.m.wikipedia.org/wiki/Nothing_to_hide_argument https://en.m.wikipedia.org/wiki/Nothing_to_hide_argument
- miguelrochefort 8y ago
  I suggest that a right to privacy is a mistake. It shouldn't exist. Unsustainability: It will only become more difficult to keep secrets as technology improves. Imagine cameras that can see through walls and drones the size of a fly. Unenforceability: How do you make people forget information on demand? How do you delete data from the internet? Inefficiency: We waste a lot of resources securing data. We waste a lot of resources requesting data. Allowing data to flow naturally would be more efficient. I think it's a good idea to let "everyone else see [my] bank balance[.] Personal emails[.] Personnel reviews at work[.] Letters to [my] girlfriend[.] Late night browsing habits[.] Purchase history[.] All [my] photos along with the video feed from [my] phone[.]" However, I think it would be unfair to make the life of one person transparent in a society where the social and technical expectation is to keep secrets, although I think it would be better to make everyone's lives transparent in a society where transparency is supported. I think the transition to a transparent society is inevitable. I also think that the later we prepare for the transition the more people will suffer. This is why I bring up the subject and encourage people to think about it. David Brin explains it much better in his book: https://en.wikipedia.org/wiki/The_Transparent_Society https://en.wikipedia.org/wiki/The_Transparent_Society

publicarray 8y ago

Possible target for spear phishing (easier to social engineer when more information about a target is public). Account take-over if the password was used elsewhere (credential stuffing). Become a target for Extortion or Blackmail: https://www.troyhunt.com/the-opportunistic-and-empty-threat-that/ https://www.troyhunt.com/the-opportunistic-and-empty-threat-... Edit: Some companies still use birth dates, security questions or social security numbers for identification. If the information is public, any one can identify as that person via a phone call. https://krebsonsecurity.com/?s=SMS&x=10&y=14 https://krebsonsecurity.com/?s=SMS&x=10&y=14 https://krebsonsecurity.com/2018/10/voice-phishing-scams-are-getting-more-clever/ https://krebsonsecurity.com/2018/10/voice-phishing-scams-are... https://krebsonsecurity.com/2018/08/hanging-up-on-mobile-in-the-name-of-security/ https://krebsonsecurity.com/2018/08/hanging-up-on-mobile-in-...

xupybd 8y ago

I get scam calls a couple times a month. They know my name number and profession. It’s really annoying.

ghidra 8y ago

someone could login to HN as you and downvote everyone for no reason so they figure out what login is doing it and ban your a$$ that would be a hard hit to all the high karma types that were fubard like that

badestrand 8y ago

It is quite interesting that everyone is so alert about privacy now and hates Facebook and Google and just ten years ago people willingly published their address and phone number in a phone book for everyone to see. Also in Germany the cities sell every citizens' personal data and nobody cares. It is quite hipocritical.

mch82 8y ago
Most people didn’t understand why privacy mattered. People are slowly learning the value of privacy through personal experience and the stories of others.

the8472 8y ago

It does not even take a breach. All it takes is the database to exist and a change in administration. And the database does not even have to be in the government's hands for them to use it. https://www.abc.net.au/radionational/programs/rearvision/the-dark-side-of-census-collections/7860908 https://www.abc.net.au/radionational/programs/rearvision/the...

Kiro 8y ago

In many countries name, address, social security number etc are all public information so really depends on where you live.

bookofjoe 8y ago
"Would you be happy to have your tax return displayed for everyone to see? In Norway, no one can disguise their earnings, as every citizen's is made available for everyone else in the country to inspect. Workers can see what their colleagues earn and neighbours can snoop on how much the people next door make — all legally and online. On a date every year in October, just after midnight, Norwegian citizens' annual tax returns are posted online — and the country's Norwegian newspapers leap to produce top ten lists of the country's highest earners, the incomes and taxes paid by the political and cultural elites, celebrities and sportspeople. https://www.theguardian.com/money/blog/2016/apr/11/when-it-comes-to-tax-transparency-norway-leads-the-field https://www.theguardian.com/money/blog/2016/apr/11/when-it-c...

capitol_ 8y ago

There is also a herd immunity effect, if it's easy to compile a large database with everyone's personal data and political beliefs, then it's also easy to launch micro-targeting campaigns where you give political ads with messages that are tailored to the narrow segment of the population that the person viewing the ad is in.

indigochill 8y ago

I suspect blackmail is going to see a rise as more information like this gets leaked. It goes like this: "Hi, <insert name here>. I know all about you. For instance, <insert the piece of personal information you have>. Wire me <insert large sum here> or I'll publish your browser history (or credit card statements, or anything else that sounds sufficiently compromising among some segment of the population)." Against any particular target, this may not be effective if they don't care about the leverage you claim to have or call your bluff. However, since you have a data dump you can send this to every single affected individual and you'll get at least some bites.

stevewillows 8y ago
>"Hi, <insert name here>. I know all about you. Did you receive that in an email recently? I've already deleted it, but I got almost that exact email in my spam on my junk mail account the other day. They were clearly working off of the Adobe password leak. They quoted my old password in the email and gave the same ol', 'I will email a list of your perverted pornographic interests to your family and employer' Like you said, they cast a wide net in hopes of catching a few fish. That being said, asking for BTC seems to really narrow the pool to folks who, I assume, would be less likely to fall for this scam.
- oth001 8y ago
  I know someone who got an email just like that as well.

pritambarhate 8y ago

There is a very good podcast episode on IRS Tax Refund fraud using identity theft: https://darknetdiaries.com/episode/26/ https://darknetdiaries.com/episode/26/ BTW, Darknet Diaries is very informative and entertaining podcast. Highly recommended!

anewguy9000 8y ago

I'm astonished to see things like blackmail and fear of a break-in near the top of the list.. really? the most likely and damaging outcome is identity theft -- the consequence of which is damaged credit which is difficult to fix

rjkennedy98 8y ago

The biggest hacks have been by governments. They aren't looking to steal your credit card, they are interested in espionage on a large scale. OPM and Equifax were likelt state-sponsored hacks. My guess is they are looking for government and corporate individuals to target. You probably don't need to worry about the hack affecting you directly, but it is affecting you in ways you probably can't imagine.

throwaway209381 8y ago

Yes, criminals do not have your best interest in mind.

coldtea 8y ago

What about your tax returns? Your browser history? Mails to your boyfriend/girlfriend? Those agree comments in about your brother or boss sent to someone else? The source code to your side project? Your half-finished novel? Work-related files? Your IM chats? Your full contact list and their numbers? Your purchase history? Photos?

Spooky23 8y ago

It all depends who gets the information and if they go after you. My parents had a criminal gang compromise their information and open up a savings account in their name. They then initiated ACH transfers from their legit accounts and filed a fraudulent income tax return in their name, to the tune of $50k refund. The only reason they did not get away with it is that the online bank sent a gift to the house and my parents knew people from their careers that could get the attention of law enforcement quickly. Their bank suggested that a relative probably stole their bank credentials and that it was “nothing to worry about”.