5 ms·

It depends on what you mean by 'etc'. The problem might not be in a single leak, but with enough leaks people can get access to all kinds of PII (personally ide

It depends on what you mean by 'etc'. The problem might not be in a single leak, but with enough leaks people can get access to all kinds of PII (personally identifiable information). It's important to me that my physical address not leak, I don't want people or packages showing up that I didn't ask to show up. If your important numbers (in the US that's passport, social security, and driver license) get leaked, it becomes easier and easier for someone to commit identity theft and open credit cards in your name which you will have will have to pay with either money or a lot of time proving it wasn't really you. Or they can get traffic tickets in your name which will become a warrant for you. And if they know enough about you (address, likes and dislikes, etc), it becomes much easier to socially hack (https://en.wikipedia.org/wiki/Social_hacking https://en.wikipedia.org/wiki/Social_hacking) you. Any security is only as strong as its weakest link, and social hacking has been used to get access to people's bank account, email address (doesn't sound scary but if someone has access to your email, they likely have access to all of your accounts because they can trigger a password reset, intercept it, set a new password, then lock you out), and a lot of other things.

totesraunch 8y ago
Your address is a matter of public record. Obviously one should be much more worried about SSN, passport numbers, and other government issued UIDs.
imgabe 8y ago
> It's important to me that my physical address not leak, I don't want people or packages showing up that I didn't ask to show up. What is the likelihood of being a target of this? Are there people out there that you expect might want to mail you an unexpected package or stalk you at your home? I get that there are people who have stalkers and such, but for the average, random person, what is the likelihood a criminal is going to pick their name and address out of some leaked information and...what? Mail them a bomb? Travel from Estonia or wherever the hacker lives to burgle a house in the US? Why? There's no point to doing that.
- quanticle 8y ago
  >What is the likelihood of being a target of this? Are there people out there that you expect might want to mail you an unexpected package or stalk you at your home? As we see in the instances of so-called "revenge porn", you don't have to be famous to be the victim of these tactics. It just takes one person who becomes annoyed enough to use some of these tools and then you're left with an expensive and time consuming mess. Did you have a nasty break-up? Fire someone? Do you have a business rival who would like to see your reputation ruined? Did you leave a comment on a website that just happened to offend the wrong person [1]? The tools to completely ruin your life are becoming easier and cheaper to wield, and the costs of defending against them are only increasing. Even if the likelihood isn't high, the consequences are severe enough that you should take the risk seriously. Objectively, the likelihood of you getting robbed isn't that high either, but you lock your doors and don't leave valuables sitting out in your car either. [1]: https://gizmodo.com/when-a-stranger-decides-to-destroy-your-life-1827546385 https://gizmodo.com/when-a-stranger-decides-to-destroy-your-... EDIT: note that in the link above, the attacker wasn't even using non-public data. Imagine how much more damage someone with the ability to gain access to bank accounts, etc. could have done.
  - imgabe 8y ago
    > Did you have a nasty break-up? Fire someone? Do you have a business rival who would like to see your reputation ruined? If you were dating someone, worked at the same company, or even in the same industry and know the same people, they do not need a data leak from Marriott to get your address. That has nothing to do with data leaks. Maybe, maybe, you could conceivably piss off some Mr. Robot Darknet-wizard on a forum who would then spend hours combing through leaked data to try to figure out who you are so they could mail you some anthrax, but I'm going to put that at "get hit by an asteroid" level of things to worry about. As far as "take the risk seriously", what is there for an individual to do? I have zero control over the data security practices of Equifax, Marriott, or any other major corporation. I can just avoid their services, but that would basically entail living completely off the grid and being a hermit. If it were something as simple as locking a door, or putting your backpack in the trunk, yeah, people would do it. But all of this "the sky is falling, freak out now!" propaganda, comes with absolutely zero actionable items that the average person can do. I'm not going to waste my life being worried about things I have no control over.
sys_64738 8y ago
There are leaks and there are leaks. Something like OSNews having a breach is a case of who cares. If it's important info (SSN, Drivers license, passport #) then any company leaking such info should be hammered with $1m fine per leak for each person. These companies which leak valuable information must suffer intolerably so that they never, ever do it again. That means making examples of those companies early in the cycle by having some go to the wall as that's the consequence of such. I'd also like to see executives be personally liable for the fines too.
SL61 8y ago
> It's important to me that my physical address not leak How do you avoid the people-search sites coming up in Google? When I search my name, Google instantly provides several Whitepages-like sites with my full name and address. Some of them (actual Whitepages included) provide options for removal, but there are so many and they all pull from the same source that it's a losing battle.
miguelrochefort 8y ago
> It's important to me that my physical address not leak, I don't want people or packages showing up that I didn't ask to show up. Because you think your physical address doesn't otherwise exist? Or are you talking about packages personally addressed to you?
closeparen 8y ago
The relation between full name, telephone number, and physical address is not secret at all. Sometimes I feel like I'm the only person who grew up with a phone book. The financial sector abuses some of the more obscure facts about people (SSN, DL/passport number, bank account number, address history, mother's maiden name) as authenticators. They aren't. In the short term, someone can create a lot of bureaucratic hassle for you by knowing these facts. In the long term, institutions will adapt to the reality that knowing them no longer proves anything. The stuff you should really care about, IMO: Contents of private conversations. Interests and opinions expressed online that could harm real-world relationships. Habits and characteristics that could signal insurance, credit, or crime risk. Political activity far from mainstream. Relationships with controversial or high-risk people. Evidence of excessive wealth for your context. The fact that person with your metadata exists and does normal life things like having a home, a job, a cell phone, and a bank account is always going to be well-known. This information is more or less neutral. The real secrets are those which might prompt some actor (friend, lover, ex-spouse, family member, boss, insurance underwriter, lender, police, secret police, conman, vigilante, person who is wrong on the internet, etc) to turn against you, or to do worse damage than they would otherwise.
- tokyodude 8y ago
  Kind of wish the EFF or some group similar would sue or push to have the law require not using that info as ID with fines for non-compliance. It's inexcusable that someone can pretend to be you, sign up for stuff at various services, and some how that ends up being your responsibility to fix. It should be the various businesses who failed to correctly identify you and they should be financially liable, not you who had ZERO to do with it.
  - closeparen 8y ago
    We’d need a stronger government-backed identity/authentication scheme to replace it, which civil liberties groups like EFF vehemently oppose.
    - tokyodude 8y ago

totesraunch 8y ago

Your address is a matter of public record. Obviously one should be much more worried about SSN, passport numbers, and other government issued UIDs.

imgabe 8y ago

> It's important to me that my physical address not leak, I don't want people or packages showing up that I didn't ask to show up. What is the likelihood of being a target of this? Are there people out there that you expect might want to mail you an unexpected package or stalk you at your home? I get that there are people who have stalkers and such, but for the average, random person, what is the likelihood a criminal is going to pick their name and address out of some leaked information and...what? Mail them a bomb? Travel from Estonia or wherever the hacker lives to burgle a house in the US? Why? There's no point to doing that.

quanticle 8y ago
>What is the likelihood of being a target of this? Are there people out there that you expect might want to mail you an unexpected package or stalk you at your home? As we see in the instances of so-called "revenge porn", you don't have to be famous to be the victim of these tactics. It just takes one person who becomes annoyed enough to use some of these tools and then you're left with an expensive and time consuming mess. Did you have a nasty break-up? Fire someone? Do you have a business rival who would like to see your reputation ruined? Did you leave a comment on a website that just happened to offend the wrong person [1]? The tools to completely ruin your life are becoming easier and cheaper to wield, and the costs of defending against them are only increasing. Even if the likelihood isn't high, the consequences are severe enough that you should take the risk seriously. Objectively, the likelihood of you getting robbed isn't that high either, but you lock your doors and don't leave valuables sitting out in your car either. [1]: https://gizmodo.com/when-a-stranger-decides-to-destroy-your-life-1827546385 https://gizmodo.com/when-a-stranger-decides-to-destroy-your-... EDIT: note that in the link above, the attacker wasn't even using non-public data. Imagine how much more damage someone with the ability to gain access to bank accounts, etc. could have done.
- imgabe 8y ago
  > Did you have a nasty break-up? Fire someone? Do you have a business rival who would like to see your reputation ruined? If you were dating someone, worked at the same company, or even in the same industry and know the same people, they do not need a data leak from Marriott to get your address. That has nothing to do with data leaks. Maybe, maybe, you could conceivably piss off some Mr. Robot Darknet-wizard on a forum who would then spend hours combing through leaked data to try to figure out who you are so they could mail you some anthrax, but I'm going to put that at "get hit by an asteroid" level of things to worry about. As far as "take the risk seriously", what is there for an individual to do? I have zero control over the data security practices of Equifax, Marriott, or any other major corporation. I can just avoid their services, but that would basically entail living completely off the grid and being a hermit. If it were something as simple as locking a door, or putting your backpack in the trunk, yeah, people would do it. But all of this "the sky is falling, freak out now!" propaganda, comes with absolutely zero actionable items that the average person can do. I'm not going to waste my life being worried about things I have no control over.

sys_64738 8y ago

There are leaks and there are leaks. Something like OSNews having a breach is a case of who cares. If it's important info (SSN, Drivers license, passport #) then any company leaking such info should be hammered with $1m fine per leak for each person. These companies which leak valuable information must suffer intolerably so that they never, ever do it again. That means making examples of those companies early in the cycle by having some go to the wall as that's the consequence of such. I'd also like to see executives be personally liable for the fines too.

SL61 8y ago

> It's important to me that my physical address not leak How do you avoid the people-search sites coming up in Google? When I search my name, Google instantly provides several Whitepages-like sites with my full name and address. Some of them (actual Whitepages included) provide options for removal, but there are so many and they all pull from the same source that it's a losing battle.

miguelrochefort 8y ago

> It's important to me that my physical address not leak, I don't want people or packages showing up that I didn't ask to show up. Because you think your physical address doesn't otherwise exist? Or are you talking about packages personally addressed to you?

closeparen 8y ago

The relation between full name, telephone number, and physical address is not secret at all. Sometimes I feel like I'm the only person who grew up with a phone book. The financial sector abuses some of the more obscure facts about people (SSN, DL/passport number, bank account number, address history, mother's maiden name) as authenticators. They aren't. In the short term, someone can create a lot of bureaucratic hassle for you by knowing these facts. In the long term, institutions will adapt to the reality that knowing them no longer proves anything. The stuff you should really care about, IMO: Contents of private conversations. Interests and opinions expressed online that could harm real-world relationships. Habits and characteristics that could signal insurance, credit, or crime risk. Political activity far from mainstream. Relationships with controversial or high-risk people. Evidence of excessive wealth for your context. The fact that person with your metadata exists and does normal life things like having a home, a job, a cell phone, and a bank account is always going to be well-known. This information is more or less neutral. The real secrets are those which might prompt some actor (friend, lover, ex-spouse, family member, boss, insurance underwriter, lender, police, secret police, conman, vigilante, person who is wrong on the internet, etc) to turn against you, or to do worse damage than they would otherwise.

tokyodude 8y ago
Kind of wish the EFF or some group similar would sue or push to have the law require not using that info as ID with fines for non-compliance. It's inexcusable that someone can pretend to be you, sign up for stuff at various services, and some how that ends up being your responsibility to fix. It should be the various businesses who failed to correctly identify you and they should be financially liable, not you who had ZERO to do with it.
- closeparen 8y ago
  We’d need a stronger government-backed identity/authentication scheme to replace it, which civil liberties groups like EFF vehemently oppose.
  - tokyodude 8y ago