6 ms·
It’s time for attorney generals to hold permanent identity monitoring pots and funds. The idea that someone can lose all your data and then pay for two years o
by basch 3y ago
It’s time for attorney generals to hold permanent identity monitoring pots and funds.
The idea that someone can lose all your data and then pay for two years of identity monitoring is absurd. The people with the data can see that and can just wait two years to sell it. Social security numbers don’t reset after two years.
If you lose data, you pay a data breach tax forever. Over time, your competitors will be able to run with lower margins if they stay secure. As companies die out, the remaining breaches ones are responsible to keep footing the bill.
- stvltvs 3y agoIt should all be free, like getting credit reports is now. We need a robust and accessible way to manage our data personas, assuming that all of the supposed secrets are in fact public data.
- kingforaday 3y agoAs a reminder for any US Citizens, there is an official path to getting this from each of the main three for free[1] is the approved method verified by FTC [2]. 1. https://annualcreditreport.com https://annualcreditreport.com 2. https://consumer.ftc.gov/articles/free-credit-reports https://consumer.ftc.gov/articles/free-credit-reports
- kmoser 3y agoThis still puts the burden on the consumer of having to verify that their credit file is accurate, not to mention the even bigger burden of trying to correct it.
- Rewrap3643 3y agoFurthermore it's a reactive measure. Locking credit reports and unlocking as needed can help mitigate some risks.
- kelseyfrog 3y agoIt also incentivizes holding as little personal data as possible and increases the probability of coordinated adoption of systems[1][2][3][4][5] of identification/verification that minimize collateral damage. 1. https://sovrin.org/ https://sovrin.org/ 2. https://github.com/sertoID/ https://github.com/sertoID/ 3. https://www.hyperledger.org/projects/hyperledger-indy https://www.hyperledger.org/projects/hyperledger-indy 4. https://identity.foundation/ion/ https://identity.foundation/ion/ 5. https://www.civic.com/ https://www.civic.com/
- crotchfire 3y ago> incentivizes holding as little personal data as possible The government does not want to incentivize that. https://en.wikipedia.org/wiki/Third-party_doctrine https://en.wikipedia.org/wiki/Third-party_doctrine
- grotorea 3y agoI get the impression incentivizing holding little personal data is one of the goals of GDPR
- crotchfire 3y agoFair enough, I should have said "The US government does not want..." Mention of attorneys general and social security numbers in OP's posting put me in a US mindset.
- mindslight 3y agoFurther cementing this broken idea of "identity" as something that can be stolen is most certainly not what we need! Rather we need AG's to start going after companies that attempt to collect negligently verified and other fake debts for the outright brazen fraud that it is, and a law that allow victims to procedurally recover triple damages for time/money spent defending against these companies and helping the companies clean up their own messes. Separately, we need a law like the GDPR that lets individuals audit, control, and opt out of the surveillance records being kept on us.
- hypeatei 3y agoExactly. The whole idea that end users are responsible for their stolen "identity" is absurd. It was a successful tactic used by banks and credit bureaus to shed their responsibility of proper verification when opening lines of credit or other accounts.
- jimt1234 3y agoI would go one step further, saying that proper verification is prone to fraud because of failure in government (in the US; not sure about other countries). It still baffles me that identification typically comes down to two things: social security card and driver's license, and both are managed by agencies whose primary objective is not identification. IMHO, it's time for a single agency at either the fed or state level that's in charge of just identification. That's it. Fund that agency and let them do it properly. However, inevitably someone will scream "Big Brother!", and we'll end up back where we started, with this Rube Goldberg system that basically leaves individuals to fend for themselves.
- mindslight 3y agoI'll go yet another step further, and say that the main opposition to having a better technical system of government identification is because we're lacking a comprehensive privacy law akin to the GDPR. As it stands if the government started say issuing smart cards for identify verification, then every business would gradually force their customers to identify themselves, for helping the commercial surveillance industry track everything they do. This is the current dynamic with mobile apps, phone numbers, and existing static identifiers, and it's only held back because one can feign not having them and/or being worried about giving out that info. Whereas with actually secure technicals, that friction basically disappears. And so the only way to prevent this dynamic (and make it so better identification isn't itself a security vulnerability) is by gaining the legal right to inspect/audit/reject the collection, use, and storage of such information in the first place.
- ChrisMarshallNY 3y ago> two years TWO years? I have had my data pwn3d a couple of times. One was six months', the other was one year, and Experian used that as leverage to unendingly nag me to buy into them.
- godelski 3y agoI'm very open to government solutions, but at the same time I'm not sure they have a good track record. Despite that, this service should come from the government because anyone else has misaligned incentives. I specifically would want a privacy and security maximalist approach. What we have right now is completely unacceptable, especially given our current technology level. Though of course, the downside is also that this database becomes a big target (and that's why I want a maximalist approach). I don't know what the solution is, but I'm sure there are security experts here on HN that can lay out better paths and I'm interested in actually hearing what systems I should be advocating for (with more specificity than the generic thing I said). I do think we should also push back against surveillance capitalism. This has been a disaster. Such data breaches are a result of this system (and clearly it isn't even unique to the western world). I think any government has the power to hold these companies accountable in at least some form or another. Big dogs like US, China, and Germany should be leaders, but clearly they aren't as this stuff keeps happening.
- basch 3y agoThe service doesn’t need to come from the government. A marketplace of services of which I can choose my own provider would work.
- lazide 3y agoUntil your average American suffers in some clearly identifiable way - which they currently don’t really - ain’t nothing going to change. And probably not even then.
- akira2501 3y agoThe government is the problem. They issue me a single identification number that can be used anywhere at anytime without any verification or notification that it has been used, and it's next to impossible to get a new one issued. This is madness. A state funded "insurance" system to backstop this mistake is an unworkable hack that seeks to ignore the fundamental problem.
- 3y ago
- tootie 3y agoI think an easier approach would be some sort of mandatory indemnity. Rather than trying to impose specific practices which very well may vary greatly depending on the domain, just levy automatic penalties for breaches and set them high enough to encourage action.
- danesparza 3y agoThis will just make companies more litigious. They'll sue to silence leakers and deny wrongdoing. The leaking will still happen.
- deleted 3y ago[deleted]
- dotancohen 3y ago> It’s time for attorney generals Attorneys general They are attorneys, so that is the word to pluralize. What type of attorney are they? General
- unclenoriega 3y agoThis is an explanation poor of why that's the plural correct. You make it sound like that's grammar normal English.
- fuzztester 3y agoHim forgive, programmer he Forth a is. You thank.
- deleted 3y ago[deleted]
- stilist 3y agoNah, it's just a convention adopted from French after the Norman Conquest.
- queuebert 3y agoI think its monomorphization: Attorneys::<General>().
- herewulf 3y agoWouldn't that be Vector::<Attorney::<General>>() ?
- fuzztester 3y agoSMASH EVERYTHING INTO FLAT ENGLISH, GIVING COBOL! LIST OF GENERAL ATTORNEYS FTW! (SEE HOW EVEN THE ACRONYM AT THE END OF THE SENTENCE FITS INTO COBOL SYNTAX, BEING IN UPPERCASE?) COMPILE IN A FLASH, DEBUG AT LEISURE. AND DON'T FORGET YOUR COBOL PERIODS.
- GoblinSlayer 3y agoOr rather we should double down on aliases: everything must store aliases instead of real data.