For years, I've been trying my best to stay low-key when it comes to my personal information on the internet. I don't create new accounts, I never cross-login with my email address, I don't use phones. Certainly not perfect, but a lot of times I'm preferring privacy over convenience.
At the same time, my government and society at large is pushing more and more for "digital everything". It's great when it works. But to me, every new service translates to a new opportunity for my data to be leaked.
I think one reason why we're still seeing so many breaches is that security is hard and thus expensive - and on the other hand, other than customer push-back, companies or other providers have pretty much nothing to worry about when their data gets extorted. To me, this is impossible. When I give my private data to them, I'm giving them something very valuable. If being careless with that value basically has no consequences, the incentives to care are low.
We need to establish measures of accountability for data holders. Not securing customer data appropriately needs to be persecutable, and the affected parties need to be given a right for compensation. Of course, that's not going to happen. It would be difficult to implement in practice, if at all possible. But as long as there is no monetary incentive for data holders to be as careful as possible, the laxness is going to continue.
>We need to establish measures of accountability for data holders. Not securing customer data appropriately needs to be persecutable, and the affected parties need to be given a right for compensation.
The ultimate entity that could hold businesses accountable is the government but the government itself is careless with citizens' private data.
My "compensation" for my data being leaked was 1 year of free credit monitoring. But obviously, criminals interested in identity theft will continue their attacks after 1 year.
As far as persecution/prosecution, I suppose Katherine Archuleta, the director of OPM, and the CIO, Donna Seymour ... could have been put in prison as punishment instead of just resigning. I don't think that would change anything. There will still be future scenarios where governments want more collection of private data. Flock cameras, TSA airport scans, internet access age-verification face scans, etc.
> The ultimate entity that could hold businesses accountable is the government but the government itself is careless with citizens' private data.
Let's not forget the largest data breach in US history by Elon Musk and his DOGE kids.
It’s a double whammy in places like India where “digital push” means everything is based on your mobile number with worst of safety and regulation the planet has to offer. Push is 100%, safeguards zero (if not negative).
What makes it even worse is every policy and regulation push is just talk on paper and even it succeeds and comes in effect, it essentially stays at where it was — zero power to the people, zero accountability to others, and negative punishment to the offenders (they are not even considered offenders). There are no legal frameworks like a class action lawsuit either. As in, when you look beyond “paper regulators” (and won’t have to look hard) there is nothing at all, practically speaking.
The thing is you can’t fight it, and you really can’t opt out. Not here. It feels kafkaesque, you don’t even speak up because 90% or more of your compatriots will wonder what the hell you are on about, if you are lucky enough to be not labelled an anti-national.
The issue is how easy computers make everything, and how well processes scale with computers. Back in the day to heist data you'd have to physically break in or infiltrate, rummage through files, copy them somehow or just straight up take them. In a briefcase?? How many files can you exfiltrate per day like that?
But on a database it's practically a matter of running a copy command and uploading it or exfiltrating it. And there will always be software vulnerabilities.
Computer processes have no inherent rate limiter to them, and they even allow you to run stuff from a distance.
> . I don't create new accounts, I never cross-login with my email address
I honestly tend to think this is the only viable long term strategy.
Let's face it: In a truly global internet where every single forum or website is hosted in a different country with a different jurisdiction, hoping that every single actor will act responsibly is just delusional.
It is not what we see. It is not happening and it is not going to happen.
Individual need to have right to online privacy.
That's means the right to get proxy email address, proxy phone number, proxy physical address and even proxy identity (first name/family name).
The sooner the governments will accept that, the better.
If done right, it is not incompatible with a system where identities can be reconstructed by the authorities for legal actions.
If nothing is done, scams and blackmails will continue to spread like bushfire and proxies anonymity will happen anyway outside of any control.
Is the alternative just accepting that my data is out there? Even if I never used any online service, there are databases out there with my information anyway.
Just figure anything online that you aren't securing yourself is compromised. Minimize the effect that has on your life. Identify theft is annoying, but it rarely has severe effects.
You will have to go out of your way to be truly anonymous online, and it might be impossible if you aren't tech savvy enough. Otherwise, just assume everything you do online is public and act accordingly.
> Identify theft is annoying, but it rarely has severe effects.
I disagree. It has already severe effects.
- The fact we are facing so many data leaks made easy for malicious agent to cross and mix data sources and setup much more evolved and convincing scam scheme.
It is now trivial to get name, address, birthday and phone number from a data leak and crossed check that with the login id (email) used for lets say, a financial service and setup a convincing phone scam on that.
Many dubious actors are already doing that. One acquaintance of mine (working in ITsec ironically) got trapped by this exact scheme last week.
- It is trivial to harvest data leaks for online telemarketing, robot calls and any other abusing commercial practices.
- We are heading to a situation where any wierdo or/and stalker with a bit of tech knowhow can rather trivially extract a physical address out of an online profile. That is a giant opened door for harassment and physical insecurity for the most vulnerable of us.
Thats not just "nerd concerns" and the strategy "everything you do online is public" does not work. Many website will request my personal physical address for trivial matters like billing or delivery. That can not under any mean be considered public data.
> Many website will request my personal physical address for trivial matters like billing or delivery.
Some will even require it for no actual reason at all.
Do I need to give my living address when I buy a sandwich? Then why would I need to when buying an online service?
Similarly, fast foods nearly all have these automated kiosques. They don’t need any info. So why do they require an email address when ordering to the table through the app, while in the restaurant?
They don’t need them. They just demand them because they can and everyone online is used to giving them without a second thought.
I can’t wait for personal data to become digital radioactive waste.
> Otherwise, just assume everything you do online is public and act accordingly.
This is such a depressing reality. It's also what governments want you to believe. If you aren't able to speak your mind about anything anonymously, then you won't be able to, say, spread ideas that go against them.
Admitting defeat at all and not even trying to teach people about privacy results in the "I don't care, what's the point?" attitude that plagues many people today.
> If done right, it is not incompatible with a system where identities can be reconstructed by the authorities for legal actions.
Doing it right is exactly the thing that makes this impossible. If instead you give everyone a unique barcode that every other pseudonym can be tied back to, do you really think that database will never be breached? It would become the prime target for all attackers in the world.
Meanwhile reconstructing "identities" is the least valuable thing to doing law enforcement well, because the first thing criminals will do is use someone else's identity, and then tying something to the wrong identity isn't just useless, it's actively counterproductive. The thing you need is not centralized identity but proper investigations that can tie some activity to the person pulling the strings regardless of whose name they're using.
The thing centralized identity does is precisely the opposite -- it leads you to person associated with a name, often the wrong person. You want to get the person offering to do murder for hire to think they have a contract and show up somewhere you can arrest them regardless of whether you know their name, not to convict the person whose identity they stole.
> Doing it right is exactly the thing that makes this impossible. [...] do you really think that database will never be breached? It would become the prime target for all attackers in the world.
Critical data is always better in the hand of a few (trustable) than in the hands of many.
That is currently the exact reason why you are using Paypal instead of giving your credit card number to everybody.
That is the exact reason why you are using a password manager.
A lot about security is about who you trust, and for how long.
I don't use Paypal. My credit cards protect me from fraud. And it rarely happens. In fact it's been well over a decade since I had a fraudulent charge on any of my payment cards. Funny how when there's motivation, protection happens.
If a business legitimately needs such information to operate, isn't it borderline impossible to 100% prevent it from leaking? If the data is there, it can be compromised either by technical means or non-technical means.
The primary issues in my opinion are (1) businesses collecting and holding on to information they don't need and (2) businesses getting so large that they become prime targets by default.
In a world where pointless data collection was disincentivized and there were many small businesses instead of a few large ones, this problem would be much more localized and addressable. But of course this is a dream within a dream.
I'd also add a third issue to this list: data retention. Too many companies I've dealt with have privacy policies that state something to the tune of "we'll hold onto your data for as long as required" without giving much of an explanation as to how long "as required" is.
Which usually means until the financial incentives to remove the data outweigh the incentives to keep the data. Data is more valuable than database storage costs, thus there is no incentive to remove the data. Policies should therefore be in place to punish unnecesary data retention.
There is a vast difference between it not being 100% impossible and data holders not doing the absolute basics to keep it safe.
I could imagine if, after a data breach, there was a government-run cyber investigative task force that would come into an organization, and be tasked with investigating and fully understanding the nature of the breach. We already have forensic detectives for other crimes, why not this one?
And if it turns out that the failure occurred due to the company acting negligently, a la (whoopsie all the records were in an open S3 bucket) then humans would be found personally liable.
--
But in principle, i also agree with the other causes you list. These are very much what GDPR was aimed at improving. It really is a shame when you look at what GDPR could have accomplished if not for malicious compliance by American tech giants, and shitty enforcement (instigated by American tech giants)
It doesn't even need to be government-run, we just need the right incentives. I've seen proposals for making some kind of data loss insurance mandatory to compensate victims. The insurance companies would then conduct audits which determine the premiums for the company, and investigate for negligence after a breach.
Edit: Thinking more about it, this would probably also be positive for security investigators. If a company is stonewalling you and ignoring a legitimate bug report, you now have the option to escalate this to the insurer. Maybe they could even facilitate bug bounty programs for smaller companies
I've had a similar thought in the past. I was thinking about the feasibility of a law being introduced where each company making over a certain amount of money per year must begin a VDP (and optionally a BBP) so that security flaws can be reported to them easily. This can easily be done by simply opening up security@companydomain and using security.txt (https://securitytxt.org). Reports must receive a response in N days, where N is calculated based on available staff, resource allocation, and revenue of the company. If they don't receive a response after N days, this can be escalated to some government agency which can take action against the company for failing to respond to a report on time.
If something like this had been implemented 20 years ago, we'd probably be exactly where we are now. What's the point?
Small businesses are equally vulnerable, and it's possibly to perform cyber attacks at scale - Gen AI makes this easier
>We need to establish measures of accountability for data holders
This is true, and it needs to change. The incentives are warped right now, as a decent chunk of global GDP traces itself back to ad tech.
Let's not persecute anyone.
So at the risk of sounding incredibly apathetic toward something that I'm sure is probably a massive headache for some people somewhere...
I'm a millennial and I've been told probably hundreds of times by this point in my life that my data has been breached. Not a single one of those times was there a) anything truly actionable for me to do about it[0] or b) a single negative impact to my actual life. In anyway. At all.
People were talking about the Equifax breach a decade ago like identity theft was going to become an absolutely routine part of daily life for +90% of people. That didn't happen, at least not for me.
My point is: I understand that this is a topic that nerd communities like HN are well-aligned on—data collection bad, data breach bad, I get it. But does it actually matter?
Every single one of us have had our data harvested by tech giants every second of every day for absolutely decades and neither I nor a single person I know in real life have ever had any negative consequences, either because of the collection itself or from the inevitable and seemingly continuous breaching of that data. Every single website, from the random indie shoe website I purchased from one time to multiple health insurance companies, have breached my data, over the span of decades, and from all appearances it has had absolutely zero effect that I can actually point to in real actual life.
So I'm becoming a bit of a skeptic on this item of quasi-religious dogma that y'all all seem to recite the same position on. Does the emperor perhaps have no clothes? Do we all just fear "data breaches" because we've been told to fear them by people who sounded smarter than us?
I need y'all to hit me with some scary anecdata about what happened to your hairdresser's cousin's ex-husband's dog—anecdata with no citation that I obviously can't even verify isn't hallucinated by a GPT, but should clearly accept as valid because "ooooh data breach bad"—because without that the propaganda patina on my brain is wearing a little thin.
[0] (I use a password manager to guarantee that I'm not sharing passwords between logins, so really the only thing I could do in response to a data breach disclosure is rotate the password on the breached account. But that only matters if they were storing my password in plaintext right? I certainly can't do anything about my data being out there, and it's too late for closing that account out to prevent anything.)
I found I had exactly that issue ~3 months ago. A particular government department had their systems hacked and 1 of my email addresses became public along with 10s of thousands of other users. That in itself was bad enough except that this particular department had known about the breach about 2 months earlier and to make matters worse they had not been aware that the breach had occurred back in June 2025.
<We need to establish measures of accountability for data holders. Not securing customer data appropriately needs to be prosecutable, and the affected parties need to be given a right for compensation>
I 100% agree with you here. The trouble is, the government which are often the ones to push for major court-issued penalties when corporations stuff up, don't want to be held to the same level of scrutiny and penalty. Go figure
As usual, the answer is never "collect less data."
That's the only sensible approach. It's the one that I use, but then, I care about the users of my software, and I don't make any money from their PII.
These days I treat other people's data like it's a live hand grenade. Case in point (bit of a shameless plug here :) I'm working on an App called Hockeytastic. It's an ice-hockey stickhandling app that my son's been using for months: the engine is solid but it looked like shit. However, his coach told me to get it on the app stores and sell subs. That meant I needed to clean it up, build a DB, store stuff etc.
Anyway, working with Google and Apple I realised that I quite literally do not need to store anything identifiable. The only identifier I store is the Apple id and the Google id and unless you steal those and then hack Google and Apple, they are utterly useless.
I do not store emails, names, addresses, nothing. That's the way I want it.
If the data is ever breached, the only thing hackers will see are many many instances of Connor McDavid, Nate Mckinnon and various other famous NHL player names :)
If more companies treated personal data like it was toxic, we'd have less issues with breaches, however, I see it in my day job where the marketing people want to take as much data as possible, all the time!
I wish that were the case, but because of there being barely any consequences for breaches, it's much more profitable to store everything you can and sell it to the highest bidder. Make it a huge risk to store data, then companies will start treating data like a live hand grenade.
That's exactly what the GDPR tried. If only it was properly enforced
Companies can and do get away with arguing that they have a "lawful basis" to collect whatever data they'd like. It's unfortunate.
IANAL, but the law seems a bit vague to me, and it appears that companies use that vagueness to their advantage. Maybe I'm just not articulating my arguments correctly.
Even if you have a lawful basis for collecting data, in theory the GDPR is in theory restricting you to only use it for that basis, delete it as soon as you don't need it anymore, have a plan on how to store and handle it, and requires you to follow best practices when doing so. Backups, encryption, regularly testing the technical and organizational measures that protect the data are in theory all mandated. Also, on the topic of this post, notification of data breaches when they occur
But enforcement is just laughable. Even on easy to observe issues like which data is collected
Why does the app need to store the google/apple Id? Because it stores the data in the cloud, instead of locally for the app to use?
It's for your login and payments. I need to verify that you are authenticated somehow and Google/Apple also handle payments.
You "Login with Apple" or "Login with Google". They manage the login entirely and pass me your id and an access token (assuming you pass their login test). I store that in my DB so that your data from the app can sync (the paid-for app syncs your training data to my backend but I match it only based on the Google/Apple id.)
The alternative is that I build my own auth system and I'd need to store something you can type in the next time, e.g. email/password address etc.
If you have an Android/Apple phone you're already authenticated with them. I just need Google/Apple to say "this guy is cool, let him in" and I then use the id to check if you've paid, sync your training data etc.
On its own, the id is useless! Means nothing and cannot be traced back to a person. I genuinely do not know your name, email, what country you come from, GPS data, CC data. Nothing at all!
I don't want your data.
Is there ANY business motivation for any corporation to open such information up sooner than later?
Depends where they are in the world. I _think_ GDPR would be a good enough business reason, as they set a ticking clock of 72 hours from the breach to notifying individuals who are in the breach. And the fines involved are pretty steep (almost effing vertical for some).
A minor problem with GDPR is enforcement.
At least in germany it feels like you need a very dedicated and persistent person to make the case against a company/service (bonus points if they get media attention). Other countries are a bit better but it generally is not very consistent.
The enforcement for most small to mid-sized companies is often just not present and resources for relevant agencies are often only reluctantly allocated. Ime, in government institutions it is generally not very respected as it "impedes progress".
At least there is the very dedicated and persistent https://noyb.eu :)
[dead]
For tech B2B companies where the founders or executive team hold the majority stake in the organisation, yes. A failure to disclose or respond when there is a public notice on an .onion address, or a sample set of your customer data has been published online, creates tangible, direct commercial impact.
You should expect every deal in your pipeline to stall. Your product and company will be flagged by every GRC team, and every stakeholder trying to purchase your product will suddenly need to go to risk committees, or into meetings with CISOs, CTOs, and founders, to explain why buying from you is worth the risk compared to competitors who have not been breached.
If you have not addressed the issue, it becomes a literal deal-breaker. The sooner you write the press release, notify customers, and deal with the underlying problems, the sooner you can turn the incident into a credible story about how you responded, contained it, and improved.
If you do not respond, or you deny it, your deals are dead.
The reason I prefaced this with companies where the founders or executive team hold a majority stake is that I sincerely do not believe the same incentives do not exist for most other companies. The stock price is not meaningfully impacted by incidents like this; it is more affected by vibes, market conditions, and the general tech economy. There are a hundred things that will move the stock price before cybersecurity and data incidents do.
Operating revenue and profit, however, will be impacted. Executives on a death march for growth, who understand that an incident like this can wipe away a year of progress (and essentially their life's work), are far more likely to take it seriously. They are directly exposed to the commercial consequences.
The companies you see trying to sweep this under the rug, or outright ignore it, are usually one of two things.
1. They are so out of touch with their customers that they would rather listen to a lawyer chasing the “ideal legal-risk outcome” than pursue the best financial, customer and cybersecurity risk outcome. In my experience these are executives who are independently wealthy or already come from wealth, and their priority is simply keeping the status quo.
2. They are simply not incentivised to deal with it properly (carrot, nor stick). That is: they don't lose their bonus, they don't face the axe, and they aren't rewarded for doing anything "well" in response to it. They might say they're "inherently" exposed because if the business is impacted, so are they (stock price, performance bonuses) -- but that's incredibly disingenuous, as it's pretty much always not a material difference to them.
For B2C or B2B doing "traditional" stuff? No. The incentive simply just isn't there.
GDPR, CCPA, whatever, hasn't moved the dial.
I have a custom domain for my emails with catch all. When I create an account somewhere I just use <name of the service>@my-domain.com
Can I find out if any of my emails are in leaks with a service somewhere?
For me, with a similar wildcard setup, it became something I wasn't willing to spend money on. I work on the basis that accounts are compromised and if the company is large enough I'll see it in the news. Strong passwords, and a password-database is the best I can manage.
You don't, you can register a whole domain and it'll work.
One by one, but I think the question is about the entire domain name
You can have haveibeenpwned.com check for the custom domain itself. For instance, I get notified if any email of our family domain get leaked (not just mine).
If you sign in that's an option on your dashboard. You need an account because you need to verify the domain is yours
At this stage just expect that every accounts will get leaked or rooted, it's a matter of when, not if...
Use varying email `plus addressing` (john+am2604@foo.com), varying passwords or passkey and 2FA on anything remotely important (use of your identity, not just financials).
I recommend people use proper email aliasing, not plus addressing. Duckduckgo makes a free one that's can integrate into Bitwarden, if you have iCloud+ Apple's($0.99/month) hide my email is good. Addy.io and SimpleLogin are the best and allow PGP encryption to prevent another party having access to your emails, but they are paid for full features.
> Organizations like the IAB require that advertisers normalize email addresses so that they can be correlated and tracked, regardless of users' privacy wishes.
One time I clicked "I forgot my password" on a website and they e-mailed me my password.
Ever since I don't trust online services.
[deleted]
Plus addressing doesn't work well unfortunately - lots of poorly written websites will reject it.
+1 for not giving those websites your email in the first place!
The + trick is useless to protect you, obviously. Instead, use a a service like simplelogin to create unique emails for every place you sign in.
Correct, but you get to see who leaked you.
Depends if the criminals are smart enough to strip the +.. part when sending you phishing.
Not to spoil the surprise but it will get much MUCH worse. Reason: sloppers. Anyone who's dealt with security and has looked into how all the slop agents work can understand how catastrophic it is from a security perspective. The "yes" button on "I trust the authors" is what unlocks the gates of hell.
>why is it still needed?
It's not needed. There are already alternatives that could take its place. Some of them are able to actually show you what data leaked instead of leaving you blind of what was actually included in the breach.
I don't think he meant "show the actual data," I think he meant "what leaked? My name, address, phone number, email, medical records, payment history, bank account number?"
We get a "your private data is now public" email, but knowing exactly what data turns that from a depressing statement on how much corporations value their customers' privacy into something actionable.
Yes, I meant the actual data so you know what leaked. There is a difference between leaking a password 12345678 and leaking a password that was reused on a different site. There is a difference between leaking your actual birthday and leaking 01/01/1900. There is a difference between leaking a fake address, your previous address, and your current address.
>Most breaches already contain hashed passwords
It could show the hash instead.
>No, it's not ok that these passwords are already out there
So it's better that people have to pay for it instead of getting this information for free?
>Because it's important to say "I don't store passwords in HIBP"
This is a personal choice.
>I'm not your personal lookup service
The idea is that this would be done by the site itself and would not require manual work by the owner.
Hashes can be cracked, and end users won't understand how to create password hashes to check which one was leaked. Plus, salts exist.
Passwords shouldn't matter anyways. Use a password manager and be done with it. The real issue is metadata which can't easily be changed - phone numbers, addresses, and the like. If any of that data is leaked, it becomes much harder to contain impact. You can't move addresses every time your address gets leaked online.
Can you give examples of these alternatives?
I use Snusbase (https://snusbase.com). They've been around since around 2016 and haven't had any issues legally - they're the longest-standing data breach search engine besides HIBP, as far as I know.
(This is not an advertisement.)
there will be more data breaches.
Google and Apple are throttling hotfix updates (for app developers) as tons of code pushes to their infra (by vibe coders) is straining their system.
The are fixing this by throttling updates to minimum 3 days review period.
so good luck fixing the vulnerability or data leaks in your apps.
I am not sure I get the connection between AI code holding up review processes and data breaches.
The post made a pretty clear claim, I thought: the volume of apps being sent through is so extreme that they can't keep up with their review process.
Dont worry the vibecoders will tire out, they're the same people who were making NFTs and mining bitcoin, they'll move onto the next hot thing soon enough. Its more an archetype, not necessarily the same exact people. They dont commit long term.
This indeed. They are the "type of guy type of guys", always drifting to next big thing®
I wonder whats next, I feel it might be a huge swing of the pendulum next.
For years, I've been trying my best to stay low-key when it comes to my personal information on the internet. I don't create new accounts, I never cross-login with my email address, I don't use phones. Certainly not perfect, but a lot of times I'm preferring privacy over convenience.
At the same time, my government and society at large is pushing more and more for "digital everything". It's great when it works. But to me, every new service translates to a new opportunity for my data to be leaked.
I think one reason why we're still seeing so many breaches is that security is hard and thus expensive - and on the other hand, other than customer push-back, companies or other providers have pretty much nothing to worry about when their data gets extorted. To me, this is impossible. When I give my private data to them, I'm giving them something very valuable. If being careless with that value basically has no consequences, the incentives to care are low.
We need to establish measures of accountability for data holders. Not securing customer data appropriately needs to be persecutable, and the affected parties need to be given a right for compensation. Of course, that's not going to happen. It would be difficult to implement in practice, if at all possible. But as long as there is no monetary incentive for data holders to be as careful as possible, the laxness is going to continue.
>We need to establish measures of accountability for data holders. Not securing customer data appropriately needs to be persecutable, and the affected parties need to be given a right for compensation.
The ultimate entity that could hold businesses accountable is the government but the government itself is careless with citizens' private data.
I underwent a government required background check to get a security clearance and my data was stolen: https://en.wikipedia.org/wiki/2015_Office_of_Personnel_Manag...
My "compensation" for my data being leaked was 1 year of free credit monitoring. But obviously, criminals interested in identity theft will continue their attacks after 1 year.
As far as persecution/prosecution, I suppose Katherine Archuleta, the director of OPM, and the CIO, Donna Seymour ... could have been put in prison as punishment instead of just resigning. I don't think that would change anything. There will still be future scenarios where governments want more collection of private data. Flock cameras, TSA airport scans, internet access age-verification face scans, etc.
> The ultimate entity that could hold businesses accountable is the government but the government itself is careless with citizens' private data.
Let's not forget the largest data breach in US history by Elon Musk and his DOGE kids.
It’s a double whammy in places like India where “digital push” means everything is based on your mobile number with worst of safety and regulation the planet has to offer. Push is 100%, safeguards zero (if not negative).
What makes it even worse is every policy and regulation push is just talk on paper and even it succeeds and comes in effect, it essentially stays at where it was — zero power to the people, zero accountability to others, and negative punishment to the offenders (they are not even considered offenders). There are no legal frameworks like a class action lawsuit either. As in, when you look beyond “paper regulators” (and won’t have to look hard) there is nothing at all, practically speaking.
The thing is you can’t fight it, and you really can’t opt out. Not here. It feels kafkaesque, you don’t even speak up because 90% or more of your compatriots will wonder what the hell you are on about, if you are lucky enough to be not labelled an anti-national.
The issue is how easy computers make everything, and how well processes scale with computers. Back in the day to heist data you'd have to physically break in or infiltrate, rummage through files, copy them somehow or just straight up take them. In a briefcase?? How many files can you exfiltrate per day like that?
But on a database it's practically a matter of running a copy command and uploading it or exfiltrating it. And there will always be software vulnerabilities.
Computer processes have no inherent rate limiter to them, and they even allow you to run stuff from a distance.
> . I don't create new accounts, I never cross-login with my email address
I honestly tend to think this is the only viable long term strategy.
Let's face it: In a truly global internet where every single forum or website is hosted in a different country with a different jurisdiction, hoping that every single actor will act responsibly is just delusional.
It is not what we see. It is not happening and it is not going to happen.
Individual need to have right to online privacy.
That's means the right to get proxy email address, proxy phone number, proxy physical address and even proxy identity (first name/family name).
The sooner the governments will accept that, the better.
If done right, it is not incompatible with a system where identities can be reconstructed by the authorities for legal actions.
If nothing is done, scams and blackmails will continue to spread like bushfire and proxies anonymity will happen anyway outside of any control.
Is the alternative just accepting that my data is out there? Even if I never used any online service, there are databases out there with my information anyway.
Just figure anything online that you aren't securing yourself is compromised. Minimize the effect that has on your life. Identify theft is annoying, but it rarely has severe effects.
You will have to go out of your way to be truly anonymous online, and it might be impossible if you aren't tech savvy enough. Otherwise, just assume everything you do online is public and act accordingly.
> Identify theft is annoying, but it rarely has severe effects.
I disagree. It has already severe effects.
- The fact we are facing so many data leaks made easy for malicious agent to cross and mix data sources and setup much more evolved and convincing scam scheme.
It is now trivial to get name, address, birthday and phone number from a data leak and crossed check that with the login id (email) used for lets say, a financial service and setup a convincing phone scam on that.
Many dubious actors are already doing that. One acquaintance of mine (working in ITsec ironically) got trapped by this exact scheme last week.
- It is trivial to harvest data leaks for online telemarketing, robot calls and any other abusing commercial practices.
- We are heading to a situation where any wierdo or/and stalker with a bit of tech knowhow can rather trivially extract a physical address out of an online profile. That is a giant opened door for harassment and physical insecurity for the most vulnerable of us.
Thats not just "nerd concerns" and the strategy "everything you do online is public" does not work. Many website will request my personal physical address for trivial matters like billing or delivery. That can not under any mean be considered public data.
> Many website will request my personal physical address for trivial matters like billing or delivery.
Some will even require it for no actual reason at all.
Do I need to give my living address when I buy a sandwich? Then why would I need to when buying an online service?
Similarly, fast foods nearly all have these automated kiosques. They don’t need any info. So why do they require an email address when ordering to the table through the app, while in the restaurant?
They don’t need them. They just demand them because they can and everyone online is used to giving them without a second thought.
I can’t wait for personal data to become digital radioactive waste.
> Otherwise, just assume everything you do online is public and act accordingly.
This is such a depressing reality. It's also what governments want you to believe. If you aren't able to speak your mind about anything anonymously, then you won't be able to, say, spread ideas that go against them.
Admitting defeat at all and not even trying to teach people about privacy results in the "I don't care, what's the point?" attitude that plagues many people today.
> If done right, it is not incompatible with a system where identities can be reconstructed by the authorities for legal actions.
Doing it right is exactly the thing that makes this impossible. If instead you give everyone a unique barcode that every other pseudonym can be tied back to, do you really think that database will never be breached? It would become the prime target for all attackers in the world.
Meanwhile reconstructing "identities" is the least valuable thing to doing law enforcement well, because the first thing criminals will do is use someone else's identity, and then tying something to the wrong identity isn't just useless, it's actively counterproductive. The thing you need is not centralized identity but proper investigations that can tie some activity to the person pulling the strings regardless of whose name they're using.
The thing centralized identity does is precisely the opposite -- it leads you to person associated with a name, often the wrong person. You want to get the person offering to do murder for hire to think they have a contract and show up somewhere you can arrest them regardless of whether you know their name, not to convict the person whose identity they stole.
> Doing it right is exactly the thing that makes this impossible. [...] do you really think that database will never be breached? It would become the prime target for all attackers in the world.
Critical data is always better in the hand of a few (trustable) than in the hands of many.
That is currently the exact reason why you are using Paypal instead of giving your credit card number to everybody.
That is the exact reason why you are using a password manager.
A lot about security is about who you trust, and for how long.
I don't use Paypal. My credit cards protect me from fraud. And it rarely happens. In fact it's been well over a decade since I had a fraudulent charge on any of my payment cards. Funny how when there's motivation, protection happens.
If a business legitimately needs such information to operate, isn't it borderline impossible to 100% prevent it from leaking? If the data is there, it can be compromised either by technical means or non-technical means.
The primary issues in my opinion are (1) businesses collecting and holding on to information they don't need and (2) businesses getting so large that they become prime targets by default.
In a world where pointless data collection was disincentivized and there were many small businesses instead of a few large ones, this problem would be much more localized and addressable. But of course this is a dream within a dream.
I'd also add a third issue to this list: data retention. Too many companies I've dealt with have privacy policies that state something to the tune of "we'll hold onto your data for as long as required" without giving much of an explanation as to how long "as required" is.
Which usually means until the financial incentives to remove the data outweigh the incentives to keep the data. Data is more valuable than database storage costs, thus there is no incentive to remove the data. Policies should therefore be in place to punish unnecesary data retention.
There is a vast difference between it not being 100% impossible and data holders not doing the absolute basics to keep it safe.
I could imagine if, after a data breach, there was a government-run cyber investigative task force that would come into an organization, and be tasked with investigating and fully understanding the nature of the breach. We already have forensic detectives for other crimes, why not this one?
And if it turns out that the failure occurred due to the company acting negligently, a la (whoopsie all the records were in an open S3 bucket) then humans would be found personally liable.
--
But in principle, i also agree with the other causes you list. These are very much what GDPR was aimed at improving. It really is a shame when you look at what GDPR could have accomplished if not for malicious compliance by American tech giants, and shitty enforcement (instigated by American tech giants)
It doesn't even need to be government-run, we just need the right incentives. I've seen proposals for making some kind of data loss insurance mandatory to compensate victims. The insurance companies would then conduct audits which determine the premiums for the company, and investigate for negligence after a breach.
Edit: Thinking more about it, this would probably also be positive for security investigators. If a company is stonewalling you and ignoring a legitimate bug report, you now have the option to escalate this to the insurer. Maybe they could even facilitate bug bounty programs for smaller companies
I've had a similar thought in the past. I was thinking about the feasibility of a law being introduced where each company making over a certain amount of money per year must begin a VDP (and optionally a BBP) so that security flaws can be reported to them easily. This can easily be done by simply opening up security@companydomain and using security.txt (https://securitytxt.org). Reports must receive a response in N days, where N is calculated based on available staff, resource allocation, and revenue of the company. If they don't receive a response after N days, this can be escalated to some government agency which can take action against the company for failing to respond to a report on time.
If something like this had been implemented 20 years ago, we'd probably be exactly where we are now. What's the point?
Small businesses are equally vulnerable, and it's possibly to perform cyber attacks at scale - Gen AI makes this easier
>We need to establish measures of accountability for data holders
This is true, and it needs to change. The incentives are warped right now, as a decent chunk of global GDP traces itself back to ad tech.
Let's not persecute anyone.
So at the risk of sounding incredibly apathetic toward something that I'm sure is probably a massive headache for some people somewhere...
I'm a millennial and I've been told probably hundreds of times by this point in my life that my data has been breached. Not a single one of those times was there a) anything truly actionable for me to do about it[0] or b) a single negative impact to my actual life. In anyway. At all.
People were talking about the Equifax breach a decade ago like identity theft was going to become an absolutely routine part of daily life for +90% of people. That didn't happen, at least not for me.
My point is: I understand that this is a topic that nerd communities like HN are well-aligned on—data collection bad, data breach bad, I get it. But does it actually matter?
Every single one of us have had our data harvested by tech giants every second of every day for absolutely decades and neither I nor a single person I know in real life have ever had any negative consequences, either because of the collection itself or from the inevitable and seemingly continuous breaching of that data. Every single website, from the random indie shoe website I purchased from one time to multiple health insurance companies, have breached my data, over the span of decades, and from all appearances it has had absolutely zero effect that I can actually point to in real actual life.
So I'm becoming a bit of a skeptic on this item of quasi-religious dogma that y'all all seem to recite the same position on. Does the emperor perhaps have no clothes? Do we all just fear "data breaches" because we've been told to fear them by people who sounded smarter than us?
I need y'all to hit me with some scary anecdata about what happened to your hairdresser's cousin's ex-husband's dog—anecdata with no citation that I obviously can't even verify isn't hallucinated by a GPT, but should clearly accept as valid because "ooooh data breach bad"—because without that the propaganda patina on my brain is wearing a little thin.
[0] (I use a password manager to guarantee that I'm not sharing passwords between logins, so really the only thing I could do in response to a data breach disclosure is rotate the password on the breached account. But that only matters if they were storing my password in plaintext right? I certainly can't do anything about my data being out there, and it's too late for closing that account out to prevent anything.)
I found I had exactly that issue ~3 months ago. A particular government department had their systems hacked and 1 of my email addresses became public along with 10s of thousands of other users. That in itself was bad enough except that this particular department had known about the breach about 2 months earlier and to make matters worse they had not been aware that the breach had occurred back in June 2025.
<We need to establish measures of accountability for data holders. Not securing customer data appropriately needs to be prosecutable, and the affected parties need to be given a right for compensation>
I 100% agree with you here. The trouble is, the government which are often the ones to push for major court-issued penalties when corporations stuff up, don't want to be held to the same level of scrutiny and penalty. Go figure
As usual, the answer is never "collect less data."
That's the only sensible approach. It's the one that I use, but then, I care about the users of my software, and I don't make any money from their PII.
These days I treat other people's data like it's a live hand grenade. Case in point (bit of a shameless plug here :) I'm working on an App called Hockeytastic. It's an ice-hockey stickhandling app that my son's been using for months: the engine is solid but it looked like shit. However, his coach told me to get it on the app stores and sell subs. That meant I needed to clean it up, build a DB, store stuff etc.
Anyway, working with Google and Apple I realised that I quite literally do not need to store anything identifiable. The only identifier I store is the Apple id and the Google id and unless you steal those and then hack Google and Apple, they are utterly useless.
I do not store emails, names, addresses, nothing. That's the way I want it.
If the data is ever breached, the only thing hackers will see are many many instances of Connor McDavid, Nate Mckinnon and various other famous NHL player names :)
If more companies treated personal data like it was toxic, we'd have less issues with breaches, however, I see it in my day job where the marketing people want to take as much data as possible, all the time!
I wish that were the case, but because of there being barely any consequences for breaches, it's much more profitable to store everything you can and sell it to the highest bidder. Make it a huge risk to store data, then companies will start treating data like a live hand grenade.
That's exactly what the GDPR tried. If only it was properly enforced
Companies can and do get away with arguing that they have a "lawful basis" to collect whatever data they'd like. It's unfortunate.
IANAL, but the law seems a bit vague to me, and it appears that companies use that vagueness to their advantage. Maybe I'm just not articulating my arguments correctly.
Even if you have a lawful basis for collecting data, in theory the GDPR is in theory restricting you to only use it for that basis, delete it as soon as you don't need it anymore, have a plan on how to store and handle it, and requires you to follow best practices when doing so. Backups, encryption, regularly testing the technical and organizational measures that protect the data are in theory all mandated. Also, on the topic of this post, notification of data breaches when they occur
But enforcement is just laughable. Even on easy to observe issues like which data is collected
Why does the app need to store the google/apple Id? Because it stores the data in the cloud, instead of locally for the app to use?
It's for your login and payments. I need to verify that you are authenticated somehow and Google/Apple also handle payments.
You "Login with Apple" or "Login with Google". They manage the login entirely and pass me your id and an access token (assuming you pass their login test). I store that in my DB so that your data from the app can sync (the paid-for app syncs your training data to my backend but I match it only based on the Google/Apple id.)
The alternative is that I build my own auth system and I'd need to store something you can type in the next time, e.g. email/password address etc.
If you have an Android/Apple phone you're already authenticated with them. I just need Google/Apple to say "this guy is cool, let him in" and I then use the id to check if you've paid, sync your training data etc.
On its own, the id is useless! Means nothing and cannot be traced back to a person. I genuinely do not know your name, email, what country you come from, GPS data, CC data. Nothing at all!
I don't want your data.
Is there ANY business motivation for any corporation to open such information up sooner than later?
Depends where they are in the world. I _think_ GDPR would be a good enough business reason, as they set a ticking clock of 72 hours from the breach to notifying individuals who are in the breach. And the fines involved are pretty steep (almost effing vertical for some).
A minor problem with GDPR is enforcement.
At least in germany it feels like you need a very dedicated and persistent person to make the case against a company/service (bonus points if they get media attention). Other countries are a bit better but it generally is not very consistent.
The enforcement for most small to mid-sized companies is often just not present and resources for relevant agencies are often only reluctantly allocated. Ime, in government institutions it is generally not very respected as it "impedes progress".
At least there is the very dedicated and persistent https://noyb.eu :)
[dead]
For tech B2B companies where the founders or executive team hold the majority stake in the organisation, yes. A failure to disclose or respond when there is a public notice on an .onion address, or a sample set of your customer data has been published online, creates tangible, direct commercial impact.
You should expect every deal in your pipeline to stall. Your product and company will be flagged by every GRC team, and every stakeholder trying to purchase your product will suddenly need to go to risk committees, or into meetings with CISOs, CTOs, and founders, to explain why buying from you is worth the risk compared to competitors who have not been breached.
If you have not addressed the issue, it becomes a literal deal-breaker. The sooner you write the press release, notify customers, and deal with the underlying problems, the sooner you can turn the incident into a credible story about how you responded, contained it, and improved.
If you do not respond, or you deny it, your deals are dead.
The reason I prefaced this with companies where the founders or executive team hold a majority stake is that I sincerely do not believe the same incentives do not exist for most other companies. The stock price is not meaningfully impacted by incidents like this; it is more affected by vibes, market conditions, and the general tech economy. There are a hundred things that will move the stock price before cybersecurity and data incidents do.
Operating revenue and profit, however, will be impacted. Executives on a death march for growth, who understand that an incident like this can wipe away a year of progress (and essentially their life's work), are far more likely to take it seriously. They are directly exposed to the commercial consequences.
The companies you see trying to sweep this under the rug, or outright ignore it, are usually one of two things.
1. They are so out of touch with their customers that they would rather listen to a lawyer chasing the “ideal legal-risk outcome” than pursue the best financial, customer and cybersecurity risk outcome. In my experience these are executives who are independently wealthy or already come from wealth, and their priority is simply keeping the status quo.
2. They are simply not incentivised to deal with it properly (carrot, nor stick). That is: they don't lose their bonus, they don't face the axe, and they aren't rewarded for doing anything "well" in response to it. They might say they're "inherently" exposed because if the business is impacted, so are they (stock price, performance bonuses) -- but that's incredibly disingenuous, as it's pretty much always not a material difference to them.
For B2C or B2B doing "traditional" stuff? No. The incentive simply just isn't there.
GDPR, CCPA, whatever, hasn't moved the dial.
I have a custom domain for my emails with catch all. When I create an account somewhere I just use <name of the service>@my-domain.com
Can I find out if any of my emails are in leaks with a service somewhere?
That's literally what Have I Been Pwned is for.
https://haveibeenpwned.com/
Yes, but note that you have to pay for that, see the pricing here:
https://haveibeenpwned.com/Subscription#corePlans
For me, with a similar wildcard setup, it became something I wasn't willing to spend money on. I work on the basis that accounts are compromised and if the company is large enough I'll see it in the news. Strong passwords, and a password-database is the best I can manage.
You don't, you can register a whole domain and it'll work.
One by one, but I think the question is about the entire domain name
You can have haveibeenpwned.com check for the custom domain itself. For instance, I get notified if any email of our family domain get leaked (not just mine).
If you sign in that's an option on your dashboard. You need an account because you need to verify the domain is yours
At this stage just expect that every accounts will get leaked or rooted, it's a matter of when, not if...
Use varying email `plus addressing` (john+am2604@foo.com), varying passwords or passkey and 2FA on anything remotely important (use of your identity, not just financials).
I recommend people use proper email aliasing, not plus addressing. Duckduckgo makes a free one that's can integrate into Bitwarden, if you have iCloud+ Apple's($0.99/month) hide my email is good. Addy.io and SimpleLogin are the best and allow PGP encryption to prevent another party having access to your emails, but they are paid for full features.
> Organizations like the IAB require that advertisers normalize email addresses so that they can be correlated and tracked, regardless of users' privacy wishes.
https://www.privacyguides.org/en/email-aliasing/#over-plus-a...
One time I clicked "I forgot my password" on a website and they e-mailed me my password.
Ever since I don't trust online services.
Plus addressing doesn't work well unfortunately - lots of poorly written websites will reject it.
+1 for not giving those websites your email in the first place!
The + trick is useless to protect you, obviously. Instead, use a a service like simplelogin to create unique emails for every place you sign in.
Correct, but you get to see who leaked you.
Depends if the criminals are smart enough to strip the +.. part when sending you phishing.
Not to spoil the surprise but it will get much MUCH worse. Reason: sloppers. Anyone who's dealt with security and has looked into how all the slop agents work can understand how catastrophic it is from a security perspective. The "yes" button on "I trust the authors" is what unlocks the gates of hell.
>why is it still needed?
It's not needed. There are already alternatives that could take its place. Some of them are able to actually show you what data leaked instead of leaving you blind of what was actually included in the breach.
This is a bad idea, for multiple reasons.
https://www.troyhunt.com/here-are-all-the-reasons-i-dont-mak...
I don't think he meant "show the actual data," I think he meant "what leaked? My name, address, phone number, email, medical records, payment history, bank account number?"
We get a "your private data is now public" email, but knowing exactly what data turns that from a depressing statement on how much corporations value their customers' privacy into something actionable.
This information is shown on the site of the breach, as example: https://haveibeenpwned.com/Breach/BakerDistributing
Yes, I meant the actual data so you know what leaked. There is a difference between leaking a password 12345678 and leaking a password that was reused on a different site. There is a difference between leaking your actual birthday and leaking 01/01/1900. There is a difference between leaking a fake address, your previous address, and your current address.
>Most breaches already contain hashed passwords
It could show the hash instead.
>No, it's not ok that these passwords are already out there
So it's better that people have to pay for it instead of getting this information for free?
>Because it's important to say "I don't store passwords in HIBP"
This is a personal choice.
>I'm not your personal lookup service
The idea is that this would be done by the site itself and would not require manual work by the owner.
Hashes can be cracked, and end users won't understand how to create password hashes to check which one was leaked. Plus, salts exist.
Passwords shouldn't matter anyways. Use a password manager and be done with it. The real issue is metadata which can't easily be changed - phone numbers, addresses, and the like. If any of that data is leaked, it becomes much harder to contain impact. You can't move addresses every time your address gets leaked online.
Can you give examples of these alternatives?
I use Snusbase (https://snusbase.com). They've been around since around 2016 and haven't had any issues legally - they're the longest-standing data breach search engine besides HIBP, as far as I know.
(This is not an advertisement.)
there will be more data breaches.
Google and Apple are throttling hotfix updates (for app developers) as tons of code pushes to their infra (by vibe coders) is straining their system.
The are fixing this by throttling updates to minimum 3 days review period.
so good luck fixing the vulnerability or data leaks in your apps.
I am not sure I get the connection between AI code holding up review processes and data breaches.
The post made a pretty clear claim, I thought: the volume of apps being sent through is so extreme that they can't keep up with their review process.
Dont worry the vibecoders will tire out, they're the same people who were making NFTs and mining bitcoin, they'll move onto the next hot thing soon enough. Its more an archetype, not necessarily the same exact people. They dont commit long term.
This indeed. They are the "type of guy type of guys", always drifting to next big thing®
I wonder whats next, I feel it might be a huge swing of the pendulum next.
[dead]