6 ms·

With the billions of records breached this year alone, I'm feeling quite apathetic to these stories now. Thousands or millions of records are breached due to X

With the billions of records breached this year alone, I'm feeling quite apathetic to these stories now. Thousands or millions of records are breached due to X (usually egregious negligence, sometimes not), the company makes an apology full of mental gymnastics, blame game, and bold lies ("Your privacy is our number one concern, we're sorry we are only pretending to care now."), a few days later the heat is off because another company let loose a few million other records. Repeat. I feel like I need to be re-sensitized. This is a major problem - and I just can't seem to muster up any care for it anymore.

ghostpepper 7y ago
I wonder about the extent to which the seemingly endless supply of breaches has translated into an increase in identity theft (or any other negative consequences that I haven't thought of)
- ziddoap 7y ago
  I think a bigger use-case for these breaches is credential stuffing and more elaborate phishing rather than old fashioned identity theft - but I'm honestly just guessing and have no data to point to.
  - wolco 7y ago
    You don't need phishing if they have the credit card numbers and name/address information.
    - ziddoap 7y ago
      If the credit card number is the end goal, sure. However, there are many other goals of phishing: Pivoting through another person/company to reach another target, IP theft, espionage, corporate sabotage, impersonation, etc.
- mlb_hn 7y ago
  I'm more concerned about the propaganda issue. I argued a couple years ago (heavily edited) when I left the Army that foreign actors (read: Russia) were data mining stolen data for fracture lines to amplify [0] which makes it hard to form a comprehensive list of politically relevant topics. [0] https://www.armyupress.army.mil/Journals/NCO-Journal/Archives/2017/November/Data-Driven-Propaganda/ https://www.armyupress.army.mil/Journals/NCO-Journal/Archive...
  - AmericanChopper 7y ago
    Partisan politics really gets in the way of that point. Both sides of the aisle have been pointing to the other side saying “Russia” or “China” for the past few years, so admitting civil division is their primary objective would almost be admitting complicity.
bluetidepro 7y ago
I feel the same way about pretty much everything and anything related to any type of news. Whether it's tech news like this, environmental news, or political news. It's the same thing over and over, as you described. Incident, Twitter/media coverage/hype, blame, lies, apologies, and then it's not talked about again a week later. Sigh.
- 8f2ab37a-ed6c 7y ago
  The president's new outrageous tweet / orange man = bad, another wedding blown up in some middle eastern country, someone famous said something inappropriate / groped someone that got them fired, earthquake/fire/tsunami wiped out a few thousand people in some distant land, another school got shot up, "clear signs we're in a bubble" and the market is about to crash, something generic about Silicon Valley's hubris, something about how another oppressed group is being screwed over etc etc. I don't think we're really meant as a species for this constant stream of depressing information we can't act upon, it's not good for us. Apathy seems like the only natural response to this barrage of stressors.
  - lazyasciiart 7y ago
    Had an annual checkup recently and did a screening for anxiety/depression. It felt unrealistic - is it a problem with me to be "Worrying 'too much' about different things"?
  - solstice 7y ago
    A small counterpoint to your last point: the youngsters at Fridays for future and the folks of Extinction rebellion
    - 8f2ab37a-ed6c 7y ago
      I actually believe that the present and the future are bright. Pinker's last book does a great job at showing how we're all simply victims of recency/availability/selection/confirmation bias when consuming the news. The world is getting dramatically better, it's our perception of it that is getting constantly worse.
devoply 7y ago
With all the information exposed probably 60-70% of all people have been exposed. We need to stop the ability of anyone to do anything useful with this data. Which means forcing banks to improve their security standards... rather than calling it identity theft and forgetting about it.
- ziddoap 7y ago
  I think it might be too late to put the genie back in the bottle without a multi-industry, multi-system overhaul. I agree banks need to improve security standards (along with just about every other major and minor company). But banks being more secure doesn't get to the root of the issue any more than just forgetting about it (after all, it's generally not the bank having their innards on display). There is no silver bullet.
  - SkyBelow 7y ago
    We need to shift identity theft back onto the businesses being the ones to bear the costs. This would be hard to do, but would be far simpler than trying to force all businesses to use a new identity system (that just ends up being leaked with two years). It creates an incentive for the businesses to care about actually verifying one's id.
  - blackflame7000 7y ago
    How about 2 forms of government ID to open an account just like you need to get a passport. Identity theft is so easily facilitated by just having to enter a social security number online and the banks are responsible because they are trying to make it as easy as possible for anyone to sign up.
    - ziddoap 7y ago
      This doesn't address credential stuffing, spear-phishing, propaganda, or many of the other issues that come along with data breaches. Identity theft is a piece of the puzzle, but no where near the whole thing. Your idea might cut down on identity theft - I'm not sure. But it doesn't speak to the root issue. (Not to say it isn't worth pursuing, just that it doesn't do anything if I shared a password between my email, bank, and MoviePass)
soulofmischief 7y ago
Everyone has an opinion on why Amazon is a monopoly and should be broken up, but this is what they don't think about. I trust Amazon not to get breached. No one is infallible, but tech is their thing. I have no interest however, in further increasing the amount of online shopping accounts I maintain, because that means I have to keep tabs on the shenanigans of even more, highly technically incompetent, companies to know if I've been compromised.
- symlinkk 7y ago
  Just use a password manager so you can have a different password for each site. It's not that hard.
  - jvagner 7y ago
    The article points out that MoviePass had user and credit card data in plain text. A password manager wouldn't have helped with that.
    - checker 7y ago
      The credit agencies are supposed to protect cardholders via PCI DSS audits (see https://www.pcisecuritystandards.org/pdfs/pci_fs_data_storage.pdf https://www.pcisecuritystandards.org/pdfs/pci_fs_data_storag...). This is definitely non-compliant. Obviously this system is broken. Additionally, I don't understand why companies continue to roll their own payment processing rather than paying a service that knows how to do it. I guess it seems easy...
      - tsukurimashou 7y ago
        Well if you can make more profit, have all the advantages without being PCI DSS compliant. Why would you not roll your own payment processing? Since nothing happens apparently when the data of your customers get "breached"
        7y ago
iriei83 7y ago
The point is a technological solution isn’t viable when societies norms and laws allow it to go unpunished. You’re barking up the wrong tree trying to engineer a solution before society changes laws that would hold the power brokers accountable. Push aside your keyboard and get out there advocating for legal accountability. At the same time, those of us around today have been leaked. I’ve been in tech since the 80s, data tapes went missing all the time. One breach in the 90s resulted in tapes showing up in Russia. Change the laws. Cause there is no stopping it from a tech perspective. You’re not needing re-sensitizing. You’re needing to think of the problem outside the context of technical solutions.
- ziddoap 7y ago
  I didn't anywhere in my comment say this was a purely technical issue, or that I was advocating a purely technical solution, or that the societal side does or does not need to change, or really anything that you mentioned. I said I'm apathetic because this happens too much, and that it is a problem. Where you assumed all the other stuff about me, I'm not sure.
ProAm 7y ago
"The age of privacy is over" (2010) [1] [1] https://archive.nytimes.com/www.nytimes.com/external/readwriteweb/2010/01/10/10readwriteweb-facebooks-zuckerberg-says-the-age-of-privac-82963.html https://archive.nytimes.com/www.nytimes.com/external/readwri...
oow92 7y ago
Maybe we could accept that despite the leaks society is carrying on just fine? Perhaps the paranoia is a bit overblown, and is implicitly allowed to satisfy notions that financial market performance is somehow the highest priority or literally reflective of efficiency. Remember, scores of people are convinced Sky Wizards are literal things. I’ve seen no reason to believe common held beliefs in economics are anything less than qualification without well reasoned checking. My priorities in life are not a rich person’s financial portfolio. And we can see how they treat each other when these breaches happen. They don’t care and pat each other on the back coughEquifaxcough. Why should we take such a serious posture if the rich owners don’t?
- mattkevan 7y ago
  Data is our century’s version of leaded petrol, CFCs [0], greenhouse gases and long-term nuclear waste containment. Not saying those things are no longer problems, but they weren’t seen as ones until they suddenly became ones. Like toxic waste, data always finds a way to escape its container. Data wants to be free - just not in the way we originally hoped. Just like those early fridge manufacturers, we don’t yet know what the long-term effects of releasing so much data into the atmosphere are going to be. The next 50 years are going to be bumpy as we find out. [0] Fun fact: the inventor of leaded petrol also invented CFCs. He probably did more damage to the environment than anyone else ever, living or dead. https://en.m.wikipedia.org/wiki/Thomas_Midgley_Jr https://en.m.wikipedia.org/wiki/Thomas_Midgley_Jr.
- ziddoap 7y ago
  Bad actors having access to intimate personal details (health and financial records), past passwords (not everyone uses 1 password per site), etc. is not a matter of my paranoia being overblown. I don't know how someone getting access to my medical records or locking me out of my email account is related to financial market performance. >Remember, scores of people are convinced Sky Wizards are literal things. We know, for a fact, that data is being breached and ending up in the hands of the wrong people. How are you honestly making a comparison to "Sky Wizards"? Why should we take such a serious posture if the rich owners don’t? Because it's my f'in data.
imgabe 7y ago
At this point, security measures need to assume that your information has been made public.
- ziddoap 7y ago
  For the technically savvy, great. I'm sure most of us think like that. My poor mom on the other hand doesn't necessarily know what that entails, and what steps she should take.
  - imgabe 7y ago
    It should not be up to your mom. It needs to be on the banks, government agencies, and everyone else who needs to verify people's identity. "Oh, you've got the correct address and the last 4 digits of a social" is no longer acceptable as proof that someone is who they say they are. Something else needs to be in place. Whatever that is, the burden should be on the banks, etc. to develop that and explain to your mom what it is and how it works.
    - ziddoap 7y ago
      I agree with you wholeheartedly, but right now it is up to her. So, your first comment is great for the technically savvy, but everyone else is SOL.
Traster 7y ago
I think it's worth mentioning that GDPR was basically exactly this. They're putting in systematic regulations to ensure that data isn't arbitrarily kept, it must be secure and the regulations have teeth. It's really well thought out - minimize the number of companies that have your data, minimize the data they have, minimize how long they can hold it for and hold them repsonsible for keeping it safe. Yet, when these regulations were actually bought in, you can see especially on this forum, that people were incredibly sceptical. So whilst you might think that we need to be sensitive to private personal data, it seems like people disagree when it comes to actually implementing that.
- rhizome 7y ago
  I don't think people are skeptical so much as they are aspiring data abusers. They're taking the corporate side over users, over their friends and family.
- steve19 7y ago
  > I think it's worth mentioning that GDPR was basically exactly this. There is very little the GDPR would have done to prevent this. The data was legitimatly collected from customers. It was leaked because of badly configured server or firewall. The company is no longer in business so no fines (or minimal fines) would be paid.
  - Traster 7y ago
    Your argument only makes sense because MoviePass is now gone, but MoviePass didn't design their technology stack planning to go bankrupt. GDPR would've required them to take more reasonable precautions with the storage of private info - knowing that if they failed they could be fined even if they didn't go bankrupt for other reasons.
rhizome 7y ago
With the billions of records breached this year alone, I'm feeling quite apathetic to these stories now. My theory is that the lack of punishment is intentional for just such a purpose, in a collusion between government and industry to milk all of us for free data about every aspect of our lives, from the past into the future. They're just going to take it. You see, people won't demand privacy protections enshrined in law if they simply don't give a shit anymore. Companies don't incur liability, people get some free "credit monitoring" service that should be provided by default. None of this does anything about the leaked data being used to market to you, manipulate your votes, or worse. Then, at the end of the day Facebook et al doesn't have to worry about their contributory privacy violations at all. If you don't want your private messages sold (rented) to every spammer on Earth, what are you gonna do about it? What's the business case for caring on their part?
tibbon 7y ago
There's no accountability. Executives never see jailtime for gross negligence. They just push profits at the sake of all else, and don't give a shit about the PII of their users.

ghostpepper 7y ago

I wonder about the extent to which the seemingly endless supply of breaches has translated into an increase in identity theft (or any other negative consequences that I haven't thought of)

ziddoap 7y ago
I think a bigger use-case for these breaches is credential stuffing and more elaborate phishing rather than old fashioned identity theft - but I'm honestly just guessing and have no data to point to.
- wolco 7y ago
  You don't need phishing if they have the credit card numbers and name/address information.
  - ziddoap 7y ago
    If the credit card number is the end goal, sure. However, there are many other goals of phishing: Pivoting through another person/company to reach another target, IP theft, espionage, corporate sabotage, impersonation, etc.
mlb_hn 7y ago
I'm more concerned about the propaganda issue. I argued a couple years ago (heavily edited) when I left the Army that foreign actors (read: Russia) were data mining stolen data for fracture lines to amplify [0] which makes it hard to form a comprehensive list of politically relevant topics. [0] https://www.armyupress.army.mil/Journals/NCO-Journal/Archives/2017/November/Data-Driven-Propaganda/ https://www.armyupress.army.mil/Journals/NCO-Journal/Archive...
- AmericanChopper 7y ago
  Partisan politics really gets in the way of that point. Both sides of the aisle have been pointing to the other side saying “Russia” or “China” for the past few years, so admitting civil division is their primary objective would almost be admitting complicity.

bluetidepro 7y ago

I feel the same way about pretty much everything and anything related to any type of news. Whether it's tech news like this, environmental news, or political news. It's the same thing over and over, as you described. Incident, Twitter/media coverage/hype, blame, lies, apologies, and then it's not talked about again a week later. Sigh.

8f2ab37a-ed6c 7y ago
The president's new outrageous tweet / orange man = bad, another wedding blown up in some middle eastern country, someone famous said something inappropriate / groped someone that got them fired, earthquake/fire/tsunami wiped out a few thousand people in some distant land, another school got shot up, "clear signs we're in a bubble" and the market is about to crash, something generic about Silicon Valley's hubris, something about how another oppressed group is being screwed over etc etc. I don't think we're really meant as a species for this constant stream of depressing information we can't act upon, it's not good for us. Apathy seems like the only natural response to this barrage of stressors.
- lazyasciiart 7y ago
  Had an annual checkup recently and did a screening for anxiety/depression. It felt unrealistic - is it a problem with me to be "Worrying 'too much' about different things"?
- solstice 7y ago
  A small counterpoint to your last point: the youngsters at Fridays for future and the folks of Extinction rebellion
  - 8f2ab37a-ed6c 7y ago
    I actually believe that the present and the future are bright. Pinker's last book does a great job at showing how we're all simply victims of recency/availability/selection/confirmation bias when consuming the news. The world is getting dramatically better, it's our perception of it that is getting constantly worse.

devoply 7y ago

With all the information exposed probably 60-70% of all people have been exposed. We need to stop the ability of anyone to do anything useful with this data. Which means forcing banks to improve their security standards... rather than calling it identity theft and forgetting about it.

ziddoap 7y ago
I think it might be too late to put the genie back in the bottle without a multi-industry, multi-system overhaul. I agree banks need to improve security standards (along with just about every other major and minor company). But banks being more secure doesn't get to the root of the issue any more than just forgetting about it (after all, it's generally not the bank having their innards on display). There is no silver bullet.
- SkyBelow 7y ago
  We need to shift identity theft back onto the businesses being the ones to bear the costs. This would be hard to do, but would be far simpler than trying to force all businesses to use a new identity system (that just ends up being leaked with two years). It creates an incentive for the businesses to care about actually verifying one's id.
- blackflame7000 7y ago
  How about 2 forms of government ID to open an account just like you need to get a passport. Identity theft is so easily facilitated by just having to enter a social security number online and the banks are responsible because they are trying to make it as easy as possible for anyone to sign up.
  - ziddoap 7y ago
    This doesn't address credential stuffing, spear-phishing, propaganda, or many of the other issues that come along with data breaches. Identity theft is a piece of the puzzle, but no where near the whole thing. Your idea might cut down on identity theft - I'm not sure. But it doesn't speak to the root issue. (Not to say it isn't worth pursuing, just that it doesn't do anything if I shared a password between my email, bank, and MoviePass)

soulofmischief 7y ago

Everyone has an opinion on why Amazon is a monopoly and should be broken up, but this is what they don't think about. I trust Amazon not to get breached. No one is infallible, but tech is their thing. I have no interest however, in further increasing the amount of online shopping accounts I maintain, because that means I have to keep tabs on the shenanigans of even more, highly technically incompetent, companies to know if I've been compromised.

symlinkk 7y ago
Just use a password manager so you can have a different password for each site. It's not that hard.
- jvagner 7y ago
  The article points out that MoviePass had user and credit card data in plain text. A password manager wouldn't have helped with that.
  - checker 7y ago
    The credit agencies are supposed to protect cardholders via PCI DSS audits (see https://www.pcisecuritystandards.org/pdfs/pci_fs_data_storage.pdf https://www.pcisecuritystandards.org/pdfs/pci_fs_data_storag...). This is definitely non-compliant. Obviously this system is broken. Additionally, I don't understand why companies continue to roll their own payment processing rather than paying a service that knows how to do it. I guess it seems easy...
    - tsukurimashou 7y ago
      Well if you can make more profit, have all the advantages without being PCI DSS compliant. Why would you not roll your own payment processing? Since nothing happens apparently when the data of your customers get "breached"
      - 7y ago

iriei83 7y ago

The point is a technological solution isn’t viable when societies norms and laws allow it to go unpunished. You’re barking up the wrong tree trying to engineer a solution before society changes laws that would hold the power brokers accountable. Push aside your keyboard and get out there advocating for legal accountability. At the same time, those of us around today have been leaked. I’ve been in tech since the 80s, data tapes went missing all the time. One breach in the 90s resulted in tapes showing up in Russia. Change the laws. Cause there is no stopping it from a tech perspective. You’re not needing re-sensitizing. You’re needing to think of the problem outside the context of technical solutions.

ziddoap 7y ago
I didn't anywhere in my comment say this was a purely technical issue, or that I was advocating a purely technical solution, or that the societal side does or does not need to change, or really anything that you mentioned. I said I'm apathetic because this happens too much, and that it is a problem. Where you assumed all the other stuff about me, I'm not sure.

ProAm 7y ago

"The age of privacy is over" (2010) [1] [1] https://archive.nytimes.com/www.nytimes.com/external/readwriteweb/2010/01/10/10readwriteweb-facebooks-zuckerberg-says-the-age-of-privac-82963.html https://archive.nytimes.com/www.nytimes.com/external/readwri...

oow92 7y ago

Maybe we could accept that despite the leaks society is carrying on just fine? Perhaps the paranoia is a bit overblown, and is implicitly allowed to satisfy notions that financial market performance is somehow the highest priority or literally reflective of efficiency. Remember, scores of people are convinced Sky Wizards are literal things. I’ve seen no reason to believe common held beliefs in economics are anything less than qualification without well reasoned checking. My priorities in life are not a rich person’s financial portfolio. And we can see how they treat each other when these breaches happen. They don’t care and pat each other on the back coughEquifaxcough. Why should we take such a serious posture if the rich owners don’t?

mattkevan 7y ago
Data is our century’s version of leaded petrol, CFCs [0], greenhouse gases and long-term nuclear waste containment. Not saying those things are no longer problems, but they weren’t seen as ones until they suddenly became ones. Like toxic waste, data always finds a way to escape its container. Data wants to be free - just not in the way we originally hoped. Just like those early fridge manufacturers, we don’t yet know what the long-term effects of releasing so much data into the atmosphere are going to be. The next 50 years are going to be bumpy as we find out. [0] Fun fact: the inventor of leaded petrol also invented CFCs. He probably did more damage to the environment than anyone else ever, living or dead. https://en.m.wikipedia.org/wiki/Thomas_Midgley_Jr https://en.m.wikipedia.org/wiki/Thomas_Midgley_Jr.
ziddoap 7y ago
Bad actors having access to intimate personal details (health and financial records), past passwords (not everyone uses 1 password per site), etc. is not a matter of my paranoia being overblown. I don't know how someone getting access to my medical records or locking me out of my email account is related to financial market performance. >Remember, scores of people are convinced Sky Wizards are literal things. We know, for a fact, that data is being breached and ending up in the hands of the wrong people. How are you honestly making a comparison to "Sky Wizards"? Why should we take such a serious posture if the rich owners don’t? Because it's my f'in data.

imgabe 7y ago

At this point, security measures need to assume that your information has been made public.

ziddoap 7y ago
For the technically savvy, great. I'm sure most of us think like that. My poor mom on the other hand doesn't necessarily know what that entails, and what steps she should take.
- imgabe 7y ago
  It should not be up to your mom. It needs to be on the banks, government agencies, and everyone else who needs to verify people's identity. "Oh, you've got the correct address and the last 4 digits of a social" is no longer acceptable as proof that someone is who they say they are. Something else needs to be in place. Whatever that is, the burden should be on the banks, etc. to develop that and explain to your mom what it is and how it works.
  - ziddoap 7y ago
    I agree with you wholeheartedly, but right now it is up to her. So, your first comment is great for the technically savvy, but everyone else is SOL.

Traster 7y ago

I think it's worth mentioning that GDPR was basically exactly this. They're putting in systematic regulations to ensure that data isn't arbitrarily kept, it must be secure and the regulations have teeth. It's really well thought out - minimize the number of companies that have your data, minimize the data they have, minimize how long they can hold it for and hold them repsonsible for keeping it safe. Yet, when these regulations were actually bought in, you can see especially on this forum, that people were incredibly sceptical. So whilst you might think that we need to be sensitive to private personal data, it seems like people disagree when it comes to actually implementing that.

rhizome 7y ago
I don't think people are skeptical so much as they are aspiring data abusers. They're taking the corporate side over users, over their friends and family.
steve19 7y ago
> I think it's worth mentioning that GDPR was basically exactly this. There is very little the GDPR would have done to prevent this. The data was legitimatly collected from customers. It was leaked because of badly configured server or firewall. The company is no longer in business so no fines (or minimal fines) would be paid.
- Traster 7y ago
  Your argument only makes sense because MoviePass is now gone, but MoviePass didn't design their technology stack planning to go bankrupt. GDPR would've required them to take more reasonable precautions with the storage of private info - knowing that if they failed they could be fined even if they didn't go bankrupt for other reasons.

rhizome 7y ago

With the billions of records breached this year alone, I'm feeling quite apathetic to these stories now. My theory is that the lack of punishment is intentional for just such a purpose, in a collusion between government and industry to milk all of us for free data about every aspect of our lives, from the past into the future. They're just going to take it. You see, people won't demand privacy protections enshrined in law if they simply don't give a shit anymore. Companies don't incur liability, people get some free "credit monitoring" service that should be provided by default. None of this does anything about the leaked data being used to market to you, manipulate your votes, or worse. Then, at the end of the day Facebook et al doesn't have to worry about their contributory privacy violations at all. If you don't want your private messages sold (rented) to every spammer on Earth, what are you gonna do about it? What's the business case for caring on their part?

tibbon 7y ago

There's no accountability. Executives never see jailtime for gross negligence. They just push profits at the sake of all else, and don't give a shit about the PII of their users.