10 ms·
Stripe Atlas Vendor Leaked SSNs
- nedwin 7y agoWhy are they notifying folks via mail instead of good old fashioned email? Haven't got a letter yet but would be super easy for me to check my inbox...
- JBerlinsky 7y agoEach state has different laws about how people need to be notified about data breaches. U.S. mail is generally the lowest common denominator across states. See https://info.digitalguardian.com/rs/768-OQW-145/images/the-definitive-guide-to-us-state-data-breach-laws.pdf https://info.digitalguardian.com/rs/768-OQW-145/images/the-d... for more information if you're curious.
- duxup 7y agoIs there any verification / info other than a tweet?
- loganfrederick 7y agoAs a Stripe Atlas customer, I received a snail mail letter from Stripe about this issue. It included some suggestions from them to prevent identity theft. As I texted a tech friend of mine: if I’m receiving a physical letter from a leading tech co like Stripe, then it’s at least a moderately serious issue.
- _Codemonkeyism 7y agoGoogle sends Google adwords ads with physical letters in Germany at least.
- Buge 7y agoWhat does it mean to send an "adwords ad"? Has Google branched out from digital advertising and started distributing ads via the mail?
- kyleee 7y agoA solicitation to join adwords, often including an offer to run a certain amount (ex. $100 worth) of free ads for new users
- deleted 7y ago[deleted]
- bdcravens 7y agoI've received similar solicitations in the US.
- mjevans 7y agoI agree with https://twitter.com/constmontague/status/1213309357204688899 https://twitter.com/constmontague/status/1213309357204688899 "... we need a new personal identifier, SSNs are all stolen at this point" Though identity and authentication should be different things, as an identifier the only real problem with SSNs is that we should be using UUIDs instead. The hard part is authentication, which should have a far more secure process than merely knowing 9 digits everyone (re)uses.
- mjevans 7y agoMaybe it would be more clear if I used some examples. Identity: mjevans on news.ycombinator.com Authentication: is allowed to post as (Identity), is allowed to vote on things, etc. Identity alone should not imply authorization, when someone is asking for a proof of identity what they really want is a record that you are actually an identity (authorization).
- rexer 7y agoI think you may have authentication and authorization swapped.
- mjevans 7y agoYou're correct in that I'm grouping authentication and authorization. The three types of tuples would include: An identity (E.G. a person at an address). Proof that you are that person at that address. A list of things you're allowed to do at that address (IRL laws, or for a computer account publishing as that address/etc).
- floatingatoll 7y agoCan we calculate reproducible cryptographic private keys from fingerprints? If you solve that, you'll unlock an entire business model centered around "anonymous entities that can be regenerated at any time using a biometrics booth at the mall and a secret passphrase known only to you".
- rolltiide 7y agogetting your identity stolen in any way that’ll effect you is all random they’re all leaked now and people borrow them for things that would never show up on your credit report hope you don’t get framed! Good luck
- 3fe9a03ccd14ca5 7y agoNot me though! Equifax gave me 4 years of credit monitoring! I’m in the safe right? /s
- etaioinshrdlu 7y agoIs this relevant to LLC formation only or also c corps?
- binarynate 7y agoUnfortunately, C Corps are affected, too. I created a C Corp through Atlas and was hoping that I dodged this issue, but I just received the notification of the breach in the mail today.
- ryanlol 7y agoOdds are that all these SSNs had been leaked from a bunch of other sources anyways. Why the “fuuuuuuuck”? This doesn’t seem like a big deal at all.
- marklyon 7y agoPresence on this list potentially indicates individuals of higher net worth and credit history, making it more valuable than other sources?
- ryanlol 7y agoYou can just buy 1000s of high-credit profiles located in the wealthiest zip codes for $1/pc max (I’ve seen prices below $0.1/pc but I suppose this is a special request)
- mobileexpert 7y agoStrange to not see an official statement and post Mortem from Stripe mentioned anywhere. Can someone who got a letter post a (redacted as necessary) scan of it?
- mobileexpert 7y agoFound one on Twitter: https://twitter.com/dercentralist/status/1213216360630759431?s=21 https://twitter.com/dercentralist/status/1213216360630759431... Looks like it was the vendor ‘Legalinc’.
- throwaway99898 7y agoFor whatever reason there seems to be a semi-official version hosted by Vermont: https://ago.vermont.gov/blog/2019/12/31/stripe-legalinc-notice-of-data-breach-to-consumers/ https://ago.vermont.gov/blog/2019/12/31/stripe-legalinc-noti...
- scrollaway 7y agoOh jesus https://ago.vermont.gov/blog/category/security-breaches/ https://ago.vermont.gov/blog/category/security-breaches/ There's 63 pages.
- ckrailo 7y agoScrolling through a few, the title of this one caught my eye: University of Notice of Data Breach to Consumers https://ago.vermont.gov/blog/2019/10/02/university-of-notice-of-data-breach-to-consumers/ https://ago.vermont.gov/blog/2019/10/02/university-of-notice...
- Gaelan 7y agoIIRC, some states have laws requiring all data breaches to be reported to the state. I know WA has one, apparently Vermont does too.
- miki123211 7y agoHow could Stripe Atlas even require SSNs? Wasn't the whole point of that service giving access to the U.S. market for people from other countries?
- bdcravens 7y agoIt could be used equally by US-based founders.
- numchk 7y agoAs more Social Security Numbers are leaked from security breaches like Equifax et al - I have done a deep dive into all things publicly known about SSNs and published the results on a hobby site (with limited ad revenue to cover the server cost) to both educate myself on the historic data contained in a social security number, how its usage has changed throughout the years (enumeration at birth in the 80's for example) and then how finally the state and date information was removed around 2009 so that numbers are now randomly assigned. For those born before the 2010 - there is a real information encoded (or deduced) from your number beyond what most are aware. If you are curious what types of information a hacker could deduce, or additional ways your SSN could be mis-used if disclosed (or guessed) take a gander at https://numchk.com/ https://numchk.com/
- deleted 7y ago[deleted]
- zelly 7y agoThe problem with SSNs is how short they are. 9 digits. Even if you hash them, it's not that hard to make a 10^10 - 1 rainbow table. It's the same problem with IPs (v4). You simply cannot store them at all if you care about your customers' privacy.
- throwGuardian 7y agoWhy was Stripe sharing something as critical as [SSN+Name] with a third party? If Atlas is simply a white labeled service of another service, then I hope it was prominent in Stripe's communication with customers/potential-customers. I say this because the market has many competitive offerings in the space, and among the primary reasons to pick Stripe is the assumption of better security, given it's multi billion dollar venture funding and valuation
- reviel 7y agoIf anyone needs a Stripe Atlas alternative that doesn't require SSN and also less expensive ($350 vs Stripes $500 + $400/yr) check out https://www.blook.io/stripe-atlas-alternative https://www.blook.io/stripe-atlas-alternative
- drombn 7y agoThanks for this I was looking into setting up an LLC this year. I’ll check them out!
- andrewh428 7y agoHey Ashley