3 ms·

> We have no evidence to suggest that your personal information has been misused against you. What a fucking horribly disingenuous statement. They are trying t

> We have no evidence to suggest that your personal information has been misused against you. What a fucking horribly disingenuous statement. They are trying to say that nothing bad happened, but their SSN and information was stolen!! The information is going to be sold and at a later date it could be used. But they're not saying that, they're trying to say "Nothing to see here, your information wasn't misused so don't worry!" I would never trust them after giving this statement.

vineyardmike 3y ago
Not to discount your point- you’re right it’s so disingenuous. BUT we’re quickly approaching a world where every American has been in a leak that affects their data and SSN. Not 100% of course (simply because young people haven’t had a chance to be screwed over) but at some point we should assume that the information is public for a large enough portion of the population and we need to set new expectations.
- deathanatos 3y ago
  > we’re quickly approaching a world where every American has been in a leak that affects their data and SSN. Not 100% of course (simply because young people haven’t had a chance to be screwed over) … that number, presently, has to be a rounding error from being 100%. My SSN was first breached when I was in high school, at least. But yeah, I agree, we should set new expectations. There could definitely be a better system, and I would like to see companies held to account, but material fines against corps are basically unicorns in America.
  - bee_rider 3y ago
    We need a bunch of case law indicating that banks and credit card companies that don’t authenticate past this widely leaked PII are on the hook for the loss of money (rather than the uninvolved third parties who are being impersonated).
    - vineyardmike 3y ago
      This is already the case. You have to prove you weren’t involved (a quick police report will do), but you’re expected to be made right already. Banks have just deemed this current level of fraud acceptable. Currently, if Mallory finds Alice’s SSN and opens a credit line at Lazy Bank Corp, and then runs up a bill in Alice’s name, Alice will be assumed responsible. It’ll affect Alice’s credit score, etc when the banks report these balances. If Alice notices these changes, they can submit a letter to the bank, demanding that the bank remove these reports and close the account (Fair Credit Reporting Act?). The bank can say “but we have the SSN of Alice, so it’s Alice’s” but if Alice can prove they’re not responsible -through lawyers or strongly worded letters or otherwise- (“I don’t and have never lived at the address on file, that IP address originated from Belarus, etc”) then the bank is legally required to remove the association between Alice and that debt. Note that filing a police report is like “auto winning” because it’s a crime to lie to the police. I think the real question is what’s the actual harm on a society level in not validating further? We already have a process to undo the harm on an individual level, but do we need more onerous procedures?
SoftTalker 3y ago
The bigger question for me is, "why is my SSN still such a valuable bit of information" We, the IT industry, have demonstrated repeatedly that we are not smart enough and/or not diligent enough to consistently protect this information. I think we should admit that and try the reverse approach: make knowledge of our PII worthless for committing fraud and theft. We need to fundamentally shift our methods of proving identity to something that doesn't rely on keeping a 9-digit number a secret.
- purpleblue 3y ago
  This is the dangers of a too-powerful bureaucracy. It's obvious that having the SSN as a single point of failure is exceedingly stupid, but our government bureaucrats refuse to do anything about it. You can't even request a new SSN, it's practically impossible to get a new one even if your identity is stolen. The only thing holding us back is red tape, which is the dumbest reason of all.
  - vharuck 3y ago
    It's the danger of using something as a universal password (terrible practice #1) that's often stored in plain text (terrible practice #2). I don't regularly deal much with federal government agencies beyond the IRS. Which ones let you do nefarious things if you only know a person's name, address, and SSN? The IRS doesn't, because they require you to know info from what you filed last year.
  - bee_rider 3y ago
    It probably seemed a lot more reasonable back when most people’s exposure to “password” was “the thing you needed to get into the speakeasy.”
- bee_rider 3y ago
  That’s a bigger questions, and it is a good one, but practically it is not really relevant (other than, I guess, Okta’s vendor has made a small contribution to making it obvious how ill suited these numbers are for authentication).
- 3y ago
mbwgh 3y ago
But this kind of statement is the unfortunate industry standard. A more honest thing to say would be to say "there is no way to prove that your personal information has been or may yet be misused against you, and as such you should take the following steps to minimize risks [...]". But compare how that looks compared against the bigger players which can afford to treat their weekly apocalyptic security incidents like it's just a bad weather phenomenon we just have to accept, apply a patch for and move on.

vineyardmike 3y ago

Not to discount your point- you’re right it’s so disingenuous. BUT we’re quickly approaching a world where every American has been in a leak that affects their data and SSN. Not 100% of course (simply because young people haven’t had a chance to be screwed over) but at some point we should assume that the information is public for a large enough portion of the population and we need to set new expectations.

deathanatos 3y ago
> we’re quickly approaching a world where every American has been in a leak that affects their data and SSN. Not 100% of course (simply because young people haven’t had a chance to be screwed over) … that number, presently, has to be a rounding error from being 100%. My SSN was first breached when I was in high school, at least. But yeah, I agree, we should set new expectations. There could definitely be a better system, and I would like to see companies held to account, but material fines against corps are basically unicorns in America.
- bee_rider 3y ago
  We need a bunch of case law indicating that banks and credit card companies that don’t authenticate past this widely leaked PII are on the hook for the loss of money (rather than the uninvolved third parties who are being impersonated).
  - vineyardmike 3y ago
    This is already the case. You have to prove you weren’t involved (a quick police report will do), but you’re expected to be made right already. Banks have just deemed this current level of fraud acceptable. Currently, if Mallory finds Alice’s SSN and opens a credit line at Lazy Bank Corp, and then runs up a bill in Alice’s name, Alice will be assumed responsible. It’ll affect Alice’s credit score, etc when the banks report these balances. If Alice notices these changes, they can submit a letter to the bank, demanding that the bank remove these reports and close the account (Fair Credit Reporting Act?). The bank can say “but we have the SSN of Alice, so it’s Alice’s” but if Alice can prove they’re not responsible -through lawyers or strongly worded letters or otherwise- (“I don’t and have never lived at the address on file, that IP address originated from Belarus, etc”) then the bank is legally required to remove the association between Alice and that debt. Note that filing a police report is like “auto winning” because it’s a crime to lie to the police. I think the real question is what’s the actual harm on a society level in not validating further? We already have a process to undo the harm on an individual level, but do we need more onerous procedures?

SoftTalker 3y ago

The bigger question for me is, "why is my SSN still such a valuable bit of information" We, the IT industry, have demonstrated repeatedly that we are not smart enough and/or not diligent enough to consistently protect this information. I think we should admit that and try the reverse approach: make knowledge of our PII worthless for committing fraud and theft. We need to fundamentally shift our methods of proving identity to something that doesn't rely on keeping a 9-digit number a secret.

purpleblue 3y ago
This is the dangers of a too-powerful bureaucracy. It's obvious that having the SSN as a single point of failure is exceedingly stupid, but our government bureaucrats refuse to do anything about it. You can't even request a new SSN, it's practically impossible to get a new one even if your identity is stolen. The only thing holding us back is red tape, which is the dumbest reason of all.
- vharuck 3y ago
  It's the danger of using something as a universal password (terrible practice #1) that's often stored in plain text (terrible practice #2). I don't regularly deal much with federal government agencies beyond the IRS. Which ones let you do nefarious things if you only know a person's name, address, and SSN? The IRS doesn't, because they require you to know info from what you filed last year.
- bee_rider 3y ago
  It probably seemed a lot more reasonable back when most people’s exposure to “password” was “the thing you needed to get into the speakeasy.”
bee_rider 3y ago
That’s a bigger questions, and it is a good one, but practically it is not really relevant (other than, I guess, Okta’s vendor has made a small contribution to making it obvious how ill suited these numbers are for authentication).
3y ago

mbwgh 3y ago

But this kind of statement is the unfortunate industry standard. A more honest thing to say would be to say "there is no way to prove that your personal information has been or may yet be misused against you, and as such you should take the following steps to minimize risks [...]". But compare how that looks compared against the bigger players which can afford to treat their weekly apocalyptic security incidents like it's just a bad weather phenomenon we just have to accept, apply a patch for and move on.