Inside the "3 billion people" national public data breach

Has anyone been able to reverse this base64 encryption? Whatever am I going to do with this?

I dug into this a little and one of the files is 164GB. How do you even work with these files? That is, how would I search for my SSN on my windows box?

I can't believe HN mods think it's ok to leave this comment up. I don't know of a way to report it myself unfortunately.

I get it now, but I have so much imposter syndrome that I wasn't sure if this was ACTUALLY something I needed to figure out -__-

Anyone know the size after the 50GB file is un7zipped?

EDIT: answer: 2 files, 176GB and 120GB, total is 298GB.

Elsewhere in this thread I posted a detailed commentary on what the torrent contains.

FYI: This is only the two social security files, not the whole breach.

[dead]

I'd be worried about legal repercussions if we were talking about the latest Disney movie, but this is merely the private information of a billion people. Never seen IP law give much of a crap about that before.

Is this NPD's "IP" though? Is my personal information that company scraped, now that company's intellectual property?

Where's the IP?

It's like phone books--a collection of data, no creative content.

The offline lookup is just for passwords (the pwned passwords service) and is used to prevent people from using known breached passwords.

There is no offline availability for the Have I Been Pwned data on which emails were present in which breaches. Access to thus data is rate limited and paid API keys are needed for bulk access.

The downloads are the way to go IMHO. But this is coming a little too late. "HIBP" is already making money from "paid API" and other commercial nonsense. Profiting from data breaches. While posing as a hero, catering to a dedicated following. This is, IMHO, everything that is wrong with the web.

The issue I am raising is not whether a particular website operator claiming to be in posession of data breach dumps, that any web user can download themselves, is "trustworthy" or not. The point I am raising is the unnecessary data collection. If these downloads were available from the website from day one, then there would be no "paid API" nor partnerships with so-called "tech" companies or HN HIBP following. There would not be "HIBP" proponents trying to suppress any criticism of it, defending its every move despite its past mistakes. Most importantly, there would less/no need for "trust".

HIBP is a particularly ugly symbol of the problem of web intermediaries/middlemen and everything/anything "as a service". As expected, HN commenters will not like this viewpoint as they may themselves be trying to profit from such intermediation and the data collection it enables. They may have even convinced themselves they are doing good.

And people are born and die

I don’t think the parent is satirical at all; as an enumerated power, the IRS needs modernization and better funding.

Recent hiring expansions have increased audits for high earners and generated additional revenue. Turbotax’s lobbyists are losing influence and we’re enjoying free filing options for individuals in some states. It’s also reasonable to say that a revenue service is not responsible for defining authentication security standards.

Why do you think reallocating funds is worth it as a response to this issue? Where would those funds go?

This is neither a problem of funding or any government service being at fault. This is the fault of American culture. A national ID system sounds too scary to too many Americans. Politicians aren't going to waste their political capital on pushing through something so unpopular. It really isn't any more complicated than that. There is a huge desire for some sort of national ID system and SSNs are the closest we got so they filled the vacuum. It is silly to blame that on the IRS. It is a societal failure.

When exactly has funding EVER been raised for any of those things??

That's one of the biggest political fights in the past century: austerity, cutting public spending, and means-testing the fuck out of every social program the government even still offers. This has been the case since the 80s reagan-thatcher year. You can literally look at the budgets of major cities and easily see where the majority of spending goes. Hint: it ain't public schools. Were you not paying attention when people were talking about how much police departments get paid out of the budgets of their cities a couple years back? Have you EVER thought to actually substantiate your beliefs by actually looking up the policies that effect public spending and government budgets?

Is the answer "no"?

And it isn't just a problem with funding, it's a legislative and cultural problem too. But in the short term, without drafting up new laws or changing the culture of society, the best we can do to fix these issues is provide more funding.

In the private sector, OKRs and KPIs are used to track performance and provide metrics on whether a company is meeting its goals. Boards review these metrics and decide on additional investments based on thorough cost/benefit analyses.

I imagine it's similar in the public sector, where funding is determined by the needs of the public, political considerations, long-term planning, and so on.

I’ve heard this claim, but they could use some sort of bloom filter pr cryptographic hashing to block profiles that contain previously-removed records.

There could also be a shared, trusted opt-out service that accepted information and returned a boolean saying “opt-out” or “opt-in”.

Ideally, it’d return “opt-out” in the no-information case.

Sorry, I value my legal rights over the viability of the data broker industry. If they can’t figure out a way for lawfully not collecting my data, they should not collect data period.

1. They could be required to store a private copy of the removal requests, data that they can't sell (not ideal)

2. Sounds like "data brokers" that sell private information just shouldn't exist...

They could store a hash.

I got a quote from them and immediately initiated a data removal request. It seems like it went through, got a link in the email. Thanks for the reminder that I might need to follow up to make sure they followed through.

> It's hard to make collection, aggregation, and sharing of facts illegal.

Sure, but the US has a precedent in HIPAA. Not saying it's copy-paste, but... maybe it should be.

I would prefer the law be more restrictive than less, because I don't believe this is true:

> law is justifiably looking for a scalpel treatment here to address the specific problem without putting the quest to understand reality on the wrong side of the line.

I believe the law may use that noble goal as cover for the actual goal: restrict the ability of capital holders to accumulate capital as little as possible. Data sharing isn't a public good in any way. It's mostly not even useful for the targeting purposes it claims. It's extremely reckless rent-seeking that knowingly allows innocent people to have their lives wrecked by identity theft.

Europe figured it out.

Instead of making it illegal, we could simply make the people who aggregate the data liable for making people whole if the data is misused.

The difference now though is an attempt to legislate personal data collection, such as the CCPA. I strongly believe they are violating the law, and that if I opt-out or request removal, an answer of "oh well nuthin we can do" is not acceptable when my data re-appears either on their platform or on another platform they provided data aggregation services to.

>The "pure land" of democracy in North America was never pure

don't mix your pet grievances together, having full public knowledge of every person in your country is democratizing, frankly, an aid to democracy, not a hindrance. Not saying I want to live in that world, but it's not an impure democracy.

Norway (and others?) already publishes everybody's income statements. Not healthy imo but I guess would aid more accurate snitching (and envious resentment).

Did you use a grep command? The file is too large for me to open and I have not used grep before to have confidence with it.

Edit: nvm, ``` findstr /i /r ".000000000." ssn.txt ``` did the trick in powershell, with the zeros replaced with the ssn. Also there is a star after each period that HN has changed to italicize the text instead of showing it.

"Not available in your region" bloody hell.

You'd think something like that would require a death certificate to actually happen

that sounds very traumatizing, next explain that you have,

filed for injunctive relief from emotional duress due to actions of defendant.

and cant speak any further as instructed by legal cousel

"How do you know he's dead?"

"I called him on the phone and he told me!"

There has never been a US president that had anything close to ethical behaviour (to wit: the ones that existed after drone strikes became a thing all signed off on drone strikes. Those hit a lot of innocent people. The US has never stopped having slavery. I could go on). It is really the height of fanciful thinking to believe that the flavour of the month US leader will be any different.

You probably are posting this as a joke, but without a clear technical solution to this problem, flooding the industry with bullshit data seems like a great avenue.

In fact there are far fewer valid Socials. They follow a system where guessing a number of digits is fairly determined based on year and state of birth

> If you meet all the requirements to identify yourself to the bank, at what point does the bank have to say "this is that person, and that transaction is legal".

Our current system is entirely built on ridiculous levels of trust, mostly for convenience / cost saving reasons. I've made payments over the phone with nothing more than the information found on the bottom of every check I've ever sent. I routinely hand my credit card to waitstaff making 7.25 an hour and in that moment I'm handing every last one of them the ability to snap a photo of my card on their phones and go on a shopping spree at my expense.

As insane as our system is, it's mostly worked. Even though I've been made to pass around my account info countless times, I've never once had my accounts cleaned out. If a single mother with less than 1k in her account gets robbed, I have a hard time blaming her. She had zero say in the design of this system, and she's the person least able to deal with the cost of the consequences of it.

On the other hand, I have very little problem putting the blame on the banks which do control much of the system and who can more than afford to cover the costs of such incidents. This puts a small amount of financial pressure on them to improve the systems they've created and forced the rest of us to use in order to participate in society.

There are all kinds of things they could be doing to reduce fraud, but they don't. Mostly for convenience / cost saving reasons. I consider their refusal to take even simple steps to improve the security of their systems as their implied consent to continue accepting the responsibility for the still rare instances where criminals take advantage of their inaction.

The Google Authenticator app (just as a mainstream example) was released 14 years ago. When we're still waiting for a lot of banks to even support TOTP, consider me unimpressed with the level of effort banks are putting into securing my accounts.

>Well then you're up against the wall of digital verification.

That's whole point, they should use standardized authentication process. The problem is that they don't use any authentication at all. They just give money away because they can extort them back from unsuspecting victim like some gangsters.

How do you feel about the recent case where a caretaker for a disabled person who was given permission and access to use the person's cards, banking app, etc ended up stealing from the person. The banks response - they had given the caretaker access so it was their fault.

Even if you have all the passwords and bioinformatics, passkeys, 2FA, etc - how can you prevent theft like this?

Banks should get insurance to cover their negligence. They weren't careful.

It isn't great, but I don't think there's much risk there. There's not really much of a motivation for some random person to get into my utility account. The balance is never positive. Utilities are physically bolted to my house. They're pretty heavily regulated too. If someone wanted to steal electricity from my house, they can use the outlet on my patio that has zero authentication whatsoever.

When I obtained utilities for my house, none of them required my SSN. The water company asked, but I declined, so they asked for a fax of my DL (which I could have probably photoshopped, but didn't).

Just because people ask for something, doesn't mean you have to give it to them. I leave fields blank all the time on different (paper) forms (including when they ask for SSN), virtually no one hassles me.

I maintain my utilities account by email.

One could argue criminal.

Feel like it’s kinda like my bank using my email as the password or something.

The reason the Shaggy defense doesn't work is the default assumption of the courts is that you're a deadbeat trying to game the system. This assumption comes about because in the majority of cases it is the truth. The system would be a lot nicer if there weren't people trying to scam it every hour of every day of the week.

When someone named adamomada comes to the bank for a loan, the presumption is that adamomada will repay the loan.

If they knew it wasn't you, they wouldn't have written the loan in the first place. They're asking you to repay it because they really do think it was you.

If "it wasn't me" was all anyone had to do to get out of paying a loan, many people would do it.

Is that even a Shaggy defense? The whole point of the Shaggy defense was that it's saying it wasn't you despite overwhelming evidence ("She even caught me on camera - it wasn't me")

But in this scenario, there is basically zero evidence it was you

"Identity Fraud" is institutionalized victim blaming. The claim is that the person who's identity was stolen was defrauded (and they should protect themselves or fight back), but in reality it was the creditor that got defrauded.

As brilliantly satirized by the mitchell & web sketch https://www.youtube.com/watch?v=CS9ptA3Ya9E

I second this request of releasing the results of this “digital tracer dye” experiment. If their respect for your personal data is that low, they deserve to be named and shamed. And more.

Surprisingly, there aren't that many. When I started, I thought I would catch my email address being resold. The only reseller has been Democrat politicians or funding sites like Go Blue. The other one is Engagez, which is some kind of tech vendor expo I signed up for with some meetup event.

The most widely spread breached address is LinkedIn by a wide margin. Houzz is second. Zynga, Imgur are also in contention.

When I started getting porn spam from the Diver's Alert Network, I alerted them to a breach. They misunderstood and just told me how to change my password.

The most annoying thing is that I found my personal robert@ email address is HIBP under the evite breach. I so jealously guard my personal address. A well meaning friend invited me to something with evite. And that's all it took.

Just like a lock on the door, it raises the barrier to a non trivial level. It does not give you a ft Knox level impenetrable fortress.

I recently froze my credit with the big 3 and it was easier than I pictured. I don't know if they slow you down if you try to unfreeze it immediately after clicking "forgot password".