7 ms·

Of course they leaked the data. Any seasoned techie could've seen that coming from the start. One of these days, some seasoned and principled lawyer, who know

by neilv 2y ago

Of course they leaked the data. Any seasoned techie could've seen that coming from the start. One of these days, some seasoned and principled lawyer, who knows a bit about tech, is going to get ticked off, and decide to make one of these companies truly pay for their gross negligence. Then, gazing at the obliterated company, other companies will try to get legislation to let them let them off the hook, but some of those companies will decide the party of recklessness is probably over, and that they need to start acting responsibly and competently.

ryandrake 2y ago
Problem is, "Evil Hackers" always get the blame rather than the negligent companies, who play the victims. They trot out all the usual flawed analogies about locked doors and burglars, to excuse their negligence, and it works! So, the only legislation we ever see is to be Tougher And Tougher On Hackers instead of holding these clown companies responsible for the data they act as custodians of.
- singleshot_ 2y ago
  For negligence to arise there must be, inter Alia, duty and proximate harm. I think you’ll find the identity services have a duty to their contractual partner, the website, but not to the victim whose identity was stolen. And there’s a circuit split as to whether any of these people were even harmed. While litigation seems appealing, the answer here is legislation.
- arp242 2y ago
  Sometimes there's probably negligence involved; sometimes not. You don't know without having access to the specifics. Always blaming "negligent companies" is just as wrong as always blaming "evil hackers".
throwaway48476 2y ago
The problem is there are zero consequences for leaks. Customers should be owed automatic compensation for the companies giving their data away.
- lotsofpulp 2y ago
  That is needlessly complicated. The problem is the US federal government does not provide identity verification API as an infrastructure service. And they easily could using the USPS’s physical locations and their workflow in processing US passport applications, which already involves identity verification. Or even just coordinating the 50 states’ motor vehicle commissions or whatever since they are also verifying identities to issue drivers’ licenses and state identification cards.
  - throwaway48476 2y ago
    There are monied interests that do not want a tight American ID system.
    - MiguelX413 2y ago
      What are they?
      - kevin_thibedeau 2y ago
        Agriculture and food processors want their undocumented workers.
        simondotau 2y ago
        The transition to documented humanoid robots might take less than a decade.
        SoftTalker 2y ago
        Only if they are cheaper than a human. Which seems unlikely, for this kind of work.
        simondotau 2y ago
        Given time, what seems unlikely today will eventually be inevitable. With sufficient design iteration and manufacturing scale, there's no reason why a humanoid robot couldn't be cheaper to manufacture than a compact car. That's competitive with a single year of unskilled human labour — and that's before you account for the robot working 7 days a week, 18+ hours a day, for many years. No messing around with undocumented workers, no risk of unionising, no sexual harassment accusations, no training costs (after training the first robot), no worker injuries resulting in expensive litigation.
2OEH8eoCRo0 2y ago
> make one of these companies truly pay for their gross negligence. I think our whole industry is rotten and we need to drastically rethink a lot of what we do. This is unacceptable and it shouldn't be this hard. We need a reckoning.
- A4ET8a8uTh0 2y ago
  We might, but until average person does not consider it an issue ( and Equifax breach[2] proved it is merely cost of doing business[1] -- ~400 million out of $3,362 million profit in 2017 ), it will not be an issue. I am annoyed, but I have been annoyed for a long time. I am just waiting for the rest of the non-technical people to catch up, because it eventually should. But then... I am an optimist. [1]https://www.ftc.gov/enforcement/refunds/equifax-data-breach-settlement https://www.ftc.gov/enforcement/refunds/equifax-data-breach-... [2]https://en.wikipedia.org/wiki/2017_Equifax_data_breach https://en.wikipedia.org/wiki/2017_Equifax_data_breach
JohnFen 2y ago
> Any seasoned techie could've seen that coming from the start. At this point, it's pretty safe to just assume that any personal data any company has about you will be leaked sooner or later.
- withinboredom 2y ago
  I mean, if you live forever and cannot die by any means, your odds of getting stuck somewhere approaches 100% (fall in a pit, landslide, fall overboard on a boat, stuck in the sun, lost in space, etc). I imagine it is the same for data. The longer it is available, the more likelihood of it getting out of the company.
gotodengo 2y ago
For various reasons I started to open a bank account with Mercury, before deciding to use another provider. When I said I'd no longer be finishing the application and to please delete my passport info, first they ignored the second part. When I replied again asking them to delete my data they replied about KYC laws and assured me the data was securely stored of course. At that point I gave up. Maybe they could delete the data if I fought, maybe their hands were tied, maybe me fighting would end up flagging my info as a money laundering risk. But I immediately imagined exactly this leak happening. They're not the only vendor affected that had my data, nor is this breach the first, but that's the one that stings the most. Anecdotally I'm being swarmed by text message spam for the first time in months. I have to assume people are running through new breach data to find live numbers.
- pylua 2y ago
  They are probably outsourcing to a vendor who will do god knows what with it
- input_sh 2y ago
  Yes, their hands are tied. KYC requires the banks to keep the data for five years after account termination. One of many, many shitty things introduced by the Patriot Act that we now just live with.
  - TeMPOraL 2y ago
    I understood GP to have started but not finished the process of opening account. Does KYC still require banks to keep the data in this case?
    - input_sh 2y ago
      IANAL, so I'm not gonna attempt to interpret it, but here's how it's phrased: > Recordkeeping. Section 326 of the Act requires reasonable procedures for maintaining records of the information used to verify a person's name, address, and other identifying information. The proposed regulation sets forth recordkeeping procedures that must be included in a bank's CIP. Under the proposal, a bank is required to maintain a record of the identifying information provided by the customer. Where a bank relies upon a document to verify identity, the bank must maintain a copy of the document that the bank relied on that clearly evidences the type of document and any identifying information it may contain.6 The bank also must record the methods and result of any additional measures undertaken to verify the identity of the customer. Last, the bank must record the resolution of any discrepancy in the identifying information obtained. The bank must retain all of these records for five years after the date the account is closed.
DannyBee 2y ago
"One of these days, some seasoned and principled lawyer, who knows a bit about tech, is going to get ticked off, and decide to make one of these companies truly pay for their gross negligence." Principled lawyer who knows about tech here: This won't happen. 1. It's probably not gross negligence - gross negligence is an extreme departure from ordinary standards of care - the ordinary standard here seems to be to suck at security :) Legislation could establish a standard of care here and make this kind of thing gross negligence, but that hasn't really happened yet. It's also not obvious they owe a duty of care to anyone in the first place, without which negligence is impossible (at least regular old negligence) - this also needs legislative fixing unless you want to end up arguing about it forever. 2. Damages are basically all speculative - what is your actual injury here, and how much can you prove the value of it. Lots of people on HN love to say how much X or Y is worth. What can you actually prove in terms of real loss? It's fun to argue speculative loss (ie the value of your personal information maybe being stolen in the future, etc), but most cases are about real loss. In practice where it's too hard to calculate we often end up with statutorily set damages. That also hasn't happened here. Sorry to burst your bubble - without a bunch of legislation here, nothing is going to happen outside of the regular old class action lawsuits and $5 coupons.
- 1oooqooq 2y ago
  > 1. It's probably not gross negligence - gross negligence is an extreme departure from ordinary standards of care - the ordinary standard here seems to be to suck at security :) how hard it is to find a single company which does it right to testify? and then defense would have to find experts and several other legal counsels from similarly sized companies willing to testify that they also "do it wrong as a norm", with the extremely high risk of being included in the malpratice claim if the defense fails.
  - tptacek 2y ago
    That single company will be setting an extra-ordinary standard, so that doesn't help you.
    - 2y ago
hot_gril 2y ago
It's kinda impossible to give out DL, SSN, etc to so many companies and not have it leak. If these theoretical lawsuits scared companies enough, they might pay some centralized third party to handle the verification for them, but bad things follow from that. The federal and state governments hand out these IDs in the first place. Shouldn't they be the ones to verify them?
deleted 2y ago
[deleted]
fullspectrumdev 2y ago
Honestly, I hope Ron Wyden (I think his name is, US politician) takes this up - he has previously done excellent work calling companies to be accountable for such invasive and insecure practices

by neilv 2y ago

ryandrake 2y ago

Problem is, "Evil Hackers" always get the blame rather than the negligent companies, who play the victims. They trot out all the usual flawed analogies about locked doors and burglars, to excuse their negligence, and it works! So, the only legislation we ever see is to be Tougher And Tougher On Hackers instead of holding these clown companies responsible for the data they act as custodians of.

singleshot_ 2y ago
For negligence to arise there must be, inter Alia, duty and proximate harm. I think you’ll find the identity services have a duty to their contractual partner, the website, but not to the victim whose identity was stolen. And there’s a circuit split as to whether any of these people were even harmed. While litigation seems appealing, the answer here is legislation.
arp242 2y ago
Sometimes there's probably negligence involved; sometimes not. You don't know without having access to the specifics. Always blaming "negligent companies" is just as wrong as always blaming "evil hackers".

throwaway48476 2y ago

The problem is there are zero consequences for leaks. Customers should be owed automatic compensation for the companies giving their data away.

lotsofpulp 2y ago
That is needlessly complicated. The problem is the US federal government does not provide identity verification API as an infrastructure service. And they easily could using the USPS’s physical locations and their workflow in processing US passport applications, which already involves identity verification. Or even just coordinating the 50 states’ motor vehicle commissions or whatever since they are also verifying identities to issue drivers’ licenses and state identification cards.
- throwaway48476 2y ago
  There are monied interests that do not want a tight American ID system.
  - MiguelX413 2y ago
    What are they?
    - kevin_thibedeau 2y ago
      Agriculture and food processors want their undocumented workers.
      - simondotau 2y ago
        The transition to documented humanoid robots might take less than a decade.
        SoftTalker 2y ago
        Only if they are cheaper than a human. Which seems unlikely, for this kind of work.
        simondotau 2y ago
        Given time, what seems unlikely today will eventually be inevitable. With sufficient design iteration and manufacturing scale, there's no reason why a humanoid robot couldn't be cheaper to manufacture than a compact car. That's competitive with a single year of unskilled human labour — and that's before you account for the robot working 7 days a week, 18+ hours a day, for many years. No messing around with undocumented workers, no risk of unionising, no sexual harassment accusations, no training costs (after training the first robot), no worker injuries resulting in expensive litigation.

2OEH8eoCRo0 2y ago

> make one of these companies truly pay for their gross negligence. I think our whole industry is rotten and we need to drastically rethink a lot of what we do. This is unacceptable and it shouldn't be this hard. We need a reckoning.

A4ET8a8uTh0 2y ago
We might, but until average person does not consider it an issue ( and Equifax breach[2] proved it is merely cost of doing business[1] -- ~400 million out of $3,362 million profit in 2017 ), it will not be an issue. I am annoyed, but I have been annoyed for a long time. I am just waiting for the rest of the non-technical people to catch up, because it eventually should. But then... I am an optimist. [1]https://www.ftc.gov/enforcement/refunds/equifax-data-breach-settlement https://www.ftc.gov/enforcement/refunds/equifax-data-breach-... [2]https://en.wikipedia.org/wiki/2017_Equifax_data_breach https://en.wikipedia.org/wiki/2017_Equifax_data_breach

JohnFen 2y ago

> Any seasoned techie could've seen that coming from the start. At this point, it's pretty safe to just assume that any personal data any company has about you will be leaked sooner or later.

withinboredom 2y ago
I mean, if you live forever and cannot die by any means, your odds of getting stuck somewhere approaches 100% (fall in a pit, landslide, fall overboard on a boat, stuck in the sun, lost in space, etc). I imagine it is the same for data. The longer it is available, the more likelihood of it getting out of the company.

gotodengo 2y ago

For various reasons I started to open a bank account with Mercury, before deciding to use another provider. When I said I'd no longer be finishing the application and to please delete my passport info, first they ignored the second part. When I replied again asking them to delete my data they replied about KYC laws and assured me the data was securely stored of course. At that point I gave up. Maybe they could delete the data if I fought, maybe their hands were tied, maybe me fighting would end up flagging my info as a money laundering risk. But I immediately imagined exactly this leak happening. They're not the only vendor affected that had my data, nor is this breach the first, but that's the one that stings the most. Anecdotally I'm being swarmed by text message spam for the first time in months. I have to assume people are running through new breach data to find live numbers.

pylua 2y ago
They are probably outsourcing to a vendor who will do god knows what with it
input_sh 2y ago
Yes, their hands are tied. KYC requires the banks to keep the data for five years after account termination. One of many, many shitty things introduced by the Patriot Act that we now just live with.
- TeMPOraL 2y ago
  I understood GP to have started but not finished the process of opening account. Does KYC still require banks to keep the data in this case?
  - input_sh 2y ago
    IANAL, so I'm not gonna attempt to interpret it, but here's how it's phrased: > Recordkeeping. Section 326 of the Act requires reasonable procedures for maintaining records of the information used to verify a person's name, address, and other identifying information. The proposed regulation sets forth recordkeeping procedures that must be included in a bank's CIP. Under the proposal, a bank is required to maintain a record of the identifying information provided by the customer. Where a bank relies upon a document to verify identity, the bank must maintain a copy of the document that the bank relied on that clearly evidences the type of document and any identifying information it may contain.6 The bank also must record the methods and result of any additional measures undertaken to verify the identity of the customer. Last, the bank must record the resolution of any discrepancy in the identifying information obtained. The bank must retain all of these records for five years after the date the account is closed.

DannyBee 2y ago

"One of these days, some seasoned and principled lawyer, who knows a bit about tech, is going to get ticked off, and decide to make one of these companies truly pay for their gross negligence." Principled lawyer who knows about tech here: This won't happen. 1. It's probably not gross negligence - gross negligence is an extreme departure from ordinary standards of care - the ordinary standard here seems to be to suck at security :) Legislation could establish a standard of care here and make this kind of thing gross negligence, but that hasn't really happened yet. It's also not obvious they owe a duty of care to anyone in the first place, without which negligence is impossible (at least regular old negligence) - this also needs legislative fixing unless you want to end up arguing about it forever. 2. Damages are basically all speculative - what is your actual injury here, and how much can you prove the value of it. Lots of people on HN love to say how much X or Y is worth. What can you actually prove in terms of real loss? It's fun to argue speculative loss (ie the value of your personal information maybe being stolen in the future, etc), but most cases are about real loss. In practice where it's too hard to calculate we often end up with statutorily set damages. That also hasn't happened here. Sorry to burst your bubble - without a bunch of legislation here, nothing is going to happen outside of the regular old class action lawsuits and $5 coupons.

1oooqooq 2y ago
> 1. It's probably not gross negligence - gross negligence is an extreme departure from ordinary standards of care - the ordinary standard here seems to be to suck at security :) how hard it is to find a single company which does it right to testify? and then defense would have to find experts and several other legal counsels from similarly sized companies willing to testify that they also "do it wrong as a norm", with the extremely high risk of being included in the malpratice claim if the defense fails.
- tptacek 2y ago
  That single company will be setting an extra-ordinary standard, so that doesn't help you.
  - 2y ago

hot_gril 2y ago

It's kinda impossible to give out DL, SSN, etc to so many companies and not have it leak. If these theoretical lawsuits scared companies enough, they might pay some centralized third party to handle the verification for them, but bad things follow from that. The federal and state governments hand out these IDs in the first place. Shouldn't they be the ones to verify them?

deleted 2y ago

[deleted]

fullspectrumdev 2y ago

Honestly, I hope Ron Wyden (I think his name is, US politician) takes this up - he has previously done excellent work calling companies to be accountable for such invasive and insecure practices