4 ms·

0wn3d. Includes security questions and last four of social security for tens of millions. Couldn’t happen to a nicer company either. Boilerplate response fro

0wn3d. Includes security questions and last four of social security for tens of millions. Couldn’t happen to a nicer company either. Boilerplate response from them: https://assets.xfinity.com/assets/dotcom/learn/Notice%20To%20Customers%20of%20Data%20Security%20Incident.pdf?INTCMP=dsi-12152023 https://assets.xfinity.com/assets/dotcom/learn/Notice%20To%2...

tessierashpool 3y ago
it didn't happen to a company at all. it happened to their customers. if the CEO faces criminal or civil penalties, or the company does, then it happens to the company. what makes it worse is Comcat's quasi-monopoly status as a non-optional public utility with, in many areas, no competitors. your only choice is to give away your secrets to a company which will manage them irresponsibly and then act like victims about it.
RajT88 3y ago
"Starting today" - there's no date on that notice. But the URI suggests it was authored on the 15th. Apparently not released for 4 days?
- happytiger 3y ago
  Admitting they suck at security is hard for monopolies. Be sensitive to their feelings man.
- stonepresto 3y ago
  The part of the prompt that suggests its the 15th of December is a GET param, which just means wherever this link was retrieved from is where that date is coming from. The PDF could have been authored at any time. Looks like the created date embedded in the metadata is as follows: 2023-12-18T21:21:19.000Z Created with MS Word. But even that isn't definitive.
  - deleted 3y ago
    [deleted]
crazybLanKeT 3y ago
another reason to never answer those security questions with actual info.
- happytiger 3y ago
  Or put your real birth date.
- AdamJacobMuller 3y ago
  The primary reason being when you have to answer the questions over the phone. "What is your mother's maiden name?" "bidah6shee8Dahkouju" "Wait, what, that is correct how ?" Every time I hear their confusion and shock, I get a bit more depressed that more people aren't doing this.
  - tzs 3y ago
    Most people want to minimize the time it takes to resolve whatever issue has led to them being on the phone with support. Giving "bidah6shee8Dahkouju" as your mother's maiden name does not help achieve that. Using a different made up mother's maiden name at each site is a good idea, but you can use short names that are easy to pronounce and spell for that to get the security benefits without drawing out the time you have to spend with support.
  - amlozano 3y ago
    Protip, use something like a https://diceware.rempe.us/#eff https://diceware.rempe.us/#eff password with 6 words. They never seem to mind when you just say "litmus secrecy ruckus nest reason send", they don't even skip a beat.
    - mdaniel 3y ago
      I enjoy pointing out that 1Password has a dedicated section for generating "security answers" using this same method (they allow "horse battery staple" style with variable number of words, although a minimum of 3) https://support.1password.com/generate-security-questions/ https://support.1password.com/generate-security-questions/ Like all good Bitwarden things, feel free to spit^W vote for a similar feature request https://community.bitwarden.com/t/security-questions-track-autofill-like-a-password/14353 https://community.bitwarden.com/t/security-questions-track-a...

tessierashpool 3y ago

it didn't happen to a company at all. it happened to their customers. if the CEO faces criminal or civil penalties, or the company does, then it happens to the company. what makes it worse is Comcat's quasi-monopoly status as a non-optional public utility with, in many areas, no competitors. your only choice is to give away your secrets to a company which will manage them irresponsibly and then act like victims about it.

RajT88 3y ago

"Starting today" - there's no date on that notice. But the URI suggests it was authored on the 15th. Apparently not released for 4 days?

happytiger 3y ago
Admitting they suck at security is hard for monopolies. Be sensitive to their feelings man.
stonepresto 3y ago
The part of the prompt that suggests its the 15th of December is a GET param, which just means wherever this link was retrieved from is where that date is coming from. The PDF could have been authored at any time. Looks like the created date embedded in the metadata is as follows: 2023-12-18T21:21:19.000Z Created with MS Word. But even that isn't definitive.
- deleted 3y ago
  [deleted]

crazybLanKeT 3y ago

another reason to never answer those security questions with actual info.

happytiger 3y ago
Or put your real birth date.
AdamJacobMuller 3y ago
The primary reason being when you have to answer the questions over the phone. "What is your mother's maiden name?" "bidah6shee8Dahkouju" "Wait, what, that is correct how ?" Every time I hear their confusion and shock, I get a bit more depressed that more people aren't doing this.
- tzs 3y ago
  Most people want to minimize the time it takes to resolve whatever issue has led to them being on the phone with support. Giving "bidah6shee8Dahkouju" as your mother's maiden name does not help achieve that. Using a different made up mother's maiden name at each site is a good idea, but you can use short names that are easy to pronounce and spell for that to get the security benefits without drawing out the time you have to spend with support.
- amlozano 3y ago
  Protip, use something like a https://diceware.rempe.us/#eff https://diceware.rempe.us/#eff password with 6 words. They never seem to mind when you just say "litmus secrecy ruckus nest reason send", they don't even skip a beat.
  - mdaniel 3y ago
    I enjoy pointing out that 1Password has a dedicated section for generating "security answers" using this same method (they allow "horse battery staple" style with variable number of words, although a minimum of 3) https://support.1password.com/generate-security-questions/ https://support.1password.com/generate-security-questions/ Like all good Bitwarden things, feel free to spit^W vote for a similar feature request https://community.bitwarden.com/t/security-questions-track-autofill-like-a-password/14353 https://community.bitwarden.com/t/security-questions-track-a...