Data Theft Soars to Unprecedented Levels 116
A Wired article reports on data loss in 2007, and the numbers aren't good. Credit card and social security theft was at an all-time high, with even more losses expected in 2008. Information thieves, it seems, are just one step ahead of IT security. "While companies, government agencies, schools and other institutions are spending more to protect ever-increasing volumes of data with more sophisticated firewalls and encryption, the investment often is too little too late. 'More of them are experiencing data breaches, and they're responding to them in a reactive way, rather than proactively looking at the company's security and seeing where the holes might be,' said Linda Foley, who founded the San Diego-based Identity Theft Resource Center after becoming an identity theft victim herself."
The Solution. (Score:5, Funny)
Re: (Score:2)
Re: (Score:2, Funny)
Re: (Score:3, Insightful)
Re: (Score:2)
On the other hand, I'm smart, talented, healthy, educated, a problem solver, a useful person to have around. I don't rely on the interest return on my massive holdings to sustain some overinflated lifestyle.
So, why should I give a shit about these problems? Seems like it will make m
Re: (Score:2)
If the financial market goes to shit who are you going to borrow money off to sustain that debt? what if the banks call in all your loans (as they are entitled to do) would you be able to pay them all out tomorrow?
more importantly, is someone stole your identify and racked up $10k in debts in your name, how would you feel about it? you'd be pretty stressed i imagine, so don't kid yourslef i
Re: (Score:2)
Re: (Score:1)
There is talk of this happening along with other major financial changes because of how badly the financial markets in the US and elsewhere have been screwed up.
Re: (Score:2)
Yes, a mortgage is a debt. Just like a car loan, and a student loan. Most people are in debt. What planet do you come from?
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
The downside of exponential-growth computing (Score:5, Insightful)
Re: (Score:2)
Required car analogy: It's
Re: (Score:2)
Instant credit without true identity verification is the problem here. Social security numbers and other PII are worth stealing because credit is so easy to obtain, including in someone else's name. Come
Re: (Score:2)
Re: (Score:2)
Which is something they should never be doing.
I drove down there and told the manager to delete any of my personal information and asked him where I ever signed anything or in any other way authorized them to retain my credit card information. Of course he wasn't able to provide any such documentation.
Prob
Something fishy... (Score:5, Insightful)
Re: (Score:1)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Yes, it
Re: (Score:2)
You don't even need to know their mother's "maiden name"?
I suspect that impersonating someone by knowing facts about them only actually works for some people. If you are well known or important enough there are actually secure available. Otherwise every celebrity's house would be easily identifiable by the presence of a generator... (A generator with a very large fuel tank in
Re: (Score:2)
By the way, accurate summarization of what a SSN is. I will be updating wikipedia article shortly.
Re: (Score:2)
Why did either of them need it in the first place? Quite often when it comes to these kind of "loses" there is little rational reason for several of the fields being in the database. In the extreme this applies to the whole database.
There's no reason th
Re: (Score:2)
No, it's because we're using shared secrets (hey look, an oxymoron!) to establish identity.
As far as your finances are concerned, anyone who knows your name/birthdate/SSN/address/card number/etc is *you*, and can do pretty much anything you can do. And of course anyone you do business with knows enough of these things that they or anyone who steals their database can pr
Re: (Score:2)
As far as your finances are concerned, anyone who knows your name/birthdate/SSN/address/card number/etc is *you*, and can do pretty much anything you can do.
A rather fundermental part of the problem is that none of these actually are "shared secrets" in the first place. Technically they are what is know as "identifiers".
In some cases, especially with web based systems, it can be possible to hack in actual shared sec
Re: (Score:2)
"Were they encrypted?"
"No."
"Why not?"
"..."
One step ahead..? (Score:4, Insightful)
I don't know what the trouble is with the 'myminicity' thing, so I'll just comment on the synopsis.
It has to be noted that since much data these days appears to be stored unencrypted, or removed from the premises by 'interns,' that much of the populace is 'one step ahead.' The advantage the bad guys have, beyond institutional stupidity and negligence, is that there's so many of them willing to exchange the data once acquired.
Re: (Score:2)
Re: (Score:2)
The advantage the bad guys have, beyond institutional stupidity and negligence, is that there's so many of them willing to exchange the data once acquired.
Huh. So the more "open source" approach of the crackers is beating the "closed source" defensive model of the defenders?
I'm not a zealot one way or the other (in particular I've always thought that "security through obscurity" actually has some value) but that point seems telling.
call me a cynic (Score:3, Funny)
"darling, the CC company says we owe them $2400 dollars."
"thats nonsense, I barely use my CC"
"it says there were hookers, gallons of gin and a blackjack tableset ordered to an address in Nevada."
"OMG it must have been the waiter in the diner I went in on the way to the 'conference' with work! (pray you are saying it with a straight face)"
Re: (Score:2)
Re: (Score:3, Interesting)
wife: Honey what's this charge for porn on our creditcard?
man: Oh you know I would never look at THAT. Someone must have stolen our credit card.
Re: (Score:2)
wife: Honey do you know what this charge on our creditcard is for?
man: Never heard of them. Someone must have stolen our credit card.
Not that I understand how you manage to avoid finding free porn on the Internet.
Not a big surprise (Score:5, Insightful)
One of my friends went dumpster diving at Compusa. On top of finding almost every cable you'd ever need to hook anything up, he found over 70 pages of daily reports disclosing full credit card numbers, expiration dates, first/last names, and card company. Personal checks that were used during that day listed the account #, routing #, first/last name, birthdate, drivers license #, address, phone number, and probably some other stuff. He found this on two separate occasions, with over 300 cards listed total. None of the papers were shredded/torn either. He didn't intend to find this stuff - Imagine how easy it must be for somebody who actually wants the information!
The majority of the population doesn't understand how seriously security needs to be taken when venturing online to make purchases. If people understood going onto unsecured networks/etc was pretty much the same as leaving your credit card/checkbook in the front seat of your car, leaving the doors unlocked, and parking it in a bad neighborhood they might take security more seriously.
Sure - Most of the time if you leave stuff in your car unsecured, it'll be there when you get back. But there's always that small chance it'll get stolen.
Yet another reason... (Score:1)
Re: (Score:2)
Re: (Score:2)
Most of which may well have been "in a computer" before being printed...
I have been fighting with people at work to shred everything if they shred anything.
Let me guess, instead they want some policy for only shredding the stuff which matters. (It also dosn't help that there are some strange attitudes towards paper recycling around.)
Re: (Score:1)
Given that data ... (Score:4, Insightful)
Use Arizona's anti-illegal immigrant method (Score:3, Interesting)
IT Security really to blame? (Score:4, Insightful)
RSA Secure ID... (Score:4, Insightful)
It works for managing access to top secret material, hundreds of billions in monetary instruments and the most vital systems of companies in every industry worldwide... I suppose that on an individual basis, any person's assets, credit and livelihood just aren't as important. Or, perhaps the very industries that protect themselves with this system just don't give a fuck about their consumers.
If these folks were landlords, they'd tell every criminal they could find who you are and were you live, and they'd refuse to install a lock on your door.
Re: (Score:1, Insightful)
As much as I like RSA keyfobs, they are pricy. Presumably you would get a better price when you buy millions of them though.
However, I'm betting that 5% of the population are going to lose their keyfob every year, 5% will forget the PIN, and another 5% will write the PIN on the keyfob.
Re: (Score:2)
Re: (Score:2)
Mod Parent Funny (Score:2)
I salute your dongle scheme, sir, and the clever way you slipped it past prior commentators. I too have never heard of counterfeit passports or leaks of top secret material. As for hundreds of billions in monetary instruments, I am confident that the alleged losses on "sub prime" mortgages c
Re: (Score:2)
What _ the _ fuck.
Piracy (Score:1)
Truenames and identity (Score:4, Interesting)
What amazes me about "identity" (financial, blog or otherwise) in the Internet age is how similar it is starting to feel to the concept of identity in fantasy fiction (such as the Earthsea books) where people have disposable day-to-day common names, but also truenames that hold the real power of identity, shared only with the most trusted of companions.
Throwing money at the problem (Score:2)
it's all very well to say spending has increased, but what was actually DONE about the problem? Simple and cheap solutions are often the best.
for example, my bank sends me an sms with a code to complete all online transfers to new billers, rendering fishing useless. the only way to change the mobile number is to answer 2 very personal security questions,
Re: (Score:2)
Actually you probably don't want to be using personal information for bank security questions at all.
I think the next step forward for CC's is one time numbers and photo ID on the card itself. shouldn't be very hard, have it operate just like l
Stupidest Legal Term (Score:2)
Re: (Score:3, Insightful)
I've seen interviews of people who say they no longer can utilize their identity to do the things they expect to be able to do, buy a house, open a credit account, and have their previous credit rating.
So they feel their identity has been stolen.
rd
Re: (Score:2)
Re: (Score:2)
But you would claim it was stolen if you couldn't drive it again because of it. Same thing.
rd
Re: (Score:2)
Re: (Score:2)
It has. It's your name, SSN, address, birthdate, credit history. That's what becomes effectively not yours anymore because you can't use it. You can try, but it's no good anymore with all the uses made of it after it was stolen.
So you try to recover it, and yet at any time a new mortgage application can come in to a credit bureau with your name on it. Takes a lawyer and a lot of money to get it back. So call it recovering stolen goods, ot getting your name back.
Re: (Score:2)
way to contridict yourself in one sentence dumbass. once an identity thief gets his hands on your details, he will run debts and bring all kinds of grief to your name so that using it again is impossible. it'd be easier to change your name and start again then go through the court system attempting to prove each infraction wasn't you.
Re: (Score:2)
The Irony (Score:2)
Re: (Score:2)
A new way of thinking about Data "security" (Score:1)
in related news (Score:3, Insightful)
More and more common thieves are learning the value of data. So more of it is being stolen. I bet MP3 player and cell phone theft rates are reaching "unprecedented" levels as well.
maybe they should work with communities of (Score:1)
Finding and stopping IDT (Score:4, Interesting)
The way to make this more effective requres a huge amount of work: Longer CC numbers and SSNs. It's the same problem IT has had with users FOREVER. Users expect the moon, stars, and all the oort cloud between, yet do not want to provide the least effort. There's no "buy in" from Soc Sec and the CC companies. As long as they get to pass along the cost to someone else, then the current system is "good enough". No need to expend any of THEIR effort to find, track, and plug up problems.
But make THEM accountable in a tangable way, and I think we'll start to see effective measures to stop this nonsense. And no few RSG and 419'ers in jail to boot.
We need the credit card companies to do more (Score:2)
Even taking the simple step of changing the merchant agreements such that if the merchant suffers a breach or loss of credit card numbers, they are contractually obligated to notify the people who's numbers have been stolen (either via announcements in the media/on the merchants website or individually somehow) wo
Re: (Score:2)
Including the most secure method, not storing them at all. Also in order for a company to store numbers they should need a special merchant account.
Discover Card (Score:1)
It's a game of roulette (Score:3, Interesting)
The problem with Encrypted media.. (Score:2)
Time for *actual* authentication (Score:5, Insightful)
It continues to astonish me that people think of "data theft" as the cause of identity theft.
Data theft is not the problem. The problem is that financial organizations are willing to accept transactions without authentication, or with very weak authentication. Supplying a 9-digit number which is a matter of public record is not a form of authentication. It does not prove that the person speaking is the account holder. Anybody can walk into a store with a fake credit card and buy stuff in my name, no questions asked. People can write checks with my account number on them, and it will be charged to my account. At no point is the slightest attempt made to authenticate the identity of the person making the transaction and certify that they are allowed to post transactions to the account.
There is no way to "plug" these leaks; most of these names and numbers are a matter of public record and must be surrendered in order to make a transaction in the first place. The identity theft problem will not abate until account holders have enhanced authentication options, and the financial institutions are required to use them. Biometrics, physical security tokens, PINs, it doesn't really matter what solution we use. We just need to use something to verify the identify of the person making the transaction. It's the only solution.
Re: (Score:2)
On the other hand, the examples you gave (credit card and cheque payments) aren't about authentication. They are about payment. I don't know why anybody (including myself) buying anything with m
Re: (Score:2)
I used credit card and check payment as examples of financial transactions that should require strong authentication, but it doesn't end there, of course. Opening accounts, getting loans, purchasing on credit (e.g. a car or furniture or whatever), etc. are all types of transactions that should be using better authentication methods.
However, and this was the point of my post, you don't have to be "careless with credit cards or checks" to get in trouble. All that is required to create a fake check is an acc
Re: (Score:2)
Perhaps, then, if these systems are so insecure, _any_ use you make of them is careless.
``How many people have an opportunity to memorize your
Re: (Score:2)
Many people, myself included, need the convenience that non-cash mechanisms provide. It'
Re: (Score:2)
That's what I did when I lived in the States. Now I live in the Netherlands. I pay w
Re: (Score:2)
The authentication is to make sure that the person spending
Re: (Score:2)
[Cash]
Authorization: The person holding the cash is authorized to spend it.
Authentication: None required. If someone hands you some cash that is sufficient authentication of their identity as 'the person holding some cash'.
[Cheques]
Authorization: Identity based; The individual in whose name the bank account was opened is authorized to spend the money.
Authentication: Possession of a blank cheque and the ability to sign it in a manner which closely resembles a s
Re: (Score:2)
All the card-based systems are migrating towards chip-based cards which should make it harder to create copies of them.
Migrating but failed. I got an American Express Blue card back in 2002 or so precisely because they offered a card with an embedded chip that is supposed to enhance security. They were supposed to issue a USB smart card reader to the card holders so they could swipe the card to make on-line purchases too.
The chip would be required for all purchases, but... to date, I have never seen the USB reader and the chip in my card has never been used. The advertised features silently disappeared from AMEX's mark
Thos who lose it don't bear the consequences (Score:3, Insightful)
Unless and until that changes, all the hand-wringing in the world won't make a hill of beans of difference.
It will take something like Sarbanes-Oxley, making the officers of companies and non-profits, and government workers, who handle our data personally criminally liable for failure to take due care, before there is any change. As it is now, it is a simple cost calculation, and security is pure cost. The people in charge are betting that they can cash in their stock options or get promoted/transferred before the failure to protect data causes a problem.
Last, but by no means least, everything that the naysayers said about Social Security when it was first proposed have come true: the SSID is a national ID number, and is routinely abused; and the Ponzi Scheme has run afoul of demographics. It's time to end the charade: outlaw the use of SSIDs by anyone except the SSA, and to allow people to opt out of SS.
I work for a web hosting company... (Score:3, Interesting)
Welcome to the modern internet (Score:1)
Oh, what a circus! (Score:1)
-no subject- (Score:1)
Theft or unauthorized access? (Score:2)
!Theft (Score:2)
/sarcasm
PEBKAC (Score:2, Insightful)
Instead of spending more on (company-side) tech there should be more spent on user-side education. Only those who've been a victim of identity theft and the paranoid (wa
Identity Theft, a Corporate Victory by Vocabulary (Score:5, Insightful)
At some point, someone changed the vocabulary, and now we call this "identify theft", and so we make the crime against the person who's name was forged. In fact, this person has nothing to do with this crime, and is an innocent bystander. The bank is charged with protecting my assets, and if they fail to do so, they should be liable, just as much as if someone walked into the bank with a gun and took it!
By convincing society at large that the crime is "identity theft" and not "fraud", the corporations, while not solving the problem of fraud, has made it someone else's problem; namely their customers. And the customers accept this, and direct their ire against the criminals, instead of against the company. (Admittedly the criminals are Bad People, so they do deserve to be feared and hated.)
In some ways, it is a stroke of genius by the corporate world. But not one that we should celebrate.
Re:Identity Theft, a Corporate Victory by Vocabula (Score:1)
My view is that they are criminals and we'll always have criminals. Therefore we need to protect ourselves from those who would take advantage of us by making those responsible for the problems pay for their failures, as you stated. When we pass a law that says that the corporate world and specifically banks are responsible for these breaches you will see things change practically overnight.
There are several other thing
BS^2 (Score:3)
No. IT security would be doing just fine if users and administrators protected themselves with existing security recommendations.
As long as people act like sheep they will be lambs to the slaughter.
when the lawyers come ... (Score:2)
Re: (Score:3, Informative)
Re: (Score:2, Redundant)
Re: (Score:2)
And by comparison, I've given up counting the posts that discuss these links. This is worse than a mailing list letting slip through a spam message, and seeing countless folks take the opportunity to offer as many off-topic comments.
Deleting a mailing list thread gone nuts is easy, but deleting Slashdot posts isn't an option. Put another way, it's easy to ignore AC posts, off-topic posts (they tend to get modded down fairly quickl
Re: (Score:2)
I've really had it with the myminicity.com crowd, and to put a stop to this nonsense I've set up a little website. [screwmyminicity.com]
Stop posting your myminicity links here and elsewhere, if myminicity.com wants to grow they can surely find a way to do it without inconveniencing others.
If you don't then I'm calling on the rest of the audience here to report those links to the site above and if they want to help a little further to place a 1 pixel image tag on their website which