15 ms·

Adult site leaks data of cam models

330 points by DemiGuru 7y ago

DemiGuru 7y ago
These include scans of documents that prove the model's age, things like ID cards, birth certificates, and passport scans. Also included were performer release forms and profile information. This is particularly bad given the sensitive nature of the work and the need to maintain the personal privacy and safety of the X-rated web stars. There is also the risk that, as the records from virtually every occupied part of the world, that LGBTQ+ performers in some areas could be at risk of persecution.
- nerdponx 7y ago
  Persecution is putting it mildly. It could put people at physical risk of harm.
  - hprotagonist 7y ago
    s/could/just did Even discarding things like prejudice, cammers have stalker problems fairly regularly as I understand it. When you can get doxxed by a traffic sign reflected in your eyes ... https://www.bbc.com/news/world-asia-50000234 https://www.bbc.com/news/world-asia-50000234
    - celticmusic 7y ago
      jesus h, that's insane.
      - Raphmedia 7y ago
        I can't remember which community this was, but I remember some forum that had a category dedicated to something similar (with consent). People would post pictures of the view from their hotel window when travelling and the other members would compete in being the first to find the exact location. When I say exact, I mean exact. They had to find from which window the picture was taken. It amazed me how some people could figure it out in a few hours and sometimes even less. Only post pictures online if you are alright with being doxxed from them.
        EForEndeavour 7y ago
        Wow. Bellingcat, but for stalking and sexual assault.
        rhcom2 7y ago
        I remember 4chan doing something similar with a project Shia Labeouf was doing: https://www.vice.com/en_us/article/d7eddj/4chan-does-first-good-thing-pulls-off-the-heist-of-the-century1 https://www.vice.com/en_us/article/d7eddj/4chan-does-first-g...
        hprotagonist 7y ago
        https://old.reddit.com/r/FridgeDetective/ https://old.reddit.com/r/FridgeDetective/ is the benign-ish version of this.
  - meowfly 7y ago
    I think some commenters might be missing that in many countries like China (where the article shows a passport photo) engaging in pornography is illegal. This leak has the opportunity to ruin lives in many ways.
- landcoctos 7y ago
  Another reason to never send IDs "required" by many companies today .. using email or their app
  - techslave 7y ago
    i always redact the PII part. so for example i cannot sign up at all of the verification required proof of age. because birthdate will be redacted. so far, if the tiny number of places i’ve needed to send a DL or something, no one has complained that it’s pretty much just my name and picture. i imagine the staff checking isn’t paid enough to care.
  - cylon13 7y ago
    That's easy for you to say as someone that I'm assuming isn't trying to become a cam model. These people wouldn't have been able to get the job without sending the verifying information, and you don't know their circumstances. Saying "just don't do the thing," without nuance or context is just ignorant.
    - celticmusic 7y ago
      I disagree. People are going to do it, but it needs to be understood that there are major risks with doing it.
      - davidajackson 7y ago
        This last point of 'understanding' is what makes this issue so hard to address for any non-technical userbase. Most people don't even really think about the fact that the "Cloud" is really just someone else's computer. Deloitte did a study recently where they concluded that although privacy is users' #1 concern, most people don't change their behavior. When you combine that with people who don't understand how technology works--but need to get paid--I don't see a good solution where they have any incentive not to take risks. The companies creating these sites don't have an incentive to put up a banner saying "You might not want to sign up for this, we might leak your data." Perhaps some legal disclosure of the risks when providing different levels of PII, just like we have Surgeon General warnings?
rahuldottech 7y ago
Leaked data includes: Full name Birth date Birthplace Citizenship status Nationality Passport/ID number Passport issue & expiration dates Nationally registered gender ID photo Personal signature Parent’s full names Fingerprints Additional country-specific details (e.g. emergency contact information for UK citizens) This is bad. IDs shouldn't be stored on your server once you've confirmed the age/identity/whatever of the user.
- celticmusic 7y ago
  generally I agree, but I can understand why they did it. If they're accused of allowing underage models they'll be in a spot they definitely don't want to be in. There was a case years ago of a man who was on trial for child porn. It took the actress physically coming into the courtroom and showing her ID before the case was dropped. It's just a really scary place to be in terms of society and the law, so I can understand making the decision to do the 'wrong' thing in this instance.
  - pavel_lishin 7y ago
    If you're sufficiently paranoid to want to hold onto this data, it should at least be kept in cold storage. And it's not expensive; I can walk over to Best Buy right now and pick up a hard drive big enough to store this data with cash I happen to have in my wallet.
    - celticmusic 7y ago
      that's a fair point. I'm not saying they didn't make mistakes, just that I understand why they held onto the ID's in this case.
    - miohtama 7y ago
      Also data retention policy: automatically purge old data when it is no longer actively being accessed
      - 7y ago
Nextgrid 7y ago
And this is why I recommend using fake details & IDs when signing up to sensitive services like this. Not an ideal situation and I'm not blaming the victims here, just stating what I would do if I had no choice but to sign up for such a site. Given the life-changing consequences of a leak and the risk of harm (stalkers showing up at home, or being an LGBT performer in a location where the government doesn't approve of that) the consequences of being caught with a fake ID are tame in comparison. Ideally there should be a way for the websites to fulfil their legal obligations regarding age verification without actually handling any ID data themselves. Maybe a government-provided oAuth style service where you are redirected there, authenticate with the government (no extra risk there, they already have the data) and then they return a signed blob to the website asserting that you are of legal age without actually disclosing any details.
- falcolas 7y ago
  The models can't fake this data - it's required as proof that the filming is consensual, and that they are of a legal age to produce the films.
  - Nextgrid 7y ago
    Would an ID with everything redacted but the picture and birthdate pass? It should be sufficient to fulfil the site's legal requirements while mitigating risk of the data leaking - you can't leak what you can't have.
    - drablyechoes 7y ago
      The moral, legal and technical imperative to protect this data is 100% on the company storing this data. Even if the onus of protecting sensitive personal information were passed on to the performers making a living from this site, they would still need to show their full legal name on a redacted ID (which makes finding the address trivial). The owners of this site should be ordered to pay restitution for the damages it has caused to all the performers impacted by this leak. If there are no consequences for things like this, companies will continue to be poor custodians of sensitive data that we entrust to them. The most vulnerable people in society will, as usual, suffer the greatest harm.
Tenoke 7y ago
Predictions, bets and opinions on what punishment will PussyCash/ImLive be facing? A fine proportional to their earnings?
- bilekas 7y ago
  My prediction, a public statement apologising. With 2-1 odds that it will contain : "We value our clients privacy" mentioned at least twice.
  - ryandrake 7y ago
    Guarantee they will also say the phrase “we take security very seriously.”
- Nextgrid 7y ago
  Absolutely zero, considering their business is already shady as fuck powered by spammers spamming the affiliate links, nasty ads and no doubt lots of dark patterns. If the law cared they would already be in trouble for something else. Besides that, Equifax got away with a slap on the wrist even though it was a highly publicised case. This case will have zero attention outside of HN and the likes so I'd be very surprised if it even makes it to court. There's also the issue that bringing the case to court will attract more attention to the leak and potentially force the plaintiffs to state their real details on the record, so while it's definitely unfair to let the website operators go unpunished, maybe leaving the mess alone and hoping the dust settles is the best course of action.
- filmgirlcw 7y ago
  Nothing. The jurisdiction this place operates in is fuzzy at best and I feel confident the owners will just abscond and go off to the next place. Plus, the people who are the victims here are not the people who typically have the money to pursue this (and may live in countries where pursuing anything would cause more harm). Marginalized victims, opaque legal jurisdiction/laws, and little/no incentive to go after the owners means that I feel confident absolutely nothing will happen. Think about it: Equifax doxxed more than half the US population and got away with a slap on the wrist and was rewarded with even more government contracts.
makach 7y ago
I feel sorry for the girls. All should stay away from the leaked data Is the website stepping up to take responsibility?
- NickBusey 7y ago
  And guys. And others.
  - deleted 7y ago
    [deleted]
- danso 7y ago
  FTA: PussyCash never replied to any of our attempts to contact them regarding the data leak, including their Data Protection Officer. ImLive finally responded to one of our emails, stating that they would take care of it and pass on the information to the PussyCash tech team.
- dependenttypes 7y ago
  > All should stay away from the leaked data Why?
  - jacquesm 7y ago
    Because nothing good can come of that.
    - MadWombat 7y ago
      That depends on how you define "good"
      - EForEndeavour 7y ago
        Even if you're trolling, I suppose you're technically correct in that this is "good" for stalker-rapists, and maybe analysts of the cam-modeling industry.
gnrlst 7y ago
What makes it even worse, is that this is an industry where un-sane individuals frequently get obsessed / fall in love / stalk the models in question very frequently due to the context in which they work. This leak is going to be life-ruining (and potentially dangerous) for many of them.
- sergiotapia 7y ago
  Obsessed simps who donate thousands upon thousands of dollars are very dangerous. Even on Twitch these people are a sight to behold.
  - viklove 7y ago
    And yet, camsite models wouldn't be able to sustain themselves without these simps. It's really a two-edged blade.
- filmgirlcw 7y ago
  Yes. I don’t say this lightly: this is the sort of data that if used the wrong way could wind up with someone being killed. This is a situation where the real-life consequences could literally be death.
droithomme 7y ago
> They boast 66 million registered members on their webcam chat arena, ImLive, alone. Let's say each registered user pays $1 a month for access to this one site they run. That's $66 million/month in revenue. Enough to secure data and comply with privacy laws.
- stevewodil 7y ago
  Why are you arbitrarily estimating revenue? Also registered users != active/paying users
gok 7y ago
A friend of mine who did a few movies in the 2000s told me she felt much more violated by the paperwork for the required record keeping than she did having sex on camera.
- rjkennedy98 7y ago
  It’s there for very good reason- to ensure that the models are adults.
Pxtl 7y ago
Given the requirements to keep this data, I'd be curious what data-model would make sense to prevent leaking it. I honestly can't think of anything practical that's better than "encrypt at rest, better hygiene with database credentials". After all, the webserver needs the ability to submit this data, and logically people are going to want to be able to review their own data on the web in order to update it. What do?
- jedimastert 7y ago
  Most of the information should have never been kept in the first placed. Hell, it never should have touched their servers in the first place
  - Pxtl 7y ago
    From the rest of the discussion, it sounds like they're legally required to keep it so they have evidence that all their performers are of-age.
- SAI_Peregrinus 7y ago
  Each person's records could be given an ID (say, a UUID) and stored encrypted in a database. Strong access controls over the decryption keys, etc. Then each video gets metadata with the UUIDs of the people in it. Also it never needs to be updated. Once you've proved you're old enough to legally appear you never need to do so again, at least as long as no time-travel shenanigans are possible.
  - dragonwriter 7y ago
    > Also it never needs to be updated. In US law the records have recency requirements, content-sample requirements for each work the model appears in, and indexing and cross-referencing requirements, and must at the time of each depiction include all names, nicknames, and aliases, the model has ever used in any context (which can expand over time), so, no, it will require updates after being stored.
    - 7y ago
filmgirlcw 7y ago
This is terrible. The sensitive nature of this information could have significantly impact on the victims. This is the type of data, that coupled with the sensitive nature of the sites content, could pose significant safety risks — and I don’t say that lightly. Moreover, the jurisdiction of this place (Andorra), leaves a lot of open questions about what (if any) recourse there could be either from a punitive or criminal standpoint. This is terrible.
taytus 7y ago
>They examine each hole for data being leaked. I bet they did
- dang 7y ago
  Please don't do this here.
sickcodebruh 7y ago
This is another example of why the US urgently needs legislation along the lines of GDPR. I know California’s law took effect on Jan 1. Does anyone know offhand what the penalty would be if this had been a Californian or EU company?
- Nextgrid 7y ago
  The problem is that the site didn't collect the data because they wanted to, they did it because the law requires it. GDPR (and presumably equivalent privacy regulations) explicitly has an exemption for data you are legally required to keep. Regarding fines, they wouldn't undo the damage of the leak either. I don't think this kind of leak can be mitigated with any amount of money, short of giving all the people involved a new identity and forcing them to start a new life somewhere else (and even then, they can still be recognised by their physical appearance).
  - bobbydroptables 7y ago
    I don't follow the distinction you're making about GDPR. I don't think anyone is saying they shouldn't have this information, just that they should make at least some minor modicum of effort to secure it. GDPR doesn't say you don't need to properly secure data even if you're legally required to collect it. GDPR solves this problem as much as any legislation can.
  - dependenttypes 7y ago
    GDPR has a few useful clauses for this case, such as making it mandatory to inform the people whose data was leaked of the leak.
  - watwut 7y ago
    GDPR also requires safe storage.
speech_less 7y ago
"We were able to access Pussycash’s S3 bucket because it was completely unsecured and unencrypted. Using a web browser, the team could access all files hosted on the database." This is absurd
sambe 7y ago
This is terrifying for the models. One of the worst leaks to date, surely?
mv4 7y ago
This is horrible, and very very dangerous for the people involved.
deleted 7y ago
[deleted]
jacquesm 7y ago
Let's hope nobody gets murdered, injured or raped. This is about as bad as it gets.
spamlord 7y ago
Will this leaked data be used by the IRS in the thot audit?
ourcat 7y ago
Alongside the risk of exposing people's private peccadilloes and the danger that presents, there's a huge risk of identity fraud, bank fraud, sim-swapping etc. with all this data. Particularly when it comes to all the copies of Government Photo IDs (Passports, Drivers licence, etc.)
throwawayxxx7 7y ago
See also https://www.stripperweb.com/forum/showthread.php?226796-PussyCash-security-breach https://www.stripperweb.com/forum/showthread.php?226796-Puss... for the reaction of camgirls.
Mountain_Skies 7y ago
The models are all legally adults so why would the producers need their parent's full names?
- Symbiote 7y ago
  They probably aren't needed, but they are present on some forms of identification, like a UK birth certificate.
apta 7y ago
Maybe these women shouldn't be putting up their bodies for sale like that for other men to watch and exploit. Perhaps this is feminism at work.
- dang 7y ago
  "Eschew flamebait. Don't introduce flamewar topics unless you have something genuinely new to say. Avoid unrelated controversies and generic tangents." https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
RedComet 7y ago
I wish people would stop referring to pornography as "adult".
- mprev 7y ago
  Why?
  - RedComet 7y ago
    To be clear, I mean using solely the term "adult". Using the term "adult pornography" is fine. But to answer your question: Because it is destructive and wrong, no matter the age of the viewer. Calling it "adult" not only suggests that it is fine for adults, but entices minors to it under the false impression that they will be more adult by viewing or participating in it.
    - StellarTabi 7y ago
      It is fine for adults. If it weren't for "online adult work" I'd have to degrade myself to being a waitress or working at McDonald's.
irascible 7y ago
Wow talk about free advertising!
navs 7y ago
It's amazing how often you find companies/individuals asking for personal information/documents over email and SMS. I've been on the hunt for a flat for the last few weeks. Being in NZ, I used the TradeMe platform where many of the landlords/listing owners asked for Passport scans, employment letters, bank statements etc via email before evening looking at the property. No mention of how that information will be secured and how it will be discarded. They've likely received hundreds of messages with personal information, all stored in Gmail inboxes. What happens to them after they're sighted - I wouldn't know. I don't know what the 'adult' industry is like but I suspect there's some sites that verify their models by similar email/SMS mediums.
deleted 7y ago
[deleted]

330 points by DemiGuru 7y ago

These include scans of documents that prove the model's age, things like ID cards, birth certificates, and passport scans. Also included were performer release forms and profile information. This is particularly bad given the sensitive nature of the work and the need to maintain the personal privacy and safety of the X-rated web stars. There is also the risk that, as the records from virtually every occupied part of the world, that LGBTQ+ performers in some areas could be at risk of persecution.

nerdponx 7y ago
Persecution is putting it mildly. It could put people at physical risk of harm.
- hprotagonist 7y ago
  s/could/just did Even discarding things like prejudice, cammers have stalker problems fairly regularly as I understand it. When you can get doxxed by a traffic sign reflected in your eyes ... https://www.bbc.com/news/world-asia-50000234 https://www.bbc.com/news/world-asia-50000234
  - celticmusic 7y ago
    jesus h, that's insane.
    - Raphmedia 7y ago
      I can't remember which community this was, but I remember some forum that had a category dedicated to something similar (with consent). People would post pictures of the view from their hotel window when travelling and the other members would compete in being the first to find the exact location. When I say exact, I mean exact. They had to find from which window the picture was taken. It amazed me how some people could figure it out in a few hours and sometimes even less. Only post pictures online if you are alright with being doxxed from them.
      - EForEndeavour 7y ago
        Wow. Bellingcat, but for stalking and sexual assault.
      - rhcom2 7y ago
        I remember 4chan doing something similar with a project Shia Labeouf was doing: https://www.vice.com/en_us/article/d7eddj/4chan-does-first-good-thing-pulls-off-the-heist-of-the-century1 https://www.vice.com/en_us/article/d7eddj/4chan-does-first-g...
      - hprotagonist 7y ago
        https://old.reddit.com/r/FridgeDetective/ https://old.reddit.com/r/FridgeDetective/ is the benign-ish version of this.
- meowfly 7y ago
  I think some commenters might be missing that in many countries like China (where the article shows a passport photo) engaging in pornography is illegal. This leak has the opportunity to ruin lives in many ways.
landcoctos 7y ago
Another reason to never send IDs "required" by many companies today .. using email or their app
- techslave 7y ago
  i always redact the PII part. so for example i cannot sign up at all of the verification required proof of age. because birthdate will be redacted. so far, if the tiny number of places i’ve needed to send a DL or something, no one has complained that it’s pretty much just my name and picture. i imagine the staff checking isn’t paid enough to care.
- cylon13 7y ago
  That's easy for you to say as someone that I'm assuming isn't trying to become a cam model. These people wouldn't have been able to get the job without sending the verifying information, and you don't know their circumstances. Saying "just don't do the thing," without nuance or context is just ignorant.
  - celticmusic 7y ago
    I disagree. People are going to do it, but it needs to be understood that there are major risks with doing it.
    - davidajackson 7y ago
      This last point of 'understanding' is what makes this issue so hard to address for any non-technical userbase. Most people don't even really think about the fact that the "Cloud" is really just someone else's computer. Deloitte did a study recently where they concluded that although privacy is users' #1 concern, most people don't change their behavior. When you combine that with people who don't understand how technology works--but need to get paid--I don't see a good solution where they have any incentive not to take risks. The companies creating these sites don't have an incentive to put up a banner saying "You might not want to sign up for this, we might leak your data." Perhaps some legal disclosure of the risks when providing different levels of PII, just like we have Surgeon General warnings?

rahuldottech 7y ago

Leaked data includes: Full name Birth date Birthplace Citizenship status Nationality Passport/ID number Passport issue & expiration dates Nationally registered gender ID photo Personal signature Parent’s full names Fingerprints Additional country-specific details (e.g. emergency contact information for UK citizens) This is bad. IDs shouldn't be stored on your server once you've confirmed the age/identity/whatever of the user.

celticmusic 7y ago
generally I agree, but I can understand why they did it. If they're accused of allowing underage models they'll be in a spot they definitely don't want to be in. There was a case years ago of a man who was on trial for child porn. It took the actress physically coming into the courtroom and showing her ID before the case was dropped. It's just a really scary place to be in terms of society and the law, so I can understand making the decision to do the 'wrong' thing in this instance.
- pavel_lishin 7y ago
  If you're sufficiently paranoid to want to hold onto this data, it should at least be kept in cold storage. And it's not expensive; I can walk over to Best Buy right now and pick up a hard drive big enough to store this data with cash I happen to have in my wallet.
  - celticmusic 7y ago
    that's a fair point. I'm not saying they didn't make mistakes, just that I understand why they held onto the ID's in this case.
  - miohtama 7y ago
    Also data retention policy: automatically purge old data when it is no longer actively being accessed
    - 7y ago

Nextgrid 7y ago

And this is why I recommend using fake details & IDs when signing up to sensitive services like this. Not an ideal situation and I'm not blaming the victims here, just stating what I would do if I had no choice but to sign up for such a site. Given the life-changing consequences of a leak and the risk of harm (stalkers showing up at home, or being an LGBT performer in a location where the government doesn't approve of that) the consequences of being caught with a fake ID are tame in comparison. Ideally there should be a way for the websites to fulfil their legal obligations regarding age verification without actually handling any ID data themselves. Maybe a government-provided oAuth style service where you are redirected there, authenticate with the government (no extra risk there, they already have the data) and then they return a signed blob to the website asserting that you are of legal age without actually disclosing any details.

falcolas 7y ago
The models can't fake this data - it's required as proof that the filming is consensual, and that they are of a legal age to produce the films.
- Nextgrid 7y ago
  Would an ID with everything redacted but the picture and birthdate pass? It should be sufficient to fulfil the site's legal requirements while mitigating risk of the data leaking - you can't leak what you can't have.
  - drablyechoes 7y ago
    The moral, legal and technical imperative to protect this data is 100% on the company storing this data. Even if the onus of protecting sensitive personal information were passed on to the performers making a living from this site, they would still need to show their full legal name on a redacted ID (which makes finding the address trivial). The owners of this site should be ordered to pay restitution for the damages it has caused to all the performers impacted by this leak. If there are no consequences for things like this, companies will continue to be poor custodians of sensitive data that we entrust to them. The most vulnerable people in society will, as usual, suffer the greatest harm.

Tenoke 7y ago

Predictions, bets and opinions on what punishment will PussyCash/ImLive be facing? A fine proportional to their earnings?

bilekas 7y ago
My prediction, a public statement apologising. With 2-1 odds that it will contain : "We value our clients privacy" mentioned at least twice.
- ryandrake 7y ago
  Guarantee they will also say the phrase “we take security very seriously.”
Nextgrid 7y ago
Absolutely zero, considering their business is already shady as fuck powered by spammers spamming the affiliate links, nasty ads and no doubt lots of dark patterns. If the law cared they would already be in trouble for something else. Besides that, Equifax got away with a slap on the wrist even though it was a highly publicised case. This case will have zero attention outside of HN and the likes so I'd be very surprised if it even makes it to court. There's also the issue that bringing the case to court will attract more attention to the leak and potentially force the plaintiffs to state their real details on the record, so while it's definitely unfair to let the website operators go unpunished, maybe leaving the mess alone and hoping the dust settles is the best course of action.
filmgirlcw 7y ago
Nothing. The jurisdiction this place operates in is fuzzy at best and I feel confident the owners will just abscond and go off to the next place. Plus, the people who are the victims here are not the people who typically have the money to pursue this (and may live in countries where pursuing anything would cause more harm). Marginalized victims, opaque legal jurisdiction/laws, and little/no incentive to go after the owners means that I feel confident absolutely nothing will happen. Think about it: Equifax doxxed more than half the US population and got away with a slap on the wrist and was rewarded with even more government contracts.

makach 7y ago

I feel sorry for the girls. All should stay away from the leaked data Is the website stepping up to take responsibility?

NickBusey 7y ago
And guys. And others.
- deleted 7y ago
  [deleted]
danso 7y ago
FTA: PussyCash never replied to any of our attempts to contact them regarding the data leak, including their Data Protection Officer. ImLive finally responded to one of our emails, stating that they would take care of it and pass on the information to the PussyCash tech team.
dependenttypes 7y ago
> All should stay away from the leaked data Why?
- jacquesm 7y ago
  Because nothing good can come of that.
  - MadWombat 7y ago
    That depends on how you define "good"
    - EForEndeavour 7y ago
      Even if you're trolling, I suppose you're technically correct in that this is "good" for stalker-rapists, and maybe analysts of the cam-modeling industry.

gnrlst 7y ago

What makes it even worse, is that this is an industry where un-sane individuals frequently get obsessed / fall in love / stalk the models in question very frequently due to the context in which they work. This leak is going to be life-ruining (and potentially dangerous) for many of them.

sergiotapia 7y ago
Obsessed simps who donate thousands upon thousands of dollars are very dangerous. Even on Twitch these people are a sight to behold.
- viklove 7y ago
  And yet, camsite models wouldn't be able to sustain themselves without these simps. It's really a two-edged blade.
filmgirlcw 7y ago
Yes. I don’t say this lightly: this is the sort of data that if used the wrong way could wind up with someone being killed. This is a situation where the real-life consequences could literally be death.

droithomme 7y ago

> They boast 66 million registered members on their webcam chat arena, ImLive, alone. Let's say each registered user pays $1 a month for access to this one site they run. That's $66 million/month in revenue. Enough to secure data and comply with privacy laws.

stevewodil 7y ago
Why are you arbitrarily estimating revenue? Also registered users != active/paying users

gok 7y ago

A friend of mine who did a few movies in the 2000s told me she felt much more violated by the paperwork for the required record keeping than she did having sex on camera.

rjkennedy98 7y ago
It’s there for very good reason- to ensure that the models are adults.

Pxtl 7y ago

Given the requirements to keep this data, I'd be curious what data-model would make sense to prevent leaking it. I honestly can't think of anything practical that's better than "encrypt at rest, better hygiene with database credentials". After all, the webserver needs the ability to submit this data, and logically people are going to want to be able to review their own data on the web in order to update it. What do?

jedimastert 7y ago
Most of the information should have never been kept in the first placed. Hell, it never should have touched their servers in the first place
- Pxtl 7y ago
  From the rest of the discussion, it sounds like they're legally required to keep it so they have evidence that all their performers are of-age.
SAI_Peregrinus 7y ago
Each person's records could be given an ID (say, a UUID) and stored encrypted in a database. Strong access controls over the decryption keys, etc. Then each video gets metadata with the UUIDs of the people in it. Also it never needs to be updated. Once you've proved you're old enough to legally appear you never need to do so again, at least as long as no time-travel shenanigans are possible.
- dragonwriter 7y ago
  > Also it never needs to be updated. In US law the records have recency requirements, content-sample requirements for each work the model appears in, and indexing and cross-referencing requirements, and must at the time of each depiction include all names, nicknames, and aliases, the model has ever used in any context (which can expand over time), so, no, it will require updates after being stored.
  - 7y ago

filmgirlcw 7y ago

This is terrible. The sensitive nature of this information could have significantly impact on the victims. This is the type of data, that coupled with the sensitive nature of the sites content, could pose significant safety risks — and I don’t say that lightly. Moreover, the jurisdiction of this place (Andorra), leaves a lot of open questions about what (if any) recourse there could be either from a punitive or criminal standpoint. This is terrible.

taytus 7y ago

>They examine each hole for data being leaked. I bet they did

dang 7y ago
Please don't do this here.

sickcodebruh 7y ago

This is another example of why the US urgently needs legislation along the lines of GDPR. I know California’s law took effect on Jan 1. Does anyone know offhand what the penalty would be if this had been a Californian or EU company?

Nextgrid 7y ago
The problem is that the site didn't collect the data because they wanted to, they did it because the law requires it. GDPR (and presumably equivalent privacy regulations) explicitly has an exemption for data you are legally required to keep. Regarding fines, they wouldn't undo the damage of the leak either. I don't think this kind of leak can be mitigated with any amount of money, short of giving all the people involved a new identity and forcing them to start a new life somewhere else (and even then, they can still be recognised by their physical appearance).
- bobbydroptables 7y ago
  I don't follow the distinction you're making about GDPR. I don't think anyone is saying they shouldn't have this information, just that they should make at least some minor modicum of effort to secure it. GDPR doesn't say you don't need to properly secure data even if you're legally required to collect it. GDPR solves this problem as much as any legislation can.
- dependenttypes 7y ago
  GDPR has a few useful clauses for this case, such as making it mandatory to inform the people whose data was leaked of the leak.
- watwut 7y ago
  GDPR also requires safe storage.

speech_less 7y ago

"We were able to access Pussycash’s S3 bucket because it was completely unsecured and unencrypted. Using a web browser, the team could access all files hosted on the database." This is absurd

sambe 7y ago

This is terrifying for the models. One of the worst leaks to date, surely?

mv4 7y ago

This is horrible, and very very dangerous for the people involved.

deleted 7y ago

[deleted]

jacquesm 7y ago

Let's hope nobody gets murdered, injured or raped. This is about as bad as it gets.

spamlord 7y ago

Will this leaked data be used by the IRS in the thot audit?

ourcat 7y ago

Alongside the risk of exposing people's private peccadilloes and the danger that presents, there's a huge risk of identity fraud, bank fraud, sim-swapping etc. with all this data. Particularly when it comes to all the copies of Government Photo IDs (Passports, Drivers licence, etc.)

throwawayxxx7 7y ago

See also https://www.stripperweb.com/forum/showthread.php?226796-PussyCash-security-breach https://www.stripperweb.com/forum/showthread.php?226796-Puss... for the reaction of camgirls.

Mountain_Skies 7y ago

The models are all legally adults so why would the producers need their parent's full names?

Symbiote 7y ago
They probably aren't needed, but they are present on some forms of identification, like a UK birth certificate.

apta 7y ago

Maybe these women shouldn't be putting up their bodies for sale like that for other men to watch and exploit. Perhaps this is feminism at work.

dang 7y ago
"Eschew flamebait. Don't introduce flamewar topics unless you have something genuinely new to say. Avoid unrelated controversies and generic tangents." https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html

RedComet 7y ago

I wish people would stop referring to pornography as "adult".

mprev 7y ago
Why?
- RedComet 7y ago
  To be clear, I mean using solely the term "adult". Using the term "adult pornography" is fine. But to answer your question: Because it is destructive and wrong, no matter the age of the viewer. Calling it "adult" not only suggests that it is fine for adults, but entices minors to it under the false impression that they will be more adult by viewing or participating in it.
  - StellarTabi 7y ago
    It is fine for adults. If it weren't for "online adult work" I'd have to degrade myself to being a waitress or working at McDonald's.

irascible 7y ago

Wow talk about free advertising!

navs 7y ago

It's amazing how often you find companies/individuals asking for personal information/documents over email and SMS. I've been on the hunt for a flat for the last few weeks. Being in NZ, I used the TradeMe platform where many of the landlords/listing owners asked for Passport scans, employment letters, bank statements etc via email before evening looking at the property. No mention of how that information will be secured and how it will be discarded. They've likely received hundreds of messages with personal information, all stored in Gmail inboxes. What happens to them after they're sighted - I wouldn't know. I don't know what the 'adult' industry is like but I suspect there's some sites that verify their models by similar email/SMS mediums.

deleted 7y ago

[deleted]