158 Million Records Exposed (And Counting) 106
Lucas123 writes "According to the
The Privacy Rights Clearing House 158 million records have been exposed over the past two years as a result of inadequate security. Data's less secure today because as fast as banks, merchants and consumers add new layers of security to their storage systems and networks, new technologies — or simply careless users — create new security holes, according to Bob Scheier at Computerworld."
Solution is simple... (Score:5, Interesting)
Bottom line: Lock up your data!. We learned this back in the days of the wild west. Now we must - relearn; reinvent the safe for the 21st century data.
Sucks (Score:5, Interesting)
The people running these companies should be considered criminally negligent. Maybe then they'll start to take security seriously.
Re:i read it somewhere else (Score:5, Interesting)
Comment removed (Score:3, Interesting)
But it has to be reasonable for Joe Sixpack (Score:3, Interesting)
Yes, that will motivate banks to use better security but in the end it all comes down to the fact that people need to do their part to uphold the security that is already there.
The problem with that is that current mechanisms are far too much of a burden for the average member of the public to avoid carelessness and/or social engineering attacks.
It simply isn't reasonable to expect people to create and remember a different, properly secure password for each of numerous services, some of which will only be accessed occasionally, perhaps as little as once per year or less. Nor is it reasonable to expect average people using typical software on typical computers to understand all the dangers of phishing attacks, the need to patch immediately against cross-site scripting vulnerabilities, and other geeky gobbledegook.
Since large organisations only tend to understand responsibilities in terms of the bottom line impact if they fail to live up to them — and that includes the responsibility to obey the law — the law needs to impose a sufficient burden on those handling sensitive personal information improperly that it becomes more economic for them to invest in proper security, both on their own side and in terms of what they expect of their clients. With sufficient pushing in the right direction, we could have not only much better security in terms of software and protocols, but also practically effective means of identifying people more reliably and with less susceptibility to casual crime.
This doesn't need to be rocket science, either: consider that switching from using signatures to using PINs to authenticate card transactions has reduced card fraud by something like 80% in several European countries. The new PIN-based systems are simple enough for almost everyone to understand, were well advertised prior to their takeover, are backed by software and equipment that work pretty well, and are based on the tried-and-tested security policy of combining a physical token with some information known only to the legitimate user. Just like that, you've removed a common mechanism for card fraud, saving businesses billions and saving hassle for thousands of would-have-been victims every year.
We have the technology to do this. A simple card and public key cryptography suffice for most purposes, after all. We just need the will to do it more widely, so the complexity is dealt with by the system and not by the user.
Re:i read it somewhere else (Score:5, Interesting)
It continually baffles me that credit card numbers are assumed to be somehow secret, despite the fact that you hand a waiter making $2.15 an hour a little piece of plastic with that number written on it without a thought.
The customer is in no position to create a new technology that ends this "open secret" way of verifying identities. There are much better mechanisms available, using public-key cryptography and some combination of passwords (entered into a smart card, not passed over the Internet), biometrics, and physical identity tokens.
That's up to the credit card companies. The reason people steal the numbers is that all they have to do is steal the number. Make it harder to steal and they'll stop stealing it. Until then it will continue to shock me that mere knowledge of a password which is regularly transmitted all over the place, and can be stolen from my wallet or my mail, is used as an identifier.
They blame it on the customer because they can, not because it's the customer's fault.
Re:i read it somewhere else (Score:2, Interesting)
Re:i read it somewhere else (Score:5, Interesting)
What about a DNS attack, where legitimate customers going to the legitimate YourBank.com site are redirected to a man-in-the-middle site? Everything looks legit (albeit slow) and it's a near-picture-perfect real-time clone of the bank's site and the user's account info. Who has to pony up in this case? Linksys/Cisco for making a router susceptible to DNS hijacking? IE or Firefox for somehow not recognizing the MITM? Verisign for legitimately issuing a certificate to a hacker that he then later misused?
At some point a lot of these fall into the category of technological failings. Are we suddenly going to see disclaimers on routers and ethernet switches claiming "Not suitable for secure financial transaction data"?
The only way to truly end this is to remove the ability to use the data online, and require face-to-face authentication. Shut down commercial use of the internet. Not a likely scenario.
The next best solution would be to train employees and end-users how to safely transact business over the internet. Joe Sixpack can't even identify every button on his TV remote control -- what are the chances he can learn how to check certificates for authenticity? Even if he could be trained, would you then shoulder the responsibility for training him how to spot hacks just in time to have a new hack come out and steal his account information anyway? "Mr. Trainer, I followed your instructions exactly and I still got hacked. Here's a lawsuit for damages due to your incompetence."
And before you place too much faith in IPV6 to solve all these problems, you should take a look at every other piece of technology claiming to solve security problems. They're all flawed -- some more than others. It's just that we don't know IPV6's vulnerabilities yet.
At least you knew! (Score:4, Interesting)
In my case, I got a letter from my credit card saying that a merchant whom I had transacted with, was the source of a breach. No more information on when this occurred, who the merchant was, how many people were impacted or how long they knew of the situation, before they informed me. Instead, the Credit Card company re-issued me a new credit card, at 'my request' prior to me doing or asking for anything.
The letter in fact was so unsettling, it was written to evoke a feeling that I had somehow reported fradulent activity... I called the company and spent 45 minutes before realizing that there was one of me and a seemingly unending supply of pod-people who kept repeating the same line to me. I obtained my own credit report a few weeks after and guess what, the aforementioned account was "closed at the customer's request".
The outrage in me continues, and I wonder what kind of risk I'm exposed to, but I don't know what to do against an army of droid? May be a letter will do some good? How much time should I invest in all of this without the faintest glimmer that anything will happen?
I second your thoughts on higher penalties. With credit cards being an increasing singular means of carrying out transactions, I would certainly modify my business behaviors with people who are not careful with my information!
Re:i read it somewhere else (Score:3, Interesting)
Very true. Technology, as it stands now, is very open to phishing, etc. You're entirely right - the technology needs to change.
However, such failings of technology is only a part of the problem. It seems like every time I visit /. there's a new article about how some company or another just lost the SSN, bank account numbers, passwords, identification numbers, DNA signatures and biometric iris scans of another 40 million people. It seems like these companies are actually at fault for this lost data, so where do we draw the line? If you get phished you're not liable but if you lose the laptop the personal information of everyone in the state is on you are? What about a weak implementation of security?
Re:i read it somewhere else (Score:5, Interesting)
You're missing the point.
Right now, the companies whose data is stolen have no financial incentive to beef up their security, but they have plenty of PR incentive to cover up breaches. If such breaches were to hurt their bottom line, the shareholders would make them take their security seriously.
As for the effectiveness of laws, look at Sarbanes-Oxley: corporations have created whole departments just to manage compliance. Sure, they bitch and moan abotu the hassle, but they comply because it's the law. Why can't they be obligated to put the same effort into customer data security?
Re:i read it somewhere else (Score:3, Interesting)
And how exactly am *I* supposed to do that? There are hundreds, perhaps thousands of companies who are continuously buying and selling information about *me*. And you can bet that when these companies sell someone else information they have collected about me, I am the last person on the notification list.
Furthermore, these companies actively resist you being able to contact them. Thanks to modern voice-mail trees, it's pretty much impossible to speak to a human at any of these companies, and assuming that you can make contact with some of the smaller ones, you can bet the first question they ask is "What's your social security number?", which, is information you're not supposed to give out over the phone if you want to protect your identity!
So far, the only way I have ever seen to have these companies take you seriously is to sue them. But you can't sue them if you're not sure they even have information about you. And it's very difficult to find out if they information about you unless you sue them.
I once recieved a letter from a collection agency I never heard of claiming I owed $28 for an AOL account, and unless I sent them a check, it would go into my credit report that I was delinquent. I called the company, and the first thing I was asked by the rude person over the phone was to give them my social security number. I refused to give this person a number since I felt this was a scam - I've never been and never will be an AOL customer. They hung up on me. So I called back, asking to speak to a supervisor. Again, I was asked for my social. I refused. They hung up.
So, I contacted AOL. AOL claimed I had an account that was unpaid. I told them I've never been an AOL customer. They said I had to fill out a form claiming that, and they needed my address. I pointed out that they should already have my address, since they were able to give that info to the collection agency.
In the end, I wound up sending complaints to AOL, the State Attouney General and Better Business, but, as far as I know, it did get resolved. But the point is, I have no idea how AOL got my information, and I only found out I had an AOL account after I was asked by a collection agency for money. AOL never once contacted me.
So exactly how am I supposed to "secure" and be responsible for my information, when I can't even tell who's got what about me?
What's worse is the amount of time I spent on this, because two dumbass companies can't even get their information about me straight. If AOL had contacted me FIRST, for example, it could have been resolved with one phone call. Instead, they just shuffled it off to a collection agency, which made the whole thing much more complicated.