AT&T is notifying 51 million former and current customers, warning them of a data breach that exposed their personal information on a hacking forum. However, the company has still not disclosed how the data was obtained.
Eh, I honestly don’t see much value in that “protection,” it’s a cop-out for companies to get away with really bad behavior with a slap on the wrist. I don’t think it actually protects anyone in any meaningful sense.
Instead, we should be fining companies heavily for improper security practices. If they would’ve avoided it if they practiced industry-standard security, big fine. If they had a reasonable amount of time to deploy a patch but didn’t, big fine. If they don’t respond quickly to a breach with industry-standard procedures (forcing users to change passwords, key rotation, etc), big fine. And the fine should get bigger very fast the longer they take to address it.
And yeah, we should absolutely have a more secure system. It’s ridiculous that big tech companies are moving toward passkeys when the federal government literally relies one one 9-digit number that’s static for life for pretty much everything. So if there’s one breach that includes your SSN, you’re screwed. These problems aren’t hard to solve, the tech around passkeys has been around for decades. There’s no reason we can’t have a system like that where companies only get the data they need, such as:
employer - work authorization and criminal record - they shouldn’t even need your full legal name, date of birth, etc
police officer - driver’s license status, criminal record, city of residence, age range (minor, 18-21, 21+, senior citizen)
cell service - I’m honestly not sure what they really need, maybe just a token in case you want to transfer to another carrier?
The only group that really needs your SSN is the Social Security Administration, and they could just keep that internal and do authentication w/ a passkey or similar. The #1 rule of security is to only have the access you need, whereas companies just grab everything “just in case.” Even lawsuits could be filed without actually knowing your personal details, as long as they have a token that uniquely refers to you, they could initiate legal proceedings to the court.
Eh, I honestly don’t see much value in that “protection,” it’s a cop-out for companies to get away with really bad behavior with a slap on the wrist. I don’t think it actually protects anyone in any meaningful sense.
Instead, we should be fining companies heavily for improper security practices. If they would’ve avoided it if they practiced industry-standard security, big fine. If they had a reasonable amount of time to deploy a patch but didn’t, big fine. If they don’t respond quickly to a breach with industry-standard procedures (forcing users to change passwords, key rotation, etc), big fine. And the fine should get bigger very fast the longer they take to address it.
And yeah, we should absolutely have a more secure system. It’s ridiculous that big tech companies are moving toward passkeys when the federal government literally relies one one 9-digit number that’s static for life for pretty much everything. So if there’s one breach that includes your SSN, you’re screwed. These problems aren’t hard to solve, the tech around passkeys has been around for decades. There’s no reason we can’t have a system like that where companies only get the data they need, such as:
The only group that really needs your SSN is the Social Security Administration, and they could just keep that internal and do authentication w/ a passkey or similar. The #1 rule of security is to only have the access you need, whereas companies just grab everything “just in case.” Even lawsuits could be filed without actually knowing your personal details, as long as they have a token that uniquely refers to you, they could initiate legal proceedings to the court.