8 ms·

Details of some 100M visitors to Thailand exposed online

90 points by prostoalex 5y ago

zachberger 5y ago
Discussed previously here: https://news.ycombinator.com/item?id=28603247 https://news.ycombinator.com/item?id=28603247
distartin 5y ago
Securities is not a priority or even medium priority for most startups and even worse government because in some countries, they are just moving from paper to online
- MattGaiser 5y ago
  Security seems like it needs to be solved at the governmental level with more effective prosecution. I don't imagine that stores would hold up well against physical theft without state protection. Can companies/smaller governments realistically either?
  - systemvoltage 5y ago
    This sounds extremely authoritarian to me. Today, if the state wanted to shutdown the internet backbone, they can by the same means you're alluding to - physical raid at all backbone infrastructure of the internet. That's as much government authority as I am willing to accept.
paulpauper 5y ago
No privacy . think of all the data breaches going back to 2006. linkedin and yahoo for example. At this point you have to just use throwaway emails and pseudonyms wherever possible.
- zaik 5y ago
  Governments generally do not accept pseudonyms.
  - ThalesX 5y ago
    Could institutions realistically accept hash + salt?
xzel 5y ago
I recently had my identity stolen and used for the first time. My data has been leaked so many times who knows where it was taken from (40+ hits on haveibeenpawned). The process of clearing the debt in my name was pretty enlightening. I feel like it’s only going downhill from here.
- bigwavedave 5y ago
  > I recently had my identity stolen and used for the first time. My data has been leaked so many times who knows where it was taken from (40+ hits on haveibeenpawned). The process of clearing the debt in my name was pretty enlightening. I feel like it’s only going downhill from here. I'm sorry, that's a really crappy experience! I hope you can get things cleared up soon. Back before I realized how easy it is for someone to steal my identity or even what any mitigating steps would be, I had an identity theft and fraud that went unnoticed for so long that I had a summary judgment executed against me by the thief's creditors- imagine my surprise when 1/4 of my paycheck suddenly vanished. Unfortunately, there was no recourse for me- I ended up having to pay for the fraud with 1/4 of my paycheck for a little over a year.
  - spaetzleesser 5y ago
    "Unfortunately, there was no recourse for me- I ended up having to pay for the fraud with 1/4 of my paycheck for a little over a year." Really? That seems insane. You didn't do anything wrong. I would think the creditors themselves are responsible since they didn't check who they were dealing with properly.
  - seanmcdirmid 5y ago
    > Unfortunately, there was no recourse for me- I ended up having to pay for the fraud with 1/4 of my paycheck for a little over a year. What country are you in? Or was it just not hiring a lawyer over the debt?
  - hiram112 5y ago
    1/4 of your paycheck for a year was garnished (roughly 25% of your WHOLE salary for the year) and you were not able to resolve the issue, and lost all that money? That is ridiculous. In the US, you'd almost certainly be able to file a lawsuit against the company who leaked the info (if you know... and it wasn't the gov't itself). And 1/4 of my salary would be well worth the legal fees.
silisili 5y ago
This could be worse for marriages than the whole AshleyMadison fiasco. In seriousness, at what point are governments held responsible for their data? If you can't keep it secure, keep it offline!
qwertyuiop_ 5y ago
Blackmail material for CCP in some instances. CCP has one of the worlds largest blackmail database culled from hacked social, dating and other underground sites.
BikiniPrince 5y ago
I had an ex that wanted to actual tourism there. I tried explaining I wasn’t yet retired or single, but she didn’t get it. She ruined a cruise instead.
- pc86 5y ago
  Are you sure it was her?
- wraptile 5y ago
  You're extremely small minded if you think down on Thailand like this. It's an absolutely gorgeous country!
  - silisili 5y ago
    It doesn't matter how one views a country, it's reality. I got downvoted to hell from people who probably never have been. Is it beautiful? Absolutely. Does creepy sex tourism make up a noninsignificant amount of it? Yup. I'd wager more than 10%, based on my travels. Anyone who thinks differently is not in tune with reality.
    - herbst 5y ago
      To be fair I've spent like 4 months in Thailand and sex tourism is focused to just a few small touristic areas. It's barely visibly up in the north, and even Bangkok you only see it if you go near walking street or drive out to Pattaya. In Amsterdam its way more obvious for example, than in most nice touristic islands.
    - wraptile 5y ago
      > Does creepy sex tourism make up a noninsignificant amount of it? Yup nah, I've been in Thailand for almost 5 years and managed to avoid all of it without any extra effort. You need to actively seek out "sex tourist" scene. In fact digital nomad scene is becomming huge here! If anyone needs some Thailand tips my contacts are in my profile :)
hiram112 5y ago
I can't imagine the type of espionage operations the various intelligence agencies can now run against each other. For example, the OPM database hack (by China, allegedly) leaked pretty much every single US citizen who holds a security clearance. A large power like China could simply hack into the travel databases of countries like Thailand, Netherlands, etc. which are known for vices like prostitution and drugs and send themselves notifications when a target enters an area known for "adult fun". Blackmail has always been a tactic used by the clandestine intel services, but I imagine it was very expensive and time consuming to track the marks you're after. But these days you'd be able to do it on a scale orders of magnitudes larger for a few thousands dollars per month in cloud costs, duct taping together some pipeline of the various hacked systems and databases with alerting notifications to your army of part-time "gig operatives" all over the world on your Mechanical Turk payroll, lol
- no_butterscotch 5y ago
  My data was leaked in the OPM hack. I had security clearance at that time. I'm not entirely sure, but there's a part of me that's paranoid about visiting China. I'd like to for tourism reasons. But at the same time, something inside me says "what if?"
  - malwarebytess 5y ago
    What are you afraid of?
    - jdavis703 5y ago
      At least personally I’m worried about being held on totally fictitious charges of espionage or sedition. I worked for a national security agency that they particularly despise. So yeah, I won’t be going there to find if they want to harass me or not. (I also don’t trust my own government to not make up fictitious petty crime charges against me, so maybe I’m paranoid.)
      - no_butterscotch 5y ago
wraptile 5y ago
> including their name, passport number and residency status. is that it?
rkagerer 5y ago
There's so little culpability for leaks like this. The typical "1yr of credit monitoring" corporations spring for is a joke. We need stronger laws around data protection, with real consequences. This sounds extreme but there's a point where I'd be happy to see some areas of government banned from using electronic records. They managed with paper records for decades, and much of the information is "write-once, store forever" anyway.
he0001 5y ago
So how do you find out if your data is in this breach?

90 points by prostoalex 5y ago

Discussed previously here: https://news.ycombinator.com/item?id=28603247 https://news.ycombinator.com/item?id=28603247

Securities is not a priority or even medium priority for most startups and even worse government because in some countries, they are just moving from paper to online

MattGaiser 5y ago
Security seems like it needs to be solved at the governmental level with more effective prosecution. I don't imagine that stores would hold up well against physical theft without state protection. Can companies/smaller governments realistically either?
- systemvoltage 5y ago
  This sounds extremely authoritarian to me. Today, if the state wanted to shutdown the internet backbone, they can by the same means you're alluding to - physical raid at all backbone infrastructure of the internet. That's as much government authority as I am willing to accept.

paulpauper 5y ago

No privacy . think of all the data breaches going back to 2006. linkedin and yahoo for example. At this point you have to just use throwaway emails and pseudonyms wherever possible.

zaik 5y ago
Governments generally do not accept pseudonyms.
- ThalesX 5y ago
  Could institutions realistically accept hash + salt?

xzel 5y ago

I recently had my identity stolen and used for the first time. My data has been leaked so many times who knows where it was taken from (40+ hits on haveibeenpawned). The process of clearing the debt in my name was pretty enlightening. I feel like it’s only going downhill from here.

bigwavedave 5y ago
> I recently had my identity stolen and used for the first time. My data has been leaked so many times who knows where it was taken from (40+ hits on haveibeenpawned). The process of clearing the debt in my name was pretty enlightening. I feel like it’s only going downhill from here. I'm sorry, that's a really crappy experience! I hope you can get things cleared up soon. Back before I realized how easy it is for someone to steal my identity or even what any mitigating steps would be, I had an identity theft and fraud that went unnoticed for so long that I had a summary judgment executed against me by the thief's creditors- imagine my surprise when 1/4 of my paycheck suddenly vanished. Unfortunately, there was no recourse for me- I ended up having to pay for the fraud with 1/4 of my paycheck for a little over a year.
- spaetzleesser 5y ago
  "Unfortunately, there was no recourse for me- I ended up having to pay for the fraud with 1/4 of my paycheck for a little over a year." Really? That seems insane. You didn't do anything wrong. I would think the creditors themselves are responsible since they didn't check who they were dealing with properly.
- seanmcdirmid 5y ago
  > Unfortunately, there was no recourse for me- I ended up having to pay for the fraud with 1/4 of my paycheck for a little over a year. What country are you in? Or was it just not hiring a lawyer over the debt?
- hiram112 5y ago
  1/4 of your paycheck for a year was garnished (roughly 25% of your WHOLE salary for the year) and you were not able to resolve the issue, and lost all that money? That is ridiculous. In the US, you'd almost certainly be able to file a lawsuit against the company who leaked the info (if you know... and it wasn't the gov't itself). And 1/4 of my salary would be well worth the legal fees.

silisili 5y ago

This could be worse for marriages than the whole AshleyMadison fiasco. In seriousness, at what point are governments held responsible for their data? If you can't keep it secure, keep it offline!

qwertyuiop_ 5y ago

Blackmail material for CCP in some instances. CCP has one of the worlds largest blackmail database culled from hacked social, dating and other underground sites.

BikiniPrince 5y ago

I had an ex that wanted to actual tourism there. I tried explaining I wasn’t yet retired or single, but she didn’t get it. She ruined a cruise instead.

pc86 5y ago
Are you sure it was her?
wraptile 5y ago
You're extremely small minded if you think down on Thailand like this. It's an absolutely gorgeous country!
- silisili 5y ago
  It doesn't matter how one views a country, it's reality. I got downvoted to hell from people who probably never have been. Is it beautiful? Absolutely. Does creepy sex tourism make up a noninsignificant amount of it? Yup. I'd wager more than 10%, based on my travels. Anyone who thinks differently is not in tune with reality.
  - herbst 5y ago
    To be fair I've spent like 4 months in Thailand and sex tourism is focused to just a few small touristic areas. It's barely visibly up in the north, and even Bangkok you only see it if you go near walking street or drive out to Pattaya. In Amsterdam its way more obvious for example, than in most nice touristic islands.
  - wraptile 5y ago
    > Does creepy sex tourism make up a noninsignificant amount of it? Yup nah, I've been in Thailand for almost 5 years and managed to avoid all of it without any extra effort. You need to actively seek out "sex tourist" scene. In fact digital nomad scene is becomming huge here! If anyone needs some Thailand tips my contacts are in my profile :)

hiram112 5y ago

I can't imagine the type of espionage operations the various intelligence agencies can now run against each other. For example, the OPM database hack (by China, allegedly) leaked pretty much every single US citizen who holds a security clearance. A large power like China could simply hack into the travel databases of countries like Thailand, Netherlands, etc. which are known for vices like prostitution and drugs and send themselves notifications when a target enters an area known for "adult fun". Blackmail has always been a tactic used by the clandestine intel services, but I imagine it was very expensive and time consuming to track the marks you're after. But these days you'd be able to do it on a scale orders of magnitudes larger for a few thousands dollars per month in cloud costs, duct taping together some pipeline of the various hacked systems and databases with alerting notifications to your army of part-time "gig operatives" all over the world on your Mechanical Turk payroll, lol

no_butterscotch 5y ago
My data was leaked in the OPM hack. I had security clearance at that time. I'm not entirely sure, but there's a part of me that's paranoid about visiting China. I'd like to for tourism reasons. But at the same time, something inside me says "what if?"
- malwarebytess 5y ago
  What are you afraid of?
  - jdavis703 5y ago
    At least personally I’m worried about being held on totally fictitious charges of espionage or sedition. I worked for a national security agency that they particularly despise. So yeah, I won’t be going there to find if they want to harass me or not. (I also don’t trust my own government to not make up fictitious petty crime charges against me, so maybe I’m paranoid.)
    - no_butterscotch 5y ago

wraptile 5y ago

> including their name, passport number and residency status. is that it?

rkagerer 5y ago

There's so little culpability for leaks like this. The typical "1yr of credit monitoring" corporations spring for is a joke. We need stronger laws around data protection, with real consequences. This sounds extreme but there's a point where I'd be happy to see some areas of government banned from using electronic records. They managed with paper records for decades, and much of the information is "write-once, store forever" anyway.

he0001 5y ago

So how do you find out if your data is in this breach?