13 ms·
> The information accessed is not sufficient to make fraudulent charges on your payment card. In other words... "We leaked a bunch of your personal information
by cj 7y ago
> The information accessed is not sufficient to make fraudulent charges on your payment card.
In other words... "We leaked a bunch of your personal information, but at least it's not enough data to steal your money!"
All of these leaks have the cumulative effect of making ineffective very commonly used security verification questions: "Can I verify that last 4 of your social? And the last 4 of your credit card?"
How long will it take for us to accept that this kind of data can no longer be assumed private? The sooner, the better, mainly so companies stop using it as a secondary form of identity verification.
- paxys 7y agoYeah. In fact reversing a fraudulent credit card charge is a LOT easier than dealing with identity theft or stalkers.
- boobePhuu7iet7i 7y agoBut now they have a dump of how many peoples names, address and phone numbers?
- hombre_fatal 7y agoLeaking is only part of the problem. The main issue is that this information lets you authenticate with anything at all or as a starting point for social engineering. For example, you could build your own database of millions of records of name/phone/addr just looking up WHOIS info on every domain name you come across. And I'm reminded of how you can get into someone's Amazon account by feeding WHOIS information to their customer support, even if the address is bogus but is in the same city that Amazon has on file. https://medium.com/@espringe/amazon-s-customer-service-backdoor-be375b3428c4 https://medium.com/@espringe/amazon-s-customer-service-backd... HN takes out its pitch forks for every leak, but the outrage is often misdirected. For example, why do we have this idiotic system where you can make purchases on my credit card with the same credentials I hand out multiple times a day, even for a $5 hotdog, and as a result I need to remain eternally vigilant to find fraud on my monthly statements? Why can you get into my Amazon account if you know a single address that approximates one of the addresses I've ever shipped product to? Leaking is inevitable. The problem is that our system and thus our expectations are built as if it's not.
- njarboe 7y agoCash really is underrated.
- hombre_fatal 7y agoHell, imagine how many scans of people’s passports and driver’s licenses are sitting in databases waiting to be leaked, yet images of those documents let you authenticate with all sorts of financial institutions online from banks to Coinbase to Paypal. We really need to rethink all this. Until then, it feels like mere luck that today wasn’t the day someone decided to social engineer their way into your life. Everything is so precarious.
- njarboe 7y agoIf militaries have any imagination, they already have this data for their adversaries' populations and have cyber weapons ready to do this quickly at massive scale.
- sterlind 7y agoI'd assumed that was the motivation for the OPM hack. Helps root out agents and handlers since they have SF-86 forms and biometrics, but also a massive database for identity fraud. Also helps with money laundering, which even richer states can benefit from.
- Washuu 7y agoEditor's clarification: United States Office of Personnel Management(OPM)
- blaser-waffle 7y agoTheir first targets would be things like power plants, tv stations, and central network nodes. Sowing chaos is useful, sorta, but that means things are still usable -- and the OpFor can potentially hit back. Better off just silencing the wires altogether; hit the power plants, tv and radio stations, major telephone & data centers, undersea cables, etc. If I had $40B to budget on cyber warfare I'm finding out how to hack nuclear plants or cause hydroelectric dam overloads, not tinker with the Amazon accounts of the flyover states.
- rolltiide 7y ago
- hchasestevens 7y agoSurely the actual problem here is that the responsibility for reliable identification somehow falls on the consumer, not the bank or what have you? I'll give an example: if I get a phishing email claiming to be from my bank, and end up wiring them $1000, I'm out $1000 for not having done the due diligence for verifying that it in fact was my bank; my bank doesn't suddenly owe me $1000. Somehow, though, if some 3rd party convinces the bank they're me, and withdraws $1000 from my account, I'm at fault as a victim of "identity fraud" (and am again out $1000, but this time as a result of my bank's incompetence). If the onus for verifying your identity were on institutions (and, consequently, the losses in cases of failure to do so) I'm confident that we would have much more reliable means of personal identification magically pop into existence.
- tolmasky 7y agoThe problem with what you're proposing is that, as far as I understand, the real "consequences" for things like identity theft end up being intangibles like "time" and "annoyance" or "credit score". I don't think you'll actually be out $1000, the bank will just reverse it or it will be covered under some sort of insurance or something. Many times its just people taking out fraudulent loans under your name (vs. directly stealing money from you), so it gets handled entirely "digitally" and you experience no long term financial harm. Because of that, no one ends up "angry" at the bank, since what they lost was a week in "hassle".
- flatline 7y agoExcept that it can take months or years for the affected individual to clear up their credit record. And they may still end up on the hook for some of that debt. There is a direct and immediate impact on the individual in terms of debt against them and whatever credit reporting occurs on that debt. There is more distant impact on the lenders to eventually eat the losses - which in aggregate are in fact quite large - but no real impact to the lender’s reputation.
- cheriot 7y agoIt's worth distinguishing between the lenders and the credit bureaus. The latter cause much of the pain around identity theft afaik.
- dmix 7y agoWhat websites are storing your mother’s maiden name? Besides maybe the bank
- deleted 7y ago[deleted]
- anigbrowl 7y agoAnyone that asks a security question, eBay for one.
- dylan604 7y agoOnly if you provided that information as answer. kwPP2ET6cJMFXVD7BXKJ is an acceptable answer to the maiden name question.
- blaser-waffle 7y agoI like swear words. It's fun to tell online personnel your first high school is "Eat A Dick, Son". High graduation rates at EADS HS, for the record.
- dmix 7y agoOh yeah I have some memorable made up names I put in those. Never thought to use my real one.
- cj 7y ago23andme. If they get hacked... well, say goodbye to maiden name as a verification!
- rhizome 7y ago"It's only 200 of Cambridge Analytica's 5000 data points about you."
- ajhurliman 7y agoAlternative, when do we start using proxy services that give minimal, fake information that forwards to our real identity? Apple sign-in was an understated release, but it will be one of the company's flagship products in years to come.
- nwallin 7y agoThe cynic in me thinks they leaked names, addresses, and credit card numbers but not the CVV number. Without the CVV it's not technically possible to make charges, so it would not be a lie. I think it's been clear since Equifax that private data can't be used to prove identity. I honestly wish the hacker behind that attack just gave away the entire dataset to the public. It would have stung a little at first, but it would have saved society a ton of time and money on the long run.
- Crosseye_Jack 7y ago> Without the CVV it's not technically possible to make charges, so it would not be a lie. You can process charges without the cvv, but it costs your more to process them and is supposed to lower the risk. Some big players like Amazon still process payments without the need of providing a cvv.
- tempsy 7y agoAt least with a drivers license it should be pretty easy to commit identity theft and sign up for credit cards/open bank accounts with that person’s identity.
- antihero 7y agoUnless you have a domain with GoDaddy, of course...