7 ms·
MoviePass database exposes 161M records
- ziddoap 7y agoWith the billions of records breached this year alone, I'm feeling quite apathetic to these stories now. Thousands or millions of records are breached due to X (usually egregious negligence, sometimes not), the company makes an apology full of mental gymnastics, blame game, and bold lies ("Your privacy is our number one concern, we're sorry we are only pretending to care now."), a few days later the heat is off because another company let loose a few million other records. Repeat. I feel like I need to be re-sensitized. This is a major problem - and I just can't seem to muster up any care for it anymore.
- ghostpepper 7y agoI wonder about the extent to which the seemingly endless supply of breaches has translated into an increase in identity theft (or any other negative consequences that I haven't thought of)
- ziddoap 7y agoI think a bigger use-case for these breaches is credential stuffing and more elaborate phishing rather than old fashioned identity theft - but I'm honestly just guessing and have no data to point to.
- wolco 7y agoYou don't need phishing if they have the credit card numbers and name/address information.
- ziddoap 7y agoIf the credit card number is the end goal, sure. However, there are many other goals of phishing: Pivoting through another person/company to reach another target, IP theft, espionage, corporate sabotage, impersonation, etc.
- mlb_hn 7y agoI'm more concerned about the propaganda issue. I argued a couple years ago (heavily edited) when I left the Army that foreign actors (read: Russia) were data mining stolen data for fracture lines to amplify [0] which makes it hard to form a comprehensive list of politically relevant topics. [0] https://www.armyupress.army.mil/Journals/NCO-Journal/Archives/2017/November/Data-Driven-Propaganda/ https://www.armyupress.army.mil/Journals/NCO-Journal/Archive...
- AmericanChopper 7y agoPartisan politics really gets in the way of that point. Both sides of the aisle have been pointing to the other side saying “Russia” or “China” for the past few years, so admitting civil division is their primary objective would almost be admitting complicity.
- bluetidepro 7y agoI feel the same way about pretty much everything and anything related to any type of news. Whether it's tech news like this, environmental news, or political news. It's the same thing over and over, as you described. Incident, Twitter/media coverage/hype, blame, lies, apologies, and then it's not talked about again a week later. Sigh.
- 8f2ab37a-ed6c 7y agoThe president's new outrageous tweet / orange man = bad, another wedding blown up in some middle eastern country, someone famous said something inappropriate / groped someone that got them fired, earthquake/fire/tsunami wiped out a few thousand people in some distant land, another school got shot up, "clear signs we're in a bubble" and the market is about to crash, something generic about Silicon Valley's hubris, something about how another oppressed group is being screwed over etc etc. I don't think we're really meant as a species for this constant stream of depressing information we can't act upon, it's not good for us. Apathy seems like the only natural response to this barrage of stressors.
- lazyasciiart 7y agoHad an annual checkup recently and did a screening for anxiety/depression. It felt unrealistic - is it a problem with me to be "Worrying 'too much' about different things"?
- solstice 7y agoA small counterpoint to your last point: the youngsters at Fridays for future and the folks of Extinction rebellion
- 8f2ab37a-ed6c 7y agoI actually believe that the present and the future are bright. Pinker's last book does a great job at showing how we're all simply victims of recency/availability/selection/confirmation bias when consuming the news. The world is getting dramatically better, it's our perception of it that is getting constantly worse.
- devoply 7y agoWith all the information exposed probably 60-70% of all people have been exposed. We need to stop the ability of anyone to do anything useful with this data. Which means forcing banks to improve their security standards... rather than calling it identity theft and forgetting about it.
- ziddoap 7y agoI think it might be too late to put the genie back in the bottle without a multi-industry, multi-system overhaul. I agree banks need to improve security standards (along with just about every other major and minor company). But banks being more secure doesn't get to the root of the issue any more than just forgetting about it (after all, it's generally not the bank having their innards on display). There is no silver bullet.
- SkyBelow 7y agoWe need to shift identity theft back onto the businesses being the ones to bear the costs. This would be hard to do, but would be far simpler than trying to force all businesses to use a new identity system (that just ends up being leaked with two years). It creates an incentive for the businesses to care about actually verifying one's id.
- blackflame7000 7y agoHow about 2 forms of government ID to open an account just like you need to get a passport. Identity theft is so easily facilitated by just having to enter a social security number online and the banks are responsible because they are trying to make it as easy as possible for anyone to sign up.
- ziddoap 7y agoThis doesn't address credential stuffing, spear-phishing, propaganda, or many of the other issues that come along with data breaches. Identity theft is a piece of the puzzle, but no where near the whole thing. Your idea might cut down on identity theft - I'm not sure. But it doesn't speak to the root issue. (Not to say it isn't worth pursuing, just that it doesn't do anything if I shared a password between my email, bank, and MoviePass)
- soulofmischief 7y agoEveryone has an opinion on why Amazon is a monopoly and should be broken up, but this is what they don't think about. I trust Amazon not to get breached. No one is infallible, but tech is their thing. I have no interest however, in further increasing the amount of online shopping accounts I maintain, because that means I have to keep tabs on the shenanigans of even more, highly technically incompetent, companies to know if I've been compromised.
- symlinkk 7y agoJust use a password manager so you can have a different password for each site. It's not that hard.
- jvagner 7y agoThe article points out that MoviePass had user and credit card data in plain text. A password manager wouldn't have helped with that.
- checker 7y agoThe credit agencies are supposed to protect cardholders via PCI DSS audits (see https://www.pcisecuritystandards.org/pdfs/pci_fs_data_storage.pdf https://www.pcisecuritystandards.org/pdfs/pci_fs_data_storag...). This is definitely non-compliant. Obviously this system is broken. Additionally, I don't understand why companies continue to roll their own payment processing rather than paying a service that knows how to do it. I guess it seems easy...
- tsukurimashou 7y agoWell if you can make more profit, have all the advantages without being PCI DSS compliant. Why would you not roll your own payment processing? Since nothing happens apparently when the data of your customers get "breached"
- 7y ago
- iriei83 7y agoThe point is a technological solution isn’t viable when societies norms and laws allow it to go unpunished. You’re barking up the wrong tree trying to engineer a solution before society changes laws that would hold the power brokers accountable. Push aside your keyboard and get out there advocating for legal accountability. At the same time, those of us around today have been leaked. I’ve been in tech since the 80s, data tapes went missing all the time. One breach in the 90s resulted in tapes showing up in Russia. Change the laws. Cause there is no stopping it from a tech perspective. You’re not needing re-sensitizing. You’re needing to think of the problem outside the context of technical solutions.
- ziddoap 7y agoI didn't anywhere in my comment say this was a purely technical issue, or that I was advocating a purely technical solution, or that the societal side does or does not need to change, or really anything that you mentioned. I said I'm apathetic because this happens too much, and that it is a problem. Where you assumed all the other stuff about me, I'm not sure.
- ProAm 7y ago"The age of privacy is over" (2010) [1] [1] https://archive.nytimes.com/www.nytimes.com/external/readwriteweb/2010/01/10/10readwriteweb-facebooks-zuckerberg-says-the-age-of-privac-82963.html https://archive.nytimes.com/www.nytimes.com/external/readwri...
- oow92 7y agoMaybe we could accept that despite the leaks society is carrying on just fine? Perhaps the paranoia is a bit overblown, and is implicitly allowed to satisfy notions that financial market performance is somehow the highest priority or literally reflective of efficiency. Remember, scores of people are convinced Sky Wizards are literal things. I’ve seen no reason to believe common held beliefs in economics are anything less than qualification without well reasoned checking. My priorities in life are not a rich person’s financial portfolio. And we can see how they treat each other when these breaches happen. They don’t care and pat each other on the back coughEquifaxcough. Why should we take such a serious posture if the rich owners don’t?
- mattkevan 7y agoData is our century’s version of leaded petrol, CFCs [0], greenhouse gases and long-term nuclear waste containment. Not saying those things are no longer problems, but they weren’t seen as ones until they suddenly became ones. Like toxic waste, data always finds a way to escape its container. Data wants to be free - just not in the way we originally hoped. Just like those early fridge manufacturers, we don’t yet know what the long-term effects of releasing so much data into the atmosphere are going to be. The next 50 years are going to be bumpy as we find out. [0] Fun fact: the inventor of leaded petrol also invented CFCs. He probably did more damage to the environment than anyone else ever, living or dead. https://en.m.wikipedia.org/wiki/Thomas_Midgley_Jr https://en.m.wikipedia.org/wiki/Thomas_Midgley_Jr.
- ziddoap 7y agoBad actors having access to intimate personal details (health and financial records), past passwords (not everyone uses 1 password per site), etc. is not a matter of my paranoia being overblown. I don't know how someone getting access to my medical records or locking me out of my email account is related to financial market performance. >Remember, scores of people are convinced Sky Wizards are literal things. We know, for a fact, that data is being breached and ending up in the hands of the wrong people. How are you honestly making a comparison to "Sky Wizards"? Why should we take such a serious posture if the rich owners don’t? Because it's my f'in data.
- imgabe 7y agoAt this point, security measures need to assume that your information has been made public.
- ziddoap 7y agoFor the technically savvy, great. I'm sure most of us think like that. My poor mom on the other hand doesn't necessarily know what that entails, and what steps she should take.
- imgabe 7y agoIt should not be up to your mom. It needs to be on the banks, government agencies, and everyone else who needs to verify people's identity. "Oh, you've got the correct address and the last 4 digits of a social" is no longer acceptable as proof that someone is who they say they are. Something else needs to be in place. Whatever that is, the burden should be on the banks, etc. to develop that and explain to your mom what it is and how it works.
- ziddoap 7y agoI agree with you wholeheartedly, but right now it is up to her. So, your first comment is great for the technically savvy, but everyone else is SOL.
- Traster 7y agoI think it's worth mentioning that GDPR was basically exactly this. They're putting in systematic regulations to ensure that data isn't arbitrarily kept, it must be secure and the regulations have teeth. It's really well thought out - minimize the number of companies that have your data, minimize the data they have, minimize how long they can hold it for and hold them repsonsible for keeping it safe. Yet, when these regulations were actually bought in, you can see especially on this forum, that people were incredibly sceptical. So whilst you might think that we need to be sensitive to private personal data, it seems like people disagree when it comes to actually implementing that.
- rhizome 7y agoI don't think people are skeptical so much as they are aspiring data abusers. They're taking the corporate side over users, over their friends and family.
- steve19 7y ago> I think it's worth mentioning that GDPR was basically exactly this. There is very little the GDPR would have done to prevent this. The data was legitimatly collected from customers. It was leaked because of badly configured server or firewall. The company is no longer in business so no fines (or minimal fines) would be paid.
- Traster 7y agoYour argument only makes sense because MoviePass is now gone, but MoviePass didn't design their technology stack planning to go bankrupt. GDPR would've required them to take more reasonable precautions with the storage of private info - knowing that if they failed they could be fined even if they didn't go bankrupt for other reasons.
- rhizome 7y agoWith the billions of records breached this year alone, I'm feeling quite apathetic to these stories now. My theory is that the lack of punishment is intentional for just such a purpose, in a collusion between government and industry to milk all of us for free data about every aspect of our lives, from the past into the future. They're just going to take it. You see, people won't demand privacy protections enshrined in law if they simply don't give a shit anymore. Companies don't incur liability, people get some free "credit monitoring" service that should be provided by default. None of this does anything about the leaked data being used to market to you, manipulate your votes, or worse. Then, at the end of the day Facebook et al doesn't have to worry about their contributory privacy violations at all. If you don't want your private messages sold (rented) to every spammer on Earth, what are you gonna do about it? What's the business case for caring on their part?
- tibbon 7y agoThere's no accountability. Executives never see jailtime for gross negligence. They just push profits at the sake of all else, and don't give a shit about the PII of their users.
- nfRfqX5n 7y agounfortunately this is just becoming the norm and companies aren't held accountable for losing data. every account i make now is with a catchall domain and a randomly generated password
- 693471 7y agoThis helps but I am still wishing that the Final credit card would have survived because it allowed you to generate new card numbers per each vendor AND set hard limits on transactions per month, one time use, etc etc. edit: still doesn't solve the issues with the other personal identity problems that comes with all of this... I just want an anonymous payment method. Is that so hard? I don't want any business to ever know who I am.
- Whatarethese 7y agoPrivacy.com might offer close to what you're describing.
- 693471 7y agoThank you, this looks promising. It does require bank account access because it's basically a proxy debit card, but it's better than nothing.
- AdieuToLogic 7y ago> It does require bank account access because it's basically a proxy debit card, but it's better than nothing. I would be wary of any service which requires this level of access to your finances. If the offering is determined worth it, at least set up a separate account with your bank which is not "linked" to any others and transfer into it as needed via standard banking mechanisms.
- umvi 7y ago> unfortunately this is just becoming the norm and companies aren't held accountable for losing data How would a company be held accountable for losing data? Fining them? Paying out to users?
- creaghpatr 7y agoI thought MoviePass was already deep in the red. What incentive do they or any company have to protect their data if they are imminently going bankrupt? I'm guessing cybersecurity is not their most pressing concern, although maybe it is now.
- goatinaboat 7y agoTheir customer database was probably the only asset of value they had.
- Buttons840 7y agoThe customers of that data were, and still are, other legitimate businesses. The security breach doesn't change that, so no reason to protect the database.
- jonknee 7y agoIs a list of people who like to pay less than face value for movie tickets valuable?
- bduerst 7y agoYes. It's a list of price-sensitive consumers who historically respond well to perceived discounting. General rule of thumb for spam email is 0.1% conv rate, so if you blasted this leak list then you'd have 150K sign ups.
- freewilly1040 7y agoWhat’s the marginal value of this kind of list though? Call me cynical but I would assume data of a similar type and quality is already readily available
- bduerst 7y agoNone really. Keep in mind any list dumps you can easily find online have already been pillaged thoroughly. There is an entire data broker industry that relies on selling lead/contact information, so if anything there is a value savings on the hack. I've seen high quality contact (and assoc. company) data sell anywhere from $3 to $120.
- minimaxir 7y agoBlogspam of https://techcrunch.com/2019/08/20/moviepass-thousands-data-exposed-leak/ https://techcrunch.com/2019/08/20/moviepass-thousands-data-e... (which I did submit [https://news.ycombinator.com/item?id=20752190 https://news.ycombinator.com/item?id=20752190] but didn't get many upvotes, hmrph)
- reilly3000 7y agoWhy are they storing credit card numbers in a database in the first place? This should fall under PCI-DSS if so.
- SilasX 7y agoSo ... twenty years of free credit monitoring, then?
- largote 7y agoWe need a GDPR equivalent in the US. That's the only way this will change.
- mychael 7y agoNo thanks. Thats a solution worse than the problem.
- jonknee 7y agohttps://www.dlapiper.com/en/uk/news/2019/02/dla-piper-gdpr-data-breach-survey/ https://www.dlapiper.com/en/uk/news/2019/02/dla-piper-gdpr-d... > Over 59,000 data breach notifications have been reported across the European Economic Area by public and private organizations since the GDPR came into force on 25th May 2018, according to DLA Piper's GDPR Data Breach survey. Sounds like they really solved this issue!
- crispyporkbites 7y agoIt wasn’t 161m customers that were exposed, it was 0.058m Pretty big difference to what the headline implies
- ziddoap 7y agoHeadline is accurate. 161M records were in the database. They have evidence that at least 60,000 of the records accessed had credit card data attached. >161 million records was left unsecured and _exposed credit card and customer card information on at least 60,000 of the ticket service’s customers_.
- fitzroy 7y agoIf I want a trip down memory lane, I can just check the data breach section of CreditKarma and see a chronological history of all of my passwords from the last 25 years. At this point, I'd join a social network that matched me with all of the people around the world that also used the same "clever, obscure" passwords.
- beeschlenker 7y agoYou think exposure like that is bad, you must see this: Soros funded child rape ring protected by Trump for $4 billion bribe, Pelosi $3b. Participants include Obama, Schumer, Cuomo, Buttgieg, DeBlasio, Theil, Dorsey, Bill Murray. Over 60+ deaths from rapes, billions in payoffs. Listen to them do it here: BE SURE TO Listen! to previously unprocessed footage now available [Soros, 0bama child rapes 15Jan 4-6am], Obama around 524: "Why is there so much blood? Someone get me something to clean the blood off my dick..." *note: -> groups of links are multiple ways to get the same file -> 15JanCh3_347-528.avi https://drive.google.com/file/d/1Q8YeDzghf95FQrxBaMpXK4b-SfJYERs8/view?usp=sharing https://drive.google.com/file/d/1Q8YeDzghf95FQrxBaMpXK4b-SfJ... https://mega.nz/#!bTQwDQDA!jolSOqGR2Zomhtn7zIG0lGmqXSqe3KG1mO_7nKLrqNo https://mega.nz/#!bTQwDQDA!jolSOqGR2Zomhtn7zIG0lGmqXSqe3KG1m... 15JanCh3_528-545.avi https://drive.google.com/file/d/1DavyRFWTRv4_teHYewpQMwMCq6LDzb6Y/view?usp=sharing https://drive.google.com/file/d/1DavyRFWTRv4_teHYewpQMwMCq6L... https://mega.nz/#!DfBywKKR!llMUzB8DLM2Rcvm0QkOKdiE3PpCY5YeR3yJwrm9R_4U https://mega.nz/#!DfBywKKR!llMUzB8DLM2Rcvm0QkOKdiE3PpCY5YeR3... 15JanCh4_400-600.avi https://drive.google.com/file/d/1DavnBCyhq_JRmST2QH5qlojUE6dr5IWS/view?usp=sharing https://drive.google.com/file/d/1DavnBCyhq_JRmST2QH5qlojUE6d... https://mega.nz/#!faZggSja!yF_QOcodvYXwk7qEO1N8eSaV90ZWUUaS18Surn8rnEU https://mega.nz/#!faZggSja!yF_QOcodvYXwk7qEO1N8eSaV90ZWUUaS1... See pgs 18-23,8,11,12,35,45,61,62, and update list at end of doc.. Having trouble getting traction. Getting censored/banned. Billions in bribes paid to Trump, Pelosi, Schumer, Harris to enable a Soros funded child raping ring to operate in the USA. Please listen to the links below. Turn up the volume and put headphones on. You will hear these people, and many other high profile people, incriminate themselves in unbelievable fashion. Full 80 page document [update 20Aug] filled with red handed evidence like this at the bottom. Go to pages 18 through 23 of this document and you will hear Dorsey and Thiel raping children. You will hear their screams. They both rape and kill three. Also at the "rape party" of note: Bill DeBlasio, Andrew Cuomo, Bill Murray, Peter Buttgieg, George Soros, Barack Obama. Please copy and paste this post and repost it, or save it for later because it will likely get removed sooner or later. I keep getting censored by these people. Bill DeBlasio's turn starts at 2100: https://mega.nz/#!OCJwQSBC!AlER6vRRTKS8yvSxnVwAl3ha3kGDLqoouQe53zkGARg https://mega.nz/#!OCJwQSBC!AlER6vRRTKS8yvSxnVwAl3ha3kGDLqoou... Andrew Cuomo's starts at 2200: https://mega.nz/#!qKZChABY!zy-2jIHqEg4gWHNbiEym-YBdSs5Y9qzT2ARieV_eozA https://mega.nz/#!qKZChABY!zy-2jIHqEg4gWHNbiEym-YBdSs5Y9qzT2... Both files in one here: 14JanCh3_2100-2300.avi https://drive.google.com/file/d/1yolCgVtY5b8d8YDcshwb-Yd3kS0Jg-Bk/view?usp=sharing https://drive.google.com/file/d/1yolCgVtY5b8d8YDcshwb-Yd3kS0... Peter Thiel starts at 100, Jack Dorsey at 130 each raping and killing three boys. Turn the volume all the way up and put head phones on. https://s3.wasabisys.com/conv1/Overnight_14-17Jan/15JanCh3_100-200.avi https://drive.google.com/file/d/1mzZrjobxhNIEf38M3xk-IeA5SeF4aUtB/view?usp=sharing https://mega.nz/#!qHhRiKLI!Tl1AnP0Lq6GIBH2MGitYNuXoe81uYeVQdxwSaZ8CY7o \0bama admits to raping and killing boys here at about 547, with commentary from Peter Thiel, George Soros, Matt Porter: https://s3.wasabisys.com/out2/Out2/15JanCh3_0545.avi https://drive.google.com/file/d/1LCDoc1kT7cfSeKQ1vniP_sx32_bRsHau/view?usp=sharing https://mega.nz/#!veBk1KrL!zkO_keTyZAtNoTGEGsfRmXyuVIj9p8c3R8GtY-o_Nt8 DTrump demands $4 billion to "take a blind eye" at 1015++ (link missing from report, unsure how). Here's pieces of dialogue: 1018 Henry Porter: The child raping. 1018 Donald Trump: What the fuck are you talking about? 1018 Gigi Hadid: Mr. President we are child rapists. 1018 Donald Trump: You cannot be serious. 1018 Donald Trump: You're gonna need $4 billion for me to take a blind eye. 1019 Porter: People are laughing because they think four billion is too much. I think it's not a problem when you have $35 billion. 1022 Donald Trump: You better have that $4 billion or you can kiss this shit goodbye. https://s3.wasabisys.com/conv2/3Jan/3JanCh3_900-1100.avi https://drive.google.com/file/d/1Grdr8xF2psKNsuYlEnl9dIRV-77YG0Vr/view?usp=sharing https://mega.nz/#!TKgxzS5J!i-nWn3HaOAJPU7rju83B4qcwSzun4Dl2B29FEZxtMSU Trump wants $138 million to ensure smooth outcome for false judgment, as in no trial or hearing, simlpy entering in a judgement into the system thus bypassing the fifth amendment right of due process: https://s3.wasabisys.com/conv1/10JanCh3/10JanCh3_951-1033.avi https://drive.google.com/file/d/1iSeGHDToFRoRdIht50Wii0i30mlw9INp/view?usp=sharing https://mega.nz/#!jSwzFYLY!RFQvL8KIyFZf1WfC6tGoPFgJ4aREeGE_pe3i2fwshy8 Obama explains the Illuminati with Jack Dorsey...At 230 a conversation is occurring on the embedded Porter camera system with Jack Dorsey, Peter Thiel, Barack Obama, Bill Murray, and the Porter's. Jack Dorsey provides a statement defining who their group is: "The Illuminati is an underground organization of child rapists and homosexuals." Matthew Porter: "We have to thin the herd, so Barack is going to explain a few things." At 232 Barack Obama says the following: "You people have to realize we are child rapists. The Illuminati are child rapists. As soon as you figure that out, you can decide what to do. Everybody is freaking out about what just happened [child raping event still going on]. This is who we are.": https://s3.wasabisys.com/conv1/Overnight_14-17Jan/15JanCh3_200-347.avi https://drive.google.com/file/d/1Ok1-9IvANULzKBOwADFgaiYCFi6yszfj/view?usp=sharing https://mega.nz/#!nbhTwALA!qmf_0Lq0jApSwxRj1KRS_Q7QYbg4aJc4JMU9rDjR_yo Full 80 page document [updated 20Aug]: three ways to get it: https://s3.wasabisys.com/aviewmefirst/FBI_FinalDraft_26Jul2019_BSchlenker.pdf https://drive.google.com/file/d/1Sj9EN_pHmicKS6rFQlmk67knMdJc9cGk/view?usp=sharing https://mega.nz/#!OKYwES6A!zPGcRSg5de1XALI3FtUH3FCNCuLUzQbZN0l5iNCQqmU \Please post this anywhere you can! Each google drive link is a backup to the wasabi link just in case one is "down". Getting blocked, censored, "downvoted" etc. These people are extremely wealthy and throw money to anyone who will help them cover up their child rapes & murders, corruption. Ironically, this is usually done through a receivership transfer, where you receive the funds after four or more day, and it can be pulled at the last second, whch is usually the case, after you've done them the "service". A word about the "f@\&&ot" usage: it was a necessary tool. It showed three things: they were not in control, if they were the usage would have be stopped. Everyone out there needed to see t%his. Two, it made it unpleasant for them to be in the headspace, which has obvious advantages. Three, it pointed out impersonators of BS because they would not call each other f@%%ot, thus helping to mitigate the spread of false information. Apologies for those unintentionally offended. Of special interest to the LGBT community, I give you Barack Obama in a foursome with Peter Thiel, Jack Dorsey, and Matthew Porter. It is on page 12 of the document where you can download the video containing audio footage of the "event". Link for the doc is just above under "Full 80 page document".
- jammygit 7y agoAs usual, I want to ask: what are your favourite resources for security? These breaches seem like a good opportunity to share knowledge. I like the OWASP content. Google Gruyere is also really nice for xss imho
- lotaezenwa 7y agoSounds like an insurance scam
- leowoo91 7y agoIn what scenario, a system without a db password could possibly be designed for new startups?