6 ms·

Information Security: "We Can Do It, We Just Choose Not To"

88 points by bo0tzz 2y ago

myspy 2y ago
Apart from outsourcing credit card data, what else could be different when that data is more secured than the more important personal data?
- nonrandomstring 2y ago
  Not having the data at all. It's almost impossible for those of us who've grown up in the last 40 years of commercial computing to imagine. But it's possible to radically decouple identity from function.
  - nutrie 2y ago
    Precisely. Tell it to the marketing director, you can watch him go hairless in real time.
    - nonrandomstring 2y ago
      And there you have it. The "technology industry" hasn't had anything to do with computer scientists, engineers or technology people in about 20 years. It's run entirely by marketing people. They just keep the eggheads around as pets.
      - bayindirh 2y ago
        Technology is always developed to earn more monies. Progress is just a side-effect of monetary greed. It's said thrice, but when you remove the monetary greed, you have Mullvad VPN. P.S.: Yes, I say monies specifically, because the people who use "monies" as job parlance has the most monetary greed from my experience.
  - roenxi 2y ago
    I'd imagine there is quite a lot of legal pressure against doing that. Not knowing who your customers are seems like the sort of thing that would eventually involve lawyers. mullvad.net was interesting to me because I could pay with Monero, meaning that they may actually have no data about me whatsoever except whatever is technically required for a VPN connection. Pretty cool company but it seems like the sort of model that would struggle in most countries with the amount of financial monitoring that tends to be in place.
    - nutrie 2y ago
      You're taking it too far. KYC concerns legal entities, that's a different story. In regards to individuals and their privacy, there are ways to greatly minimize personal information processing in "plain" form while keeping records (or access to records) to fulfill legal obligations. Having had conversations with people on security and anti-fraud teams, many experts clearly share this view.
    - kloop 2y ago
      Could still be done by re-incorporating companies in countries without kyc laws. And if fines for being breached get high enough, that's probably what would happen. That would probably be bad for tax receipts though, so it's more realistic that there's an upper bound on infosec related fines
  - benoliver999 2y ago
    Mullvad VPN does this. No email. No password. Just an account number. If you want to to send them an envelope full of cash, you can.
thriftwy 2y ago
The embarrassing truth is that we can't do it. Humans are very bad at security.
- nicce 2y ago
  We can at least be very good at it, if we accept the UX cost.
  - valenterry 2y ago
    The UX cost and the other opportunity cost, yeah.
- tedk-42 2y ago
  A counter point being, most people assume other people can be trusted. It's a small percentage of people hacking (in a malicious way) but the reach of the internet means we're all vulnerable.
- fsflover 2y ago
  We can do it, see https://qubes-os.org https://qubes-os.org
- acdha 2y ago
  Suppose that the laws were changed so that breaching personal data meant the CEO had to personally visit each affected customer and apologize face to face. Would it really be the case that “we can’t do it” because everyone is being popped by elite Chinese military operations, or would it instead magically turn out that companies could cut into the executive bonus fund by 10% to resolve understaffing for boring O&M work, and maybe reconsider collecting so much data in the first place? As the post notes, breaches of the data where they have real penalties are much rarer.
- nonrandomstring 2y ago
  > Humans are very bad at security. Security for who. from whom and to what end? I think many humans are bad at it. A smaller group, may be 10 percent, have the "security mindset". For the ninety percent who use technology or run businesses it's a schlep and imposition. They just want to forget about it. And there are many psychological and cultural devices to help them ignore security. Around 8 of remaining 10 percent are on what I see as the "dark side". They are guards for the castles, and primarily concerned with _helping_ technological abusers take advantage of the majority's weakness.
9dev 2y ago
The GDPR may be a pain in the ass to properly implement, and certain parts of it are a bureaucrats wet dream, but it sets the right incentives. If you read the general rules, it’s just common sense: Only keep what you need, take as many steps to secure data as you can, tell users proactively what you like to do with it, ask for their consent, and delete whenever they request it. It all sounds like lots of additional IT work, and it is (I spend a lot of time in our company to try and improve). But it only seems like a hassle because we went for so long without doing it right. There must be a way to let human dignity be the lowest common denominator for shareholder value…
- Chronoyes 2y ago
  No, one cannot just comply with the "general rules" of GDPR, you have to comply with every last letter of the considerable legal legislation. The fact that the rules can be generalised to a reasonable few paragraphs is meaningless.
  - denton-scratch 2y ago
    > you have to comply with every last letter Cite, please. Perhaps regulators in diferent countries take different attitudes; in the UK, it's very soft-touch. Only the most egregious, repeated flouting of the regs attracts a penalty. As far as I can see, the Irish regulator is even softer; you could be mistaken for thinking that the Irish regulator's job is to make sure that US tech companies don't move their server sheds away from Ireland.
  - 9dev 2y ago
    That’s just not true. I’ve consulted with a few privacy legal agencies and spent a lot of time evaluating the law. Some sections are even worded in a way to allow wiggling room for prosecutors, or require good will on your part. What would even be supposed to happen if you weren’t „compliant“? In the end it’s always about specific kinds of misconduct, and that means fines. The amount of a fine depends on the severity of the misconduct. The GDPR isn’t different at all from other laws in that regard. If you’re found to be in breach of the GDPR, the severity of the breach as well as the amount of negligence or malevolence on your part is taken under consideration to decide on the fine. The prosecuting attorney also doesn’t have to actually fine you if it’s clear you put in effort and acted in good will. For a concrete example, a startup usually isn’t required to provide a fully fledged data deletion policy, but if you cannot roughly outline how you intend to handle people’s requests to delete their data, that doesn’t look good. If you don’t even have some sort of privacy policy on your website, that looks worse. Nobody can implement the GDPR 100%. But you can try to handle data responsibly, and if someone discovers you don’t and you try your best to fix the error (which is on your part, mind you), nothing draconian is going to happen. And we’re still talking about basic respect towards your users or customers here, it’s not like someone asks something ridiculous of you.
Ygg2 2y ago
[flagged]
- ungamedplayer 2y ago
  Yep
  - Ygg2 2y ago
    I didn't type that. Probably got butt written.
nonrandomstring 2y ago
> Information Security: "We Can Do It, We Just Choose Not To" Maybe not. It's convenient to think that misaligned incentives [0] or insufficient motives [1] explain failures of infosec. These are popular explanations amongst tech people, because we want to believe infosec can work. Our jobs depend on it. Now there are gargantuan fines, shelves of regulation, auditing and compliance, even jail time for executives. Has it fixed anything? No. If anything the landscape of breaches is accelerating. And things like Microsoft Recall, cloud "AI" services are only going to amplify it. Even if we had a "corporate death penalty" that simply shut down companies on their first breach, it would fix nothing. We'd just get fly-by-night tech companies with an average lifespan of 18 months. What if the people who said "Data wants to be free" are right? What if data containment is impossible in principle? Once we put aside wishful thinking, how can a technological society survive. It requires radical and brutal re-thinking of cybersecurity. How we define it. How we teach it. How we legislate it. How we address harms. [0] Bob secures Alice's data while Alice pays the price for Bob's failure [1] Many people don't care. Not everyone has a security mindset, not because they lack intrinsic self-respect but because they are unable to comprehend the harms.
- bradleyjg 2y ago
  Now there are gargantuan fines, shelves of regulation, auditing and compliance, even jail time for executives. What companies paid a big enough fine to have an unprofitable year? Which executives are sitting in prison? These things only exist in theory, not practice. I’ll give you endless reams of pointless box checking exercises in the name of auditing and compliance.
  - gravescale 2y ago
    They're not pointless if you're in the Guild of Box Ticking Consultancies, and guess who gets to say what the boxes are?
    - bradleyjg 2y ago
      That’s the thing. There’s a ton of grifters and/or idiots in the compliance space. If you talk to an actual lawyer that specializes in SOX litigation, or similar, you’ll find that many of the measures your compliance or fake-infosec people are telling you that you have to do aren’t actually required by any law or regulation.
Dalewyn 2y ago
I call this the Barack Obama School of Philosophy: Yes we can. (But we won't.)
artichokeheart 2y ago
Yep. Seen it in action. If we store credit card information we need to be PCI compliant. Let’s outsource that then. All stored personal information needs to be PCI compliant.
bradleyjg 2y ago
Every time one of these garbage companies sends me a letter telling me they lost my information in a breach but don’t worry they are giving me FREE CREDIT MONITORING!!1! they should have to put $50 inside. I think that would go a long way towards solving the problem.
- nonrandomstring 2y ago
  No. That would just put a market price on your dignity. Fifty bucks is cheap that they'd happily pay you that. Please forgive me... I don't mean this as a personal insult; but a better system would be where you get fined $50 for being stupid enough to give them the data in the first place.
  - acdha 2y ago
    > where you get fined $50 for being stupid enough to give them the data in the first place. So … you don’t use banks, utilities, phone companies, healthcare, etc. and don’t apply for or accept non-anonymous jobs? This isn’t optional in many cases, which is why it really needs to be covered by legislation which shifts the cost to the company collecting that data.
  - giantg2 2y ago
    It depends. Some industries would be able to happily pay that. Others have tight enough margins that they might feel real impact. Even 1 million users x $50 is a huge sum for most companies.
  - bradleyjg 2y ago
    I’m no more insulted than if you told me I’m a fool because I don’t live in a cave in the Himalayas chanting mantras. Our visions of a life well lived are too different for you to be able to insult me.
    - nonrandomstring 2y ago
      > Our visions of a life well lived are too different Well that didn't come over as humorless, tone-deaf, pompous or over-sensitive at all, thank goodness. I'll just get back to grunting and waving a jaw-bone in my cave, eating grubs and worms and smearing myself with my own faeces, then, shall I?
donatj 2y ago
It's kind of bizarre to me that people now days don't think of their address as public information. In the US at least, until about a decade ago, we would get a physical book in the mail every year of everyone in our metro areas address and phone number, for free, whether we wanted it or not. You enter your abode via the public. It's really not hard for someone like a stalker or private investigator or paparazzi to figure out if they can find... you. That is to say if you go in public. It's readily available to anyone who actually wants to seek it out, and it's something you do in public. It's not particularly private information in the practical sense. Every time my address is leaked online, I am not worried in the least. I don't really need to do anything. It's readily available on any number of information sites online anyway. When my credit card gets leaked, it's a major headache regardless of if I am liable for charges. Now I have to cancel my card, change all my automatic subscriptions, reenter it on every single shopping site. It will take literally months for all that to resolve.
- IshKebab 2y ago
  That's the naive black and white way to think about security. If it's possible to learn something with a bit of work then why bother keeping it secret? The answer is that the bit of work - "really not hard" as you put it - actually can be quite hard, and it is a real deterrent. You don't really care about whether something bad can happen... you can about whether it is likely to happen. It's a probability. And making it hard to find your address reduces that probability. Also I would suggest that HN members are unlikely to be stalked. You might feel differently if you were a Twitch girl or whatever.
  - donatj 2y ago
    I mean isn't security by obscurity generally accepted as bad practice? If everyone treated it as easily available data, and stopped using the act of having it alone as "proof" of anything we could be much more secure. E.g. merely having someones address should not be enough to get their house swatted.
    - skybrian 2y ago
vegetablepotpie 2y ago
Data breach insurance is not helping. Using weak passwords, leaving credentials where others can see them and downloading infected files can all lead to compromised data. Data breach insurance is specifically designed to protect a company in the aftermath of such an unexpected event. Business correctly recognizes data breaches as a risk. The insurance industry allows companies to export that risk to them. Data breach insurance pays for the financial impact to the business as a result of a data breach. This does not protect customers and in-fact creates misaligned incentives between a business and its customers. One solution would be to legislate that insurance is not acceptable for an organization to mitigate cyber risk. States and the federal government could do this by passing a law. I don’t see something like that getting passed though. The insurance industry and every business, both large and small, will lobby hard against it. You’d really need a strong grassroots consumer advocacy group to push hard for this, something that tells people’s personal stories to the media.
- lll-o-lll 2y ago
  We don’t need legislation, just dramatically increased penalties for a breach. Now insurance premiums drastically increase unless you’ve done x, y, z. I’m not all “free market solves it all”, but it definitely works well at balancing money through the system. We just haven’t correctly priced a data-breach.
  - sopooneo 2y ago
    Exactly. At $500 or $1000 per record, PII starts to look highly radioactive. Companies would be avoiding it's collection with a passion. And those that had to hold it would be compelled to do so less stupidly.
- yjftsjthsd-h 2y ago
  My first thought would be that insurance could be workable, but it might be too cheap right now. I would expect that when a company signs up for such a thing, they get audited and charged according to risk - a well run organization might find it a tiny cost, while say a company storing passwords in plaintext might find that their monthly bill is ruinous because they're practically guaranteed to be breached and subsequently fined into oblivion. Insurance shouldn't so much remove risk as amortize it.
deleted 2y ago
[deleted]
1970-01-01 2y ago
You have no obligation to anyone (except the government) when they ask for your information. Lying is a valid defense to this infosec ineptitude. Virtual credit card numbers are also a leap in control. Use them.
- lofaszvanitt 2y ago
  Exactly. Just give false info, even when buying products, so when a breach occurs you won't have any headaches whether what was leaked and how.
- acdha 2y ago
  You do have a legal obligation for anything financial where KYC laws apply, and I wouldn’t try that with airline tickets, either. You might also have issues around breach of contract if you’re lying about something which might have affected their willingness to allow service – this is likely not to go beyond cancelling your account but you should think about the magnitude. Nobody’s going to care about your grocery store loyalty program, but if there’s money or copyrighted material involved you might want to weigh your willingness to be a legal test case.
  - 1970-01-01 2y ago
    Airfare can be bought with virtual CCs. REAL ID requirement is another story altogether.
    - acdha 2y ago
      An alternate or temporary card number isn’t providing false information. It’s also less sensitive since they know not to store it and, at least for Americans, your liability is lower - you can rotate numbers easily, but not your PII.
6510 2y ago
You can argue for fines and prison sentences but on HN that won't accomplish anything. Here the only workable solution is a technical one, plenty of expertise available and people able to implement stuff. I do security by not having things I don't need, printing documents and deleting the data. It's not perfect by it self but it is something we could model in hardware quite well. One-way tubes seems pretty easy. For access one could give each employee a query quota and if they exceed it have someone else increase it temporary or permanently. One could also make a dumb console that displays data on a screen, db tables, pdf files, images. Could build some business logic in hardware. More often than not the need for access is triggered by something. If the customer calls you some of their information can be displayed. Accessing it in the days after that isn't dubious. It takes a lot and makes things more complicated but in the end you do get nice small data sets to work with.

88 points by bo0tzz 2y ago

Apart from outsourcing credit card data, what else could be different when that data is more secured than the more important personal data?

nonrandomstring 2y ago
Not having the data at all. It's almost impossible for those of us who've grown up in the last 40 years of commercial computing to imagine. But it's possible to radically decouple identity from function.
- nutrie 2y ago
  Precisely. Tell it to the marketing director, you can watch him go hairless in real time.
  - nonrandomstring 2y ago
    And there you have it. The "technology industry" hasn't had anything to do with computer scientists, engineers or technology people in about 20 years. It's run entirely by marketing people. They just keep the eggheads around as pets.
    - bayindirh 2y ago
      Technology is always developed to earn more monies. Progress is just a side-effect of monetary greed. It's said thrice, but when you remove the monetary greed, you have Mullvad VPN. P.S.: Yes, I say monies specifically, because the people who use "monies" as job parlance has the most monetary greed from my experience.
- roenxi 2y ago
  I'd imagine there is quite a lot of legal pressure against doing that. Not knowing who your customers are seems like the sort of thing that would eventually involve lawyers. mullvad.net was interesting to me because I could pay with Monero, meaning that they may actually have no data about me whatsoever except whatever is technically required for a VPN connection. Pretty cool company but it seems like the sort of model that would struggle in most countries with the amount of financial monitoring that tends to be in place.
  - nutrie 2y ago
    You're taking it too far. KYC concerns legal entities, that's a different story. In regards to individuals and their privacy, there are ways to greatly minimize personal information processing in "plain" form while keeping records (or access to records) to fulfill legal obligations. Having had conversations with people on security and anti-fraud teams, many experts clearly share this view.
  - kloop 2y ago
    Could still be done by re-incorporating companies in countries without kyc laws. And if fines for being breached get high enough, that's probably what would happen. That would probably be bad for tax receipts though, so it's more realistic that there's an upper bound on infosec related fines
- benoliver999 2y ago
  Mullvad VPN does this. No email. No password. Just an account number. If you want to to send them an envelope full of cash, you can.

thriftwy 2y ago

The embarrassing truth is that we can't do it. Humans are very bad at security.

nicce 2y ago
We can at least be very good at it, if we accept the UX cost.
- valenterry 2y ago
  The UX cost and the other opportunity cost, yeah.
tedk-42 2y ago
A counter point being, most people assume other people can be trusted. It's a small percentage of people hacking (in a malicious way) but the reach of the internet means we're all vulnerable.
fsflover 2y ago
We can do it, see https://qubes-os.org https://qubes-os.org
acdha 2y ago
Suppose that the laws were changed so that breaching personal data meant the CEO had to personally visit each affected customer and apologize face to face. Would it really be the case that “we can’t do it” because everyone is being popped by elite Chinese military operations, or would it instead magically turn out that companies could cut into the executive bonus fund by 10% to resolve understaffing for boring O&M work, and maybe reconsider collecting so much data in the first place? As the post notes, breaches of the data where they have real penalties are much rarer.
nonrandomstring 2y ago
> Humans are very bad at security. Security for who. from whom and to what end? I think many humans are bad at it. A smaller group, may be 10 percent, have the "security mindset". For the ninety percent who use technology or run businesses it's a schlep and imposition. They just want to forget about it. And there are many psychological and cultural devices to help them ignore security. Around 8 of remaining 10 percent are on what I see as the "dark side". They are guards for the castles, and primarily concerned with _helping_ technological abusers take advantage of the majority's weakness.

9dev 2y ago

The GDPR may be a pain in the ass to properly implement, and certain parts of it are a bureaucrats wet dream, but it sets the right incentives. If you read the general rules, it’s just common sense: Only keep what you need, take as many steps to secure data as you can, tell users proactively what you like to do with it, ask for their consent, and delete whenever they request it. It all sounds like lots of additional IT work, and it is (I spend a lot of time in our company to try and improve). But it only seems like a hassle because we went for so long without doing it right. There must be a way to let human dignity be the lowest common denominator for shareholder value…

Chronoyes 2y ago
No, one cannot just comply with the "general rules" of GDPR, you have to comply with every last letter of the considerable legal legislation. The fact that the rules can be generalised to a reasonable few paragraphs is meaningless.
- denton-scratch 2y ago
  > you have to comply with every last letter Cite, please. Perhaps regulators in diferent countries take different attitudes; in the UK, it's very soft-touch. Only the most egregious, repeated flouting of the regs attracts a penalty. As far as I can see, the Irish regulator is even softer; you could be mistaken for thinking that the Irish regulator's job is to make sure that US tech companies don't move their server sheds away from Ireland.
- 9dev 2y ago
  That’s just not true. I’ve consulted with a few privacy legal agencies and spent a lot of time evaluating the law. Some sections are even worded in a way to allow wiggling room for prosecutors, or require good will on your part. What would even be supposed to happen if you weren’t „compliant“? In the end it’s always about specific kinds of misconduct, and that means fines. The amount of a fine depends on the severity of the misconduct. The GDPR isn’t different at all from other laws in that regard. If you’re found to be in breach of the GDPR, the severity of the breach as well as the amount of negligence or malevolence on your part is taken under consideration to decide on the fine. The prosecuting attorney also doesn’t have to actually fine you if it’s clear you put in effort and acted in good will. For a concrete example, a startup usually isn’t required to provide a fully fledged data deletion policy, but if you cannot roughly outline how you intend to handle people’s requests to delete their data, that doesn’t look good. If you don’t even have some sort of privacy policy on your website, that looks worse. Nobody can implement the GDPR 100%. But you can try to handle data responsibly, and if someone discovers you don’t and you try your best to fix the error (which is on your part, mind you), nothing draconian is going to happen. And we’re still talking about basic respect towards your users or customers here, it’s not like someone asks something ridiculous of you.

Ygg2 2y ago

[flagged]

ungamedplayer 2y ago
Yep
- Ygg2 2y ago
  I didn't type that. Probably got butt written.

nonrandomstring 2y ago

> Information Security: "We Can Do It, We Just Choose Not To" Maybe not. It's convenient to think that misaligned incentives [0] or insufficient motives [1] explain failures of infosec. These are popular explanations amongst tech people, because we want to believe infosec can work. Our jobs depend on it. Now there are gargantuan fines, shelves of regulation, auditing and compliance, even jail time for executives. Has it fixed anything? No. If anything the landscape of breaches is accelerating. And things like Microsoft Recall, cloud "AI" services are only going to amplify it. Even if we had a "corporate death penalty" that simply shut down companies on their first breach, it would fix nothing. We'd just get fly-by-night tech companies with an average lifespan of 18 months. What if the people who said "Data wants to be free" are right? What if data containment is impossible in principle? Once we put aside wishful thinking, how can a technological society survive. It requires radical and brutal re-thinking of cybersecurity. How we define it. How we teach it. How we legislate it. How we address harms. [0] Bob secures Alice's data while Alice pays the price for Bob's failure [1] Many people don't care. Not everyone has a security mindset, not because they lack intrinsic self-respect but because they are unable to comprehend the harms.

bradleyjg 2y ago
Now there are gargantuan fines, shelves of regulation, auditing and compliance, even jail time for executives. What companies paid a big enough fine to have an unprofitable year? Which executives are sitting in prison? These things only exist in theory, not practice. I’ll give you endless reams of pointless box checking exercises in the name of auditing and compliance.
- gravescale 2y ago
  They're not pointless if you're in the Guild of Box Ticking Consultancies, and guess who gets to say what the boxes are?
  - bradleyjg 2y ago
    That’s the thing. There’s a ton of grifters and/or idiots in the compliance space. If you talk to an actual lawyer that specializes in SOX litigation, or similar, you’ll find that many of the measures your compliance or fake-infosec people are telling you that you have to do aren’t actually required by any law or regulation.

Dalewyn 2y ago

I call this the Barack Obama School of Philosophy: Yes we can. (But we won't.)

artichokeheart 2y ago

Yep. Seen it in action. If we store credit card information we need to be PCI compliant. Let’s outsource that then. All stored personal information needs to be PCI compliant.

bradleyjg 2y ago

Every time one of these garbage companies sends me a letter telling me they lost my information in a breach but don’t worry they are giving me FREE CREDIT MONITORING!!1! they should have to put $50 inside. I think that would go a long way towards solving the problem.

nonrandomstring 2y ago
No. That would just put a market price on your dignity. Fifty bucks is cheap that they'd happily pay you that. Please forgive me... I don't mean this as a personal insult; but a better system would be where you get fined $50 for being stupid enough to give them the data in the first place.
- acdha 2y ago
  > where you get fined $50 for being stupid enough to give them the data in the first place. So … you don’t use banks, utilities, phone companies, healthcare, etc. and don’t apply for or accept non-anonymous jobs? This isn’t optional in many cases, which is why it really needs to be covered by legislation which shifts the cost to the company collecting that data.
- giantg2 2y ago
  It depends. Some industries would be able to happily pay that. Others have tight enough margins that they might feel real impact. Even 1 million users x $50 is a huge sum for most companies.
- bradleyjg 2y ago
  I’m no more insulted than if you told me I’m a fool because I don’t live in a cave in the Himalayas chanting mantras. Our visions of a life well lived are too different for you to be able to insult me.
  - nonrandomstring 2y ago
    > Our visions of a life well lived are too different Well that didn't come over as humorless, tone-deaf, pompous or over-sensitive at all, thank goodness. I'll just get back to grunting and waving a jaw-bone in my cave, eating grubs and worms and smearing myself with my own faeces, then, shall I?

donatj 2y ago

It's kind of bizarre to me that people now days don't think of their address as public information. In the US at least, until about a decade ago, we would get a physical book in the mail every year of everyone in our metro areas address and phone number, for free, whether we wanted it or not. You enter your abode via the public. It's really not hard for someone like a stalker or private investigator or paparazzi to figure out if they can find... you. That is to say if you go in public. It's readily available to anyone who actually wants to seek it out, and it's something you do in public. It's not particularly private information in the practical sense. Every time my address is leaked online, I am not worried in the least. I don't really need to do anything. It's readily available on any number of information sites online anyway. When my credit card gets leaked, it's a major headache regardless of if I am liable for charges. Now I have to cancel my card, change all my automatic subscriptions, reenter it on every single shopping site. It will take literally months for all that to resolve.

IshKebab 2y ago
That's the naive black and white way to think about security. If it's possible to learn something with a bit of work then why bother keeping it secret? The answer is that the bit of work - "really not hard" as you put it - actually can be quite hard, and it is a real deterrent. You don't really care about whether something bad can happen... you can about whether it is likely to happen. It's a probability. And making it hard to find your address reduces that probability. Also I would suggest that HN members are unlikely to be stalked. You might feel differently if you were a Twitch girl or whatever.
- donatj 2y ago
  I mean isn't security by obscurity generally accepted as bad practice? If everyone treated it as easily available data, and stopped using the act of having it alone as "proof" of anything we could be much more secure. E.g. merely having someones address should not be enough to get their house swatted.
  - skybrian 2y ago

vegetablepotpie 2y ago

Data breach insurance is not helping. Using weak passwords, leaving credentials where others can see them and downloading infected files can all lead to compromised data. Data breach insurance is specifically designed to protect a company in the aftermath of such an unexpected event. Business correctly recognizes data breaches as a risk. The insurance industry allows companies to export that risk to them. Data breach insurance pays for the financial impact to the business as a result of a data breach. This does not protect customers and in-fact creates misaligned incentives between a business and its customers. One solution would be to legislate that insurance is not acceptable for an organization to mitigate cyber risk. States and the federal government could do this by passing a law. I don’t see something like that getting passed though. The insurance industry and every business, both large and small, will lobby hard against it. You’d really need a strong grassroots consumer advocacy group to push hard for this, something that tells people’s personal stories to the media.

lll-o-lll 2y ago
We don’t need legislation, just dramatically increased penalties for a breach. Now insurance premiums drastically increase unless you’ve done x, y, z. I’m not all “free market solves it all”, but it definitely works well at balancing money through the system. We just haven’t correctly priced a data-breach.
- sopooneo 2y ago
  Exactly. At $500 or $1000 per record, PII starts to look highly radioactive. Companies would be avoiding it's collection with a passion. And those that had to hold it would be compelled to do so less stupidly.
yjftsjthsd-h 2y ago
My first thought would be that insurance could be workable, but it might be too cheap right now. I would expect that when a company signs up for such a thing, they get audited and charged according to risk - a well run organization might find it a tiny cost, while say a company storing passwords in plaintext might find that their monthly bill is ruinous because they're practically guaranteed to be breached and subsequently fined into oblivion. Insurance shouldn't so much remove risk as amortize it.

deleted 2y ago

[deleted]

1970-01-01 2y ago

You have no obligation to anyone (except the government) when they ask for your information. Lying is a valid defense to this infosec ineptitude. Virtual credit card numbers are also a leap in control. Use them.

lofaszvanitt 2y ago
Exactly. Just give false info, even when buying products, so when a breach occurs you won't have any headaches whether what was leaked and how.
acdha 2y ago
You do have a legal obligation for anything financial where KYC laws apply, and I wouldn’t try that with airline tickets, either. You might also have issues around breach of contract if you’re lying about something which might have affected their willingness to allow service – this is likely not to go beyond cancelling your account but you should think about the magnitude. Nobody’s going to care about your grocery store loyalty program, but if there’s money or copyrighted material involved you might want to weigh your willingness to be a legal test case.
- 1970-01-01 2y ago
  Airfare can be bought with virtual CCs. REAL ID requirement is another story altogether.
  - acdha 2y ago
    An alternate or temporary card number isn’t providing false information. It’s also less sensitive since they know not to store it and, at least for Americans, your liability is lower - you can rotate numbers easily, but not your PII.

6510 2y ago

You can argue for fines and prison sentences but on HN that won't accomplish anything. Here the only workable solution is a technical one, plenty of expertise available and people able to implement stuff. I do security by not having things I don't need, printing documents and deleting the data. It's not perfect by it self but it is something we could model in hardware quite well. One-way tubes seems pretty easy. For access one could give each employee a query quota and if they exceed it have someone else increase it temporary or permanently. One could also make a dumb console that displays data on a screen, db tables, pdf files, images. Could build some business logic in hardware. More often than not the need for access is triggered by something. If the customer calls you some of their information can be displayed. Accessing it in the days after that isn't dubious. It takes a lot and makes things more complicated but in the end you do get nice small data sets to work with.