4 ms·

Credit card numbers are worse than passwords when it comes to toxic data. Why are we, on a daily basis, distributing all the information necessary to fraudulen

Credit card numbers are worse than passwords when it comes to toxic data. Why are we, on a daily basis, distributing all the information necessary to fraudulently impersonate us, and we're all OK with that. Then shrug it off 'oh yea they have my home address, credit card number, name, age, mugshot and email address... but at least they can't hijack my phone number'. Until identity as a concept on the internet catches up with 30 years of cryptography advancements then we're all still stuck in the authentication vs authorization dark ages, the problem is because there's enough critical mass that outside of large enterprise roll-outs it means we're either stuck rubbing two-sticks together caveman style or accepting Apple or Microsoft as our new god (pls upload disk encryption keys to server, and unlock them with your face etc, trust our "secure cloud" while we MITM your login and credentials)

pid-1 4y ago
I mostly use virtual credit cards for websites. My bank allows me to create an unlimited number of them. (Well, there's likely a limit but prob very high)
- FriendlyNormie 4y ago
vba616 4y ago
Because it's so far beyond hopeless, getting into the weeds of how someone is supposedly doing things wrong is irrelevant to normal life. If you're a homeowner, then your name and address are public (at least in the US) despite phone books not being a thing anymore. Consider this: it is established practice to distribute all sorts of information about people that is far more intimate than your home address, if it is only "anonymized" in an accepted manner. HIPAA is no bar to this. But decades ago, a researcher showed that the vast majority of people can be identified through only a few data points, like for example gender, birth date, and zip code. These are available in supposedly non-identifiable data sets. She went on to demonstrate that a US state governor at the time could be linked to his health records, which were public sans name and address. It's about straightforward math - each data point, if more or less randomly distributed, reduces the number of people exponentially, so "anonymizing" people in data sets doesn't work and never did. "Fingerprinting" people based on "anonymized" data is one thing, then there's just the constant total security breaches. My primary care doctor's practice had a massive leak of data because their accountant screwed up. There were no consequences for either entity except for someone having to write an embarrassing letter. There's also the fact that every bit of information the US government had on millions of individuals with a security clearance was compromised by someone hacking into the Office of Personnel Management some years ago. Everything from the intimate details of their lives collected by background investigators, to fingerprints, everything on anybody (it was rumored that the CIA has a separate system, but otherwise everybody - for instance, James Comey mentioned it impacted him) The entire discussion of privacy and security has a "Emperor's New Clothes" aspect to it. Whoever got the OPM information presumably was able to wipe up virtually every covert US agent abroad, and create a file on virtually every cleared person in the US. And maybe they shared it with allies too. Why do you think American politics has gotten so crazy and paranoid in the last few years? Talking about improving security on the internet is like talking about organizing a neighborhood watch in Hiroshima just after it was nuked. It's over! The only thing I can think of is social shunning/shaming of those who don't respect personal privacy voluntarily. Barriers are not impregnable, they are symbolic.
- b112 4y ago
  I think part of this issue is, change. What did it matter, 30 to 50 years ago, if things were public. Public how? Well, sure it was public knowledge about home ownership, but you'd have to fax, or call, to get the info! And a person would have to do the work of a lookup of paper files. And so often there was a minor charge, to pay for that bit of work. Maybe even long distance phone costs(fax), or shipping costs too! So sure, it was public knowledge, but not usable in some sort of mass exploit. And beyond that, people performing mass exploits encountered people at the other end too! So people would notice a change in behaviour, strange things happening en mass. Sure, "a dude" could pull tricks against an account, but hundreds? Millions? No way! So legisltion, and behaviour needs to catch up, and embrace the differences today.
jhugo 4y ago
I've been using a new card number for every service for years now, same as passwords. None have been abused yet but if they do, they can only use them with the merchant they're locked to.

pid-1 4y ago

I mostly use virtual credit cards for websites. My bank allows me to create an unlimited number of them. (Well, there's likely a limit but prob very high)

FriendlyNormie 4y ago

vba616 4y ago

Because it's so far beyond hopeless, getting into the weeds of how someone is supposedly doing things wrong is irrelevant to normal life. If you're a homeowner, then your name and address are public (at least in the US) despite phone books not being a thing anymore. Consider this: it is established practice to distribute all sorts of information about people that is far more intimate than your home address, if it is only "anonymized" in an accepted manner. HIPAA is no bar to this. But decades ago, a researcher showed that the vast majority of people can be identified through only a few data points, like for example gender, birth date, and zip code. These are available in supposedly non-identifiable data sets. She went on to demonstrate that a US state governor at the time could be linked to his health records, which were public sans name and address. It's about straightforward math - each data point, if more or less randomly distributed, reduces the number of people exponentially, so "anonymizing" people in data sets doesn't work and never did. "Fingerprinting" people based on "anonymized" data is one thing, then there's just the constant total security breaches. My primary care doctor's practice had a massive leak of data because their accountant screwed up. There were no consequences for either entity except for someone having to write an embarrassing letter. There's also the fact that every bit of information the US government had on millions of individuals with a security clearance was compromised by someone hacking into the Office of Personnel Management some years ago. Everything from the intimate details of their lives collected by background investigators, to fingerprints, everything on anybody (it was rumored that the CIA has a separate system, but otherwise everybody - for instance, James Comey mentioned it impacted him) The entire discussion of privacy and security has a "Emperor's New Clothes" aspect to it. Whoever got the OPM information presumably was able to wipe up virtually every covert US agent abroad, and create a file on virtually every cleared person in the US. And maybe they shared it with allies too. Why do you think American politics has gotten so crazy and paranoid in the last few years? Talking about improving security on the internet is like talking about organizing a neighborhood watch in Hiroshima just after it was nuked. It's over! The only thing I can think of is social shunning/shaming of those who don't respect personal privacy voluntarily. Barriers are not impregnable, they are symbolic.

b112 4y ago
I think part of this issue is, change. What did it matter, 30 to 50 years ago, if things were public. Public how? Well, sure it was public knowledge about home ownership, but you'd have to fax, or call, to get the info! And a person would have to do the work of a lookup of paper files. And so often there was a minor charge, to pay for that bit of work. Maybe even long distance phone costs(fax), or shipping costs too! So sure, it was public knowledge, but not usable in some sort of mass exploit. And beyond that, people performing mass exploits encountered people at the other end too! So people would notice a change in behaviour, strange things happening en mass. Sure, "a dude" could pull tricks against an account, but hundreds? Millions? No way! So legisltion, and behaviour needs to catch up, and embrace the differences today.

jhugo 4y ago

I've been using a new card number for every service for years now, same as passwords. None have been abused yet but if they do, they can only use them with the merchant they're locked to.