8 ms·

What do we do now? It seems the majority of people on the planet now have had some of their data leaked. Or are becoming ever more entangled with government an

What do we do now? It seems the majority of people on the planet now have had some of their data leaked. Or are becoming ever more entangled with government and corporate systems which control and peddle their information as they see fit. Is it ultimately a big nothing burger, or is this some singularity we are passing through?

pyinstallwoes 4y ago
In history what have databases of people and state actor interests usually led to if any events are similar?
- mvdwoord 4y ago
  I would say, impossible to compare. Digital changes the cost of acting upon this information, for good or bad purposes. Obvious comparisons to e.g. the Netherlands' famous over-registering of religion and how the Nazis abused that. But I feel this is long term potentially worse than that. Not in the level of horribleness, but in the effect on society moving forward.
  - pyinstallwoes 4y ago
    Can you extrapolate that on what the effect on society looks like in your assessment?
- MadsRC 4y ago
  IIRC when Nazi Germany invaded Denmark in 1940, one of the first things the SS did was to send representatives to the local churches. In Denmark, every child was (I’m not sure if they still are actually?) registered at birth by the local parish in so called “church books”. With these “databases” in hand, the SS had a neat list of all names, and the approximate location of peoples homes. Those lists were used to identify and prosecute jews.
  - t_mann 4y ago
    Church books were used to find Jews? Do you have a source for that?
    - meepmorp 4y ago
      > Church books were used to find Jews? If you know who to rule out, you have a smaller pool of people to go after.
    - samus 4y ago
      Antisemitism was not really about religion. Many Jews had actually converted to Christianity for generations. The Nazis still considered them to be Jews.
      - daniel-cussen 4y ago
        Ahh...well there is the famous saying, "I decide who is a Jew." It was used on the head of the German Manhattan Project and a Jewish head (like a headmaster some shit) of a concentration camp, forget which one. And that's why we say "German Manhattan Project" stedda "Americaner Atomwaffenunternehmen" (I made that word up, it is correct in German to make words up, that means atom weapon undertaking), because German antisemitism amounted to forfeiting the bomb. That was the price, the defeat of their last hope against the Allies. All of the Great Jews that slapped those firecrackers together were exiled due to antisemitism: Fermi, Szílard, Einstein (to get the president to read the letter to get the Los Alamos show on the road in the first place, get Roosevelt to read top to bottom left to right, no easy task), von Neumann (spesh because of his schizophrenia, no concentration camp for him, he would have been experimented on to then do that same sin to everybody in the camps, Schizophrenic Jews were at the absolute bottom o the Nazi world order). I just posted about this. https://news.ycombinator.com/item?id=31990431 https://news.ycombinator.com/item?id=31990431 Fermi was originally a fascist, it basically made sense to him as a way of organizing a country. Only non-Jew in the top desks of Los Alamos. Why? Only when the racial laws against his Jewish wife and children did he pack his shit and leave for America. And Fermi was packing heat.
- shapefrog 4y ago
  Spam and phishing calls.
- googlryas 4y ago
  Not quite the same, but the US used census records that were supposed to be protected to round up the west coast japanese for their internment during WWII.
  - AnimalMuppet 4y ago
    They were "protected". That is, they didn't leak out of the government into private hands. But that still turned out pretty badly. In fact, information in the government's hands is the most dangerous, because they have more power than anyone else to use it against you. (On the other hand, as others have said about Denmark and Netherlands, data that was not in government hands became in government hands, and was used against people. So it's not "safer" if it's in private hands, except to the degree that the government has to go through the extra step of getting it.)
boomskats 4y ago
It is both. It is huge, I'd say it's absolutely the latter. but I can't think of a single thing anyone can do about any of it at this point, which also makes it the former.
- derwiki 4y ago
  One thing I’ve thought about doing is using CCPA to have companies delete all my data, hopefully before it leaks.
  - ev1 4y ago
    At several places I've seen they keep certain data such as phone, address, etc as a bullshit "business need" to "prevent abuse" and "prevent promo reuse" and keep forever even through CCPA. Also they keep the record of the delete request, which contains the PII you ask to remove.
thriftwy 4y ago
A lot of data may be made public to equalize, similarly to how real estate property rights or car registries may be public.
- mvdwoord 4y ago
  I would counter that, although it could, some groups will be able to evade it, effectively maintaining their advantage/power. Effectively averaging out the position of middle and lower classes, and lowering their chances of moving up the social ladder?
  - thriftwy 4y ago
    I'm not sure it would give such a large advantage compared to the cost of hiding
gfd 4y ago
The previous big case I remember was linkedin leak with 700M users: https://news.ycombinator.com/item?id=27674393 https://news.ycombinator.com/item?id=27674393 At this point I've basically accepted that all my info will be found on sites like fastpeoplesearch.com and that anything I tell any company (or I guess in this case, govt too) will eventually be leaked, correlated, and used against me.
- ge96 4y ago
  Wow that's bigger than Equifax
  - AnimalMuppet 4y ago
    LinkedIn doesn't have my Social Security number. It doesn't have a list of my bank accounts and credit cards. So, more people, but less damaging information.
    - ge96 4y ago
      Yeah, that's like a "how do I top that?" situation (Equifax)
    - jazzyjackson 4y ago
      the data sets are more valuable when they're concentrated, so the leak of your address, voter registration, and SSN is now tied to your employment history and education
  - hackernewds 4y ago
    Another nothingburger since these companies still exist. and profitably
  - scandinavian 4y ago
    The linkedin "leak" was just a scrape of public data.
    - 4y ago
gonzo41 4y ago
Covid is a good excuse to wear a mask, and pair it with a set of mirror sun glasses in public. Maybe that's how we live now.
- thomassmith65 4y ago
  We should probably consider a person's voice-print, too. To be safe, you need a mask with a real-time voice changer.
  - edmcnulty101 4y ago
    And gait. Everyone walks a specific way and a person can be identified by their gait. So have to change up the walk.
    - fragmede 4y ago
      In order for that to work, we’d need a ministry that catalogs ridiculous outliers of gait patterns.
      - edmcnulty101 4y ago
        Definitely need research into outlier gaits. I imagine we would need a clinic to research arguments that one can pay to have an argument with a clinician.
stjohnswarts 4y ago
All you can do (in the USA) is freeze your credit and sign up for one of the free (or paid) credit monitoring services. That only protects you from financial ruin though. Not sure about people using your credentials to commit fraud, fake birth certificates, etc.
carapace 4y ago
> What do we do now? Well, if you look at (global) society as a dynamical system it seems to me that there are two stable basins or attractors, call them "Star Trek" and "North Korea". In the "Star Trek" future the people in charge are themselves also subject to the panopticon, and the world is ruled fairly and humanely. (The other name I use for this is the "Tyranny of Mrs. Grundy".) In the "North Korea" future there are (human or AI or hybrid) masters and brain-chipped cyborg slaves, and rule is absolute and enforced with digital precision. (Of course, this is all predicated on the idea that we can't put the genie back in the bottle in re: ubiquitous surveillance. I think that's likely the case (although I do not like it) but I'm not going to make the argument here unless someone asks.) Given the above the thing to do is work to make politicians subject to 24/7 total surveillance (ASAP, before everybody else) so we can keep an eye on them. This policy would also presumably weed out the crazies and corrupt, eh?
- lagrange77 4y ago
  > Well, if you look at (global) society as a dynamical system it seems to me that there are two stable basins or attractors, call them "Star Trek" and "North Korea". Nice analogy. Do you really believe, that us being on an utopian trajectory is realistic?
  - carapace 4y ago
    > Do you really believe, that us being on an utopian trajectory is realistic? Oh yes. Very much so. In fact, by many measures we have been on an utopian trajectory for several centuries. Today even our failures are the result of unimaginable power. We have to learn to wield our power with wisdom. We have all of the physical technology we need already. We can practice regenerative agriculture that increases topsoil fertility and volume; we have methods of construction that can build housing for everyone; machines and factories that churn out the physical necessities of life; etc. We need only deploy our resources and technology efficiently. It's down to logistics now, and we have more than enough computer power to sort that out. The only thing holding us back is that most people still don't realize this yet. https://en.wikipedia.org/wiki/Design_science_revolution https://en.wikipedia.org/wiki/Design_science_revolution It's taking longer than anticipated but the process never stopped. Reading this now you are a part of it, if you want to be.
swader999 4y ago
I just change my name every few years. Makes the job hunt difficult but I like a challenge.
cm2012 4y ago
Well, leak can mean a lot of things. The standard "leak" of names and addresses of people is totally meaningless, though HN "privacy" obsessives blow it out of the water all the time. It's basically public information, we used to have everyone in phone books in the US and almost no one cared. Cell phone number is a riskier one because of the opportunity for 2FA hacks. It's not hard to get people's cell phone numbers as it is (you can buy direct marketing lists for pennies per person in the US) but its not good to make it easy for hackers. However this leak in particular appears to go much deeper so it is insidious. Police records are named and who knows what else. That is a genuine privacy issue and sucks for those involved.
- maxbond 4y ago
  Names and addresses can absolutely be used to stalk and harass people, and there are password reset flows that involve physically mailing secrets to people. Perhaps almost no one cared about phone books, but if you thought about the differences between phone books and a website for a moment, you'd see that these are different technologies that have different implications, and that it is entirely reasonable for people to have a different reaction. You've chosen some arbitrary amount of information where you begin to care and become interested, and decided everyone with a different cutoff is an absolutist you don't need to listen to. But it's really just that your situation permits you to leak that information without fear, and you haven't deigned to imagine that other people are in a different situation. I'd encourage you to rethink this perspective.
  - charcircuit 4y ago
    Names and addresses are already public information in the US. It's not that big of a deal.
nonrandomstring 4y ago
> What do we do now? I was thinking - if I had this, what could I do with the personal records of a billion Chinese people? And I must conclude - absolutely nothing. It's of no interest to me. Now, I probably lack sufficient criminal imagination, but the point is stuff like this is hard to fence because there's a very small market of buyers. In an article I wrote for Routledge about the markets for stolen digital data (specifically movie and album releases) I suggested that the underlying problem is there's symbiosis between leakers and buyers. If you want to do anything, target the buyers. There's less of them. Don't try to secure inherently insecure massively centralised systems (Blotto + Dolev Yeo problem) . Or chase leakers. Or blame users. Or fire the CIO. Find out who wants this stuff and take down the show from the demand-side. But hold on! Guess who the buyers are. And guess what sincere will exists within "law enforcement" to tackle this sort of "cybercrime".
- rz2k 4y ago
  I suppose you could go the other direction. You could be an international human rights organization, and treat the database like a billion claim checks. Having a definitive record of people's existence would make it more difficult for the authorities to skimp on natural disaster rescue efforts then lie about casualty numbers, treat citizens as canon fodder for military purposes, or simply wipe out individuals who have grievances with the government or powerful functionaries.
- dc-programmer 4y ago
  This type of information is used all of the time to discover and compromise web accounts of the victims in bulk. There are scripts that take in this data as input and will do a lot of the work for you to take over their accounts (or at least find their active accounts across web). Any additional data you are able to trawl can be sold itself, leaving the next steps to more advanced or motivated threat actors. It’s also useful for more targeted social engineering attacks.
- vbezhenar 4y ago
  After my data was leaked, now scammers periodically call my phone to let me know that "I'm from bank security and someone's recently tried to change phone number for your bank account" or "I'm from police and we're opening a criminal case against you". It was fun first few times, but now I'm considering changing my phone number because I could miss an actual bank security call. And I'm sure that plenty of gullible people were scammed and lost their money because of those leaks. When someone calls you, knows your full name and talks with enough confidence, it causes some trust.
rlt 4y ago
> What do we do now? Stop using personal information for authentication and end the concept of “identity theft”, for starters (not sure how it works in China specifically). Include online safety and anti-scam curriculum in lower education.

pyinstallwoes 4y ago

In history what have databases of people and state actor interests usually led to if any events are similar?

mvdwoord 4y ago
I would say, impossible to compare. Digital changes the cost of acting upon this information, for good or bad purposes. Obvious comparisons to e.g. the Netherlands' famous over-registering of religion and how the Nazis abused that. But I feel this is long term potentially worse than that. Not in the level of horribleness, but in the effect on society moving forward.
- pyinstallwoes 4y ago
  Can you extrapolate that on what the effect on society looks like in your assessment?
MadsRC 4y ago
IIRC when Nazi Germany invaded Denmark in 1940, one of the first things the SS did was to send representatives to the local churches. In Denmark, every child was (I’m not sure if they still are actually?) registered at birth by the local parish in so called “church books”. With these “databases” in hand, the SS had a neat list of all names, and the approximate location of peoples homes. Those lists were used to identify and prosecute jews.
- t_mann 4y ago
  Church books were used to find Jews? Do you have a source for that?
  - meepmorp 4y ago
    > Church books were used to find Jews? If you know who to rule out, you have a smaller pool of people to go after.
  - samus 4y ago
    Antisemitism was not really about religion. Many Jews had actually converted to Christianity for generations. The Nazis still considered them to be Jews.
    - daniel-cussen 4y ago
      Ahh...well there is the famous saying, "I decide who is a Jew." It was used on the head of the German Manhattan Project and a Jewish head (like a headmaster some shit) of a concentration camp, forget which one. And that's why we say "German Manhattan Project" stedda "Americaner Atomwaffenunternehmen" (I made that word up, it is correct in German to make words up, that means atom weapon undertaking), because German antisemitism amounted to forfeiting the bomb. That was the price, the defeat of their last hope against the Allies. All of the Great Jews that slapped those firecrackers together were exiled due to antisemitism: Fermi, Szílard, Einstein (to get the president to read the letter to get the Los Alamos show on the road in the first place, get Roosevelt to read top to bottom left to right, no easy task), von Neumann (spesh because of his schizophrenia, no concentration camp for him, he would have been experimented on to then do that same sin to everybody in the camps, Schizophrenic Jews were at the absolute bottom o the Nazi world order). I just posted about this. https://news.ycombinator.com/item?id=31990431 https://news.ycombinator.com/item?id=31990431 Fermi was originally a fascist, it basically made sense to him as a way of organizing a country. Only non-Jew in the top desks of Los Alamos. Why? Only when the racial laws against his Jewish wife and children did he pack his shit and leave for America. And Fermi was packing heat.
shapefrog 4y ago
Spam and phishing calls.
googlryas 4y ago
Not quite the same, but the US used census records that were supposed to be protected to round up the west coast japanese for their internment during WWII.
- AnimalMuppet 4y ago
  They were "protected". That is, they didn't leak out of the government into private hands. But that still turned out pretty badly. In fact, information in the government's hands is the most dangerous, because they have more power than anyone else to use it against you. (On the other hand, as others have said about Denmark and Netherlands, data that was not in government hands became in government hands, and was used against people. So it's not "safer" if it's in private hands, except to the degree that the government has to go through the extra step of getting it.)

boomskats 4y ago

It is both. It is huge, I'd say it's absolutely the latter. but I can't think of a single thing anyone can do about any of it at this point, which also makes it the former.

derwiki 4y ago
One thing I’ve thought about doing is using CCPA to have companies delete all my data, hopefully before it leaks.
- ev1 4y ago
  At several places I've seen they keep certain data such as phone, address, etc as a bullshit "business need" to "prevent abuse" and "prevent promo reuse" and keep forever even through CCPA. Also they keep the record of the delete request, which contains the PII you ask to remove.

thriftwy 4y ago

A lot of data may be made public to equalize, similarly to how real estate property rights or car registries may be public.

mvdwoord 4y ago
I would counter that, although it could, some groups will be able to evade it, effectively maintaining their advantage/power. Effectively averaging out the position of middle and lower classes, and lowering their chances of moving up the social ladder?
- thriftwy 4y ago
  I'm not sure it would give such a large advantage compared to the cost of hiding

gfd 4y ago

The previous big case I remember was linkedin leak with 700M users: https://news.ycombinator.com/item?id=27674393 https://news.ycombinator.com/item?id=27674393 At this point I've basically accepted that all my info will be found on sites like fastpeoplesearch.com and that anything I tell any company (or I guess in this case, govt too) will eventually be leaked, correlated, and used against me.

ge96 4y ago
Wow that's bigger than Equifax
- AnimalMuppet 4y ago
  LinkedIn doesn't have my Social Security number. It doesn't have a list of my bank accounts and credit cards. So, more people, but less damaging information.
  - ge96 4y ago
    Yeah, that's like a "how do I top that?" situation (Equifax)
  - jazzyjackson 4y ago
    the data sets are more valuable when they're concentrated, so the leak of your address, voter registration, and SSN is now tied to your employment history and education
- hackernewds 4y ago
  Another nothingburger since these companies still exist. and profitably
- scandinavian 4y ago
  The linkedin "leak" was just a scrape of public data.
  - 4y ago

gonzo41 4y ago

Covid is a good excuse to wear a mask, and pair it with a set of mirror sun glasses in public. Maybe that's how we live now.

thomassmith65 4y ago
We should probably consider a person's voice-print, too. To be safe, you need a mask with a real-time voice changer.
- edmcnulty101 4y ago
  And gait. Everyone walks a specific way and a person can be identified by their gait. So have to change up the walk.
  - fragmede 4y ago
    In order for that to work, we’d need a ministry that catalogs ridiculous outliers of gait patterns.
    - edmcnulty101 4y ago
      Definitely need research into outlier gaits. I imagine we would need a clinic to research arguments that one can pay to have an argument with a clinician.

stjohnswarts 4y ago

All you can do (in the USA) is freeze your credit and sign up for one of the free (or paid) credit monitoring services. That only protects you from financial ruin though. Not sure about people using your credentials to commit fraud, fake birth certificates, etc.

carapace 4y ago

> What do we do now? Well, if you look at (global) society as a dynamical system it seems to me that there are two stable basins or attractors, call them "Star Trek" and "North Korea". In the "Star Trek" future the people in charge are themselves also subject to the panopticon, and the world is ruled fairly and humanely. (The other name I use for this is the "Tyranny of Mrs. Grundy".) In the "North Korea" future there are (human or AI or hybrid) masters and brain-chipped cyborg slaves, and rule is absolute and enforced with digital precision. (Of course, this is all predicated on the idea that we can't put the genie back in the bottle in re: ubiquitous surveillance. I think that's likely the case (although I do not like it) but I'm not going to make the argument here unless someone asks.) Given the above the thing to do is work to make politicians subject to 24/7 total surveillance (ASAP, before everybody else) so we can keep an eye on them. This policy would also presumably weed out the crazies and corrupt, eh?

lagrange77 4y ago
> Well, if you look at (global) society as a dynamical system it seems to me that there are two stable basins or attractors, call them "Star Trek" and "North Korea". Nice analogy. Do you really believe, that us being on an utopian trajectory is realistic?
- carapace 4y ago
  > Do you really believe, that us being on an utopian trajectory is realistic? Oh yes. Very much so. In fact, by many measures we have been on an utopian trajectory for several centuries. Today even our failures are the result of unimaginable power. We have to learn to wield our power with wisdom. We have all of the physical technology we need already. We can practice regenerative agriculture that increases topsoil fertility and volume; we have methods of construction that can build housing for everyone; machines and factories that churn out the physical necessities of life; etc. We need only deploy our resources and technology efficiently. It's down to logistics now, and we have more than enough computer power to sort that out. The only thing holding us back is that most people still don't realize this yet. https://en.wikipedia.org/wiki/Design_science_revolution https://en.wikipedia.org/wiki/Design_science_revolution It's taking longer than anticipated but the process never stopped. Reading this now you are a part of it, if you want to be.

swader999 4y ago

I just change my name every few years. Makes the job hunt difficult but I like a challenge.

cm2012 4y ago

Well, leak can mean a lot of things. The standard "leak" of names and addresses of people is totally meaningless, though HN "privacy" obsessives blow it out of the water all the time. It's basically public information, we used to have everyone in phone books in the US and almost no one cared. Cell phone number is a riskier one because of the opportunity for 2FA hacks. It's not hard to get people's cell phone numbers as it is (you can buy direct marketing lists for pennies per person in the US) but its not good to make it easy for hackers. However this leak in particular appears to go much deeper so it is insidious. Police records are named and who knows what else. That is a genuine privacy issue and sucks for those involved.

maxbond 4y ago
Names and addresses can absolutely be used to stalk and harass people, and there are password reset flows that involve physically mailing secrets to people. Perhaps almost no one cared about phone books, but if you thought about the differences between phone books and a website for a moment, you'd see that these are different technologies that have different implications, and that it is entirely reasonable for people to have a different reaction. You've chosen some arbitrary amount of information where you begin to care and become interested, and decided everyone with a different cutoff is an absolutist you don't need to listen to. But it's really just that your situation permits you to leak that information without fear, and you haven't deigned to imagine that other people are in a different situation. I'd encourage you to rethink this perspective.
- charcircuit 4y ago
  Names and addresses are already public information in the US. It's not that big of a deal.

nonrandomstring 4y ago

> What do we do now? I was thinking - if I had this, what could I do with the personal records of a billion Chinese people? And I must conclude - absolutely nothing. It's of no interest to me. Now, I probably lack sufficient criminal imagination, but the point is stuff like this is hard to fence because there's a very small market of buyers. In an article I wrote for Routledge about the markets for stolen digital data (specifically movie and album releases) I suggested that the underlying problem is there's symbiosis between leakers and buyers. If you want to do anything, target the buyers. There's less of them. Don't try to secure inherently insecure massively centralised systems (Blotto + Dolev Yeo problem) . Or chase leakers. Or blame users. Or fire the CIO. Find out who wants this stuff and take down the show from the demand-side. But hold on! Guess who the buyers are. And guess what sincere will exists within "law enforcement" to tackle this sort of "cybercrime".

rz2k 4y ago
I suppose you could go the other direction. You could be an international human rights organization, and treat the database like a billion claim checks. Having a definitive record of people's existence would make it more difficult for the authorities to skimp on natural disaster rescue efforts then lie about casualty numbers, treat citizens as canon fodder for military purposes, or simply wipe out individuals who have grievances with the government or powerful functionaries.
dc-programmer 4y ago
This type of information is used all of the time to discover and compromise web accounts of the victims in bulk. There are scripts that take in this data as input and will do a lot of the work for you to take over their accounts (or at least find their active accounts across web). Any additional data you are able to trawl can be sold itself, leaving the next steps to more advanced or motivated threat actors. It’s also useful for more targeted social engineering attacks.
vbezhenar 4y ago
After my data was leaked, now scammers periodically call my phone to let me know that "I'm from bank security and someone's recently tried to change phone number for your bank account" or "I'm from police and we're opening a criminal case against you". It was fun first few times, but now I'm considering changing my phone number because I could miss an actual bank security call. And I'm sure that plenty of gullible people were scammed and lost their money because of those leaks. When someone calls you, knows your full name and talks with enough confidence, it causes some trust.

rlt 4y ago

> What do we do now? Stop using personal information for authentication and end the concept of “identity theft”, for starters (not sure how it works in China specifically). Include online safety and anti-scam curriculum in lower education.