Slashdot Mirror
158 Million Records Exposed (And Counting)
Lucas123 writes "According to the
The Privacy Rights Clearing House 158 million records have been exposed over the past two years as a result of inadequate security. Data's less secure today because as fast as banks, merchants and consumers add new layers of security to their storage systems and networks, new technologies — or simply careless users — create new security holes, according to Bob Scheier at Computerworld."
but all you would have to do is pass a law making the financial institutions responsible for all of the costs and hassles involved with identity theft, and it would never happen again. but as long as consumers shoulder that burden, or even a part of it, it will continue, as the consumer is not the one in a position to fix any of the problems that lead to identity theft
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
At a state level (We could never get our Fed legislative critter to do something for the people) have a 'data protection' right. Bottom line: You lose data: you pay the people who's data you had. You fail to notify the people you pay double. If the information is actually used, damages are double plus ACTUAL / ON GOING losses.
Bottom line: Lock up your data!. We learned this back in the days of the wild west. Now we must - relearn; reinvent the safe for the 21st century data.
My own information, including bank account numbers, has been stolen and sold. I received a letter from a company I've never done business with, explaining how it wasn't their fault that they lost information I didn't give them, and trying to reassure me that nothing bad would happen.
The people running these companies should be considered criminally negligent. Maybe then they'll start to take security seriously.
What's the ugliest part of your body? Some say your nose, some say your toes, but I think it's your mind. -Zappa
http://www.privacyrights.org/ar/DataBreaches2006-A nalysis.htm
human/software incompetence took up 44% in the public sector, hackers 52% in higher education and theft(s) were 55 and 57% for private and medical respectively
Sigs are too short to say anything truly profound so read the above post instead.
I'm guessing that's a global number (RTFA? who has time... besides me), but if that was just America, that would be more than half of the population... wonder how many of those numbers are dupes.
An I.T. motto in the hands of an idiot is a dangerous thing...
Data breaches are always going to exist.
The big question is: What can be done to minimize the impact of the breaches.
The short answer - make it harder to get credit cards, loans, etc.
Once you change the way that money is handed out by financial institutions, all that stolen data becomes worthless.
But... that will never happen. Easy access to credit is the lifeblood of the debt driven American economy. So really, no matter how much moaning goes on about fraud, they still want a system that allows everyone to easily have access to debt at the drop of a hat.
[Fuck Beta]
o0t!
Did I do the math wrong or does that add up to just over 200,000 a day give or take.
2 years = 365*2 = 730
158,000,000/730 = 216,438.36
wow thats a lot of data to be "compromised." I think some of these people should have had better measures in place to prevent this type of thing. Others just shouldn't piss off there staff to the point that they sell company information to the highest bidder. Especially when that information is mine.
Why should the banks be liable for phishing? That is the failure of the user to remember proper security and/or make a good decision. However, the banks should be 100% responsible for all fraudulent credit issues and such.
One thing we need is a new court order from each state government that allows a citizen or legal immigrant to simply walk up to a credit institution, post identity theft, and say "purge those records, NOW!" at the penalty of fines and being liable for libel and slander if not acted upon in a reasonable time period.
Yes, that will motivate banks to use better security but in the end it all comes down to the fact that people need to do their part to uphold the security that is already there.
The problem with that is that current mechanisms are far too much of a burden for the average member of the public to avoid carelessness and/or social engineering attacks.
It simply isn't reasonable to expect people to create and remember a different, properly secure password for each of numerous services, some of which will only be accessed occasionally, perhaps as little as once per year or less. Nor is it reasonable to expect average people using typical software on typical computers to understand all the dangers of phishing attacks, the need to patch immediately against cross-site scripting vulnerabilities, and other geeky gobbledegook.
Since large organisations only tend to understand responsibilities in terms of the bottom line impact if they fail to live up to them — and that includes the responsibility to obey the law — the law needs to impose a sufficient burden on those handling sensitive personal information improperly that it becomes more economic for them to invest in proper security, both on their own side and in terms of what they expect of their clients. With sufficient pushing in the right direction, we could have not only much better security in terms of software and protocols, but also practically effective means of identifying people more reliably and with less susceptibility to casual crime.
This doesn't need to be rocket science, either: consider that switching from using signatures to using PINs to authenticate card transactions has reduced card fraud by something like 80% in several European countries. The new PIN-based systems are simple enough for almost everyone to understand, were well advertised prior to their takeover, are backed by software and equipment that work pretty well, and are based on the tried-and-tested security policy of combining a physical token with some information known only to the legitimate user. Just like that, you've removed a common mechanism for card fraud, saving businesses billions and saving hassle for thousands of would-have-been victims every year.
We have the technology to do this. A simple card and public key cryptography suffice for most purposes, after all. We just need the will to do it more widely, so the complexity is dealt with by the system and not by the user.
If you disagree, post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like.
Well, at least you knew who and where the information was leaked.
In my case, I got a letter from my credit card saying that a merchant whom I had transacted with, was the source of a breach. No more information on when this occurred, who the merchant was, how many people were impacted or how long they knew of the situation, before they informed me. Instead, the Credit Card company re-issued me a new credit card, at 'my request' prior to me doing or asking for anything.
The letter in fact was so unsettling, it was written to evoke a feeling that I had somehow reported fradulent activity... I called the company and spent 45 minutes before realizing that there was one of me and a seemingly unending supply of pod-people who kept repeating the same line to me. I obtained my own credit report a few weeks after and guess what, the aforementioned account was "closed at the customer's request".
The outrage in me continues, and I wonder what kind of risk I'm exposed to, but I don't know what to do against an army of droid? May be a letter will do some good? How much time should I invest in all of this without the faintest glimmer that anything will happen?
I second your thoughts on higher penalties. With credit cards being an increasing singular means of carrying out transactions, I would certainly modify my business behaviors with people who are not careful with my information!
When it comes to your personal information there is no thing as security once it has left your control. None of it is really protected. Companies engage in "security theater" to give the appearance of protection but that is a sham. Why? THERE IS NO PENALTY FOR BREACHES.
Genuine security costs companies millions of dollars. Insecurity costs them NOTHING. They could expose every single piece of every person's information and it would have no penalty. None.
The government and corporations have no interest in protecting your information. So much is in the wild already that it makes no difference to them. 158 million people? What's 50 million more? 100 million more?
Stop complaining about this. The horse was out of the barn a long time ago. Security and privacy are illusions. They are gone and they are NEVER coming back. Your security and privacy have no value to the government or corporations.
Dictionary attack.
"aaaaaaaaa@gmail.com"
"aaaaaaaab@gmail.com"
"aaaaaaaac@gmail.com"
If you dig through your SMTP logs every once in a while, you see that stuff. Usually coming from a compromised home machine in short bursts of fifteen or thirty tries.
A few minutes later, another block is tried from another IP on the other side of the planet.
Plus, did you read the fine print on your Gmail account agreement? Did they SAY they wouldn't sell the address? Or did they SAY the wouldn't sell delivery of email to accounts? (Without releasing the list, they can do anything they want with the headers, it's their server after all.