8 ms·

My email appears in six breaches. Only one of the companies I recognize. I have never done business with the other five. This pisses me off. Not that the data

• rishabhsagar 7y ago
  So, I 100% agree with you and think a sentence in multi-page privacy policy is not informed consent. Recently in EU GDPR regulation brought in some strict measures on how consent is requested and how data is shared and managed, I was delighted when websites started sending me emails asking me for content to market and share data. However I am now seeing a bunch of websites doing the shady tactic of showing a full page pop-up on mobile site with all 30+ checkboxes pre-ticked allowing them full access of my data. Fuck such sites.
  • stevesimmons 7y ago
    Those don't meet the required standard of "an unambiguous indication by clear affirmative action" according to the UK ICO's interpretation of GDPR: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/consent/how-should-we-obtain-record-and-manage-consent/ https://ico.org.uk/for-organisations/guide-to-data-protectio... "You cannot rely on silence, inactivity, pre-ticked boxes, opt-out boxes, default settings or a blanket acceptance of your terms and conditions."
    • sneak 7y ago
      What kind of world do we live in where using a free service and agreeing to explicitly documented T&Cs doesn’t constitute acceptance? “You provided a contract, and I agreed even though I chose not to read it (despite you providing it), and used the service, but I didn’t really mean to agree” is the most ridiculous cop-out, in my view.
      • hwh 7y ago
        Actually this is default law in the EU if you are a "customer" and the other party is not. All "surprising" clauses within a T&C document are void.
      • tialaramex 7y ago
        Firstly a Contract is a Meeting of Minds, the forty pages of small type in a PDF are nice, but it's laughable that you pretend you thought everybody read those before using your free service. And if they didn't read them, they clearly cannot agree with just every random term you threw in there and so it can't all be part of that meeting of minds, so there is not, in fact, a contract with people with those terms. OK, so what _was_ agreed? Well, a court is going to decide what a _reasonable_ person thought they were getting into, and they'll use legislation (such as that from the GDPR) to help decide that. They'll also keep in mind a theory about relative power. You wrote these T&Cs, so the court is going to conclude that you should have taken that opportunity to add any terms you really cared about. On the other hand the _user_ wasn't able to edit the terms, so really anything they reasonably expected should probably be acceptable. The GDPR says that you need to have the user explicitly opt in, they get to reasonably assume that's how it works, you can't change that in the text they didn't read. You might think, "Aha, but I made them check a box saying they agree they read it". Too bad, that doesn't help for a very simple and pragmatic reason: Judges are people too. When you explain this theory to a judge, who like other people has had to check loads of these stupid "I agree I have read a 400 page document before using this free service" boxes, they are going to look at you like you just said you think they're an idiot. If you're thinking maybe you can try this on and see for yourself, you'll probably have to be your own lawyer. Certainly in the UK no competent lawyer will take that work. Years ago the UK passed a law banning certain contract terms in "short" residential leases (a "short" lease would be e.g. renting a house for a year). Immediately scumbag landlords wrote new contracts that said basically "I, the under-signed, agree to these terms even though they're not allowed" and then demanded their tenants sign the revised contract instead. Judges were not happy, and I pity the fool who first appeared in front of a judge trying to argue that this was somehow legal when it's obviously not. If you're so sure your users want to explicitly agree to let you do this, make it a separate opt-in, like the regulation says. When, to your disappointment, they don't want to, that is a _learning opportunity_ for you. Take it.
• sleavey 7y ago
  > I want to know who betrayed me. You can run your own email server (or have a company host a private domain for you), set up a catch-all address that only you know, then use a different email address for every site you sign up to. That way you can find out this sort of information. Using this technique, I know for example that spammers obtained the address I signed up to Stack Overflow with. The email is not shown on my profile now, and I can't rule out that it wasn't ever shown publicly, but evidence suggests they sold my address to spammers. I also know that spammers crawled my website and found a blog post where I stupidly made up a random address using my domain as part of an example for configuring junk filters (the irony is not lost on me).
  • bennylope 7y ago
    I do this with Fastmail, including specialized subdomains to help me segment the addresses and then distinct email names for each sign up as necessary. You can also do something similar with Gmail (and probably other providers) using "+" in your username, e.g. "myname+hackernews@gmail.com". This creates a unique email address that delivers to your Gmail account as if the "+<whatever>" were absent. This is more easily defeated if you're a moderately motivated spammer.
    • kps 7y ago
      If you run your own email, you can catch the moderately motivated spammer: use a character other than + as the segmenter, and a honeypot +. <me+some-thing@example.com> <me+some-other@example.com> Here, ‘-’ is the segment character, <me+some@example.com> is the actual delivery address, and <me@example.com> triggers an immediate block.
      • mehrdadn 7y ago
        > <me@example.com> triggers an immediate block. This doesn't work. I've seen legitimate companies just strip everything from the + onwards.
        • TeMPOraL 7y ago
• a3n 7y ago
  > It pisses me off that my data was shared with third parties without my knowledge or consent But you knew when you signed up to everywhere you've ever signed up that you were giving them uninformed consent to do whatever they want with your data and metadata, and you knew that they would do whatever they want, including not bothering to effectively protect your data. And yet you signed up. And so have I. But since this kind of thing has become front of mind the last few years, I sign up for very few to none services anymore. At signup, my first thought is "Is this service important enough to lose my money and identity for?" The answer is virtually always no. If we stop signing up for stuff, stuff will improve or die. Both outcomes are equally good.
  • NeutronStar 7y ago
    Yes, today we know, how spread was knowledge of data abuse back in 2008? Because that's what the tools tells me, websites I registered to in 2008 (when I was 18 and young) have leaked my information.
• la_barba 7y ago
  >This system would be more useful if it could report how these companies got my data. I want to know who betrayed me. The company might not have sold your info. They might have been hacked. There really isn't any way to know for sure FWICT.
  • mtgx 7y ago
    I think he means why other five, presumably legitimate, companies have his email address when he never signed-up for them. My guess is it may be someone like Facebook who used to share "your friends' data" with third-party companies. So one of your friends, who may have your email, allowed a third-party company to get that list of his contacts (including your email) via the Facebook API (which at the time may have allowed this sort of sharing). Even today, a ton of Android, and until more recently iOS, apps would collect your contact list, which means YOU shared your friends' phone numbers with some random app company. I imagine many of those friends would be pissed off at you for allowing their phone numbers to fall into the wrong hands, too, and now getting spammed all the time (if only they knew how the spam companies got their phone numbers to begin with).
    • la_barba 7y ago
      Well, the legitimate companies could have been sold "leads" by other legitimate companies but the original source of the data could have been a hack.
      • tgragnato 7y ago
        And the only option left is to hunt the breach asking them one by one who's responsible. Use standard requests and beware of panicked personnel, especially if you bypass executives.
  • TeMPOraL 7y ago
    Or the info may have been transfered to third party for "legitimate" reasons, and then "stolen" by an employer of said third party. From the second-hand stories I heard personally, this is a common practice with call centres subcontracted by Polish telcos. Still, it doesn't matter. Whether the company sold the data or got it taken from them, they are still at fault.
• SkyBelow 7y ago
  >does not constitute informed consent. Most contracts that keep modern day businesses running work by pretending uninformed consent counts as consent. If we required true informed consent things would grind to a halt. Which may not be a bad thing.
  • TeMPOraL 7y ago
    They wouldn't grind to a halt, but a lot of dishonest businesses would find themselves in a world of trouble. Which is all positive in my books. The market will go as low as people allow it to.
• criddell 7y ago
  One of the recent big breaches was from Apollo and when I searched for information on that, I found that they built their database from scraping the web.
• SubiculumCode 7y ago
  For a major grocery chain with a Savers Card program, they wanted my name, phone number, etc. They claimed they would not not sell my data. I made up an imaginary name on the spot: Joseph Kropholer 1. Six months later websites listed a Joseph Kropholer in my town. Unless I actually happened on a real name, they sold me out. 2. Reading the receipt for my name, the clerks in the check out line would thank me with "Thank you Mr Crap Hole-ermmmm. mumble mumble." Then they realize what they just called me. I did not intend that, but it is constantly funny.