Hacking - should companies store less of our personal data?
Discussion
There have been a few high profile cases in the news recently, and I suspect this is something that will only get worse.
Perhaps the most notable recently was TalkTalk, but another which has gone relatively unsung is the VTEC brand who make popular childrens toys.
My debate argument is this - shouldn't these companys be thinking more pragmatically about minimising the personal data they keep, rather than collecting as much as they can?
In the case of VTEC, some random hackers now have my name, email address, real address, password, secret question and answer, IP address, my daughters name and her date of birth too.
The only things VTEC really need in order to supply the service I require from them is my email and password. Nothing more. Everthing else can be obtained on the fly should I choose to purchase something from this occasional service.
I'm really quite angry about this as the communications they are sending are quite blazee in my opinion, and whilst no payment information has been hacked, its certainly not good that random baddies know a lot more about me - and thousands of other people and their families - than they really should.
Thoughts? Should there be a strong directive introduced on companies to collect and store only the utter bare minimum required?
Paul.
Perhaps the most notable recently was TalkTalk, but another which has gone relatively unsung is the VTEC brand who make popular childrens toys.
My debate argument is this - shouldn't these companys be thinking more pragmatically about minimising the personal data they keep, rather than collecting as much as they can?
In the case of VTEC, some random hackers now have my name, email address, real address, password, secret question and answer, IP address, my daughters name and her date of birth too.
The only things VTEC really need in order to supply the service I require from them is my email and password. Nothing more. Everthing else can be obtained on the fly should I choose to purchase something from this occasional service.
I'm really quite angry about this as the communications they are sending are quite blazee in my opinion, and whilst no payment information has been hacked, its certainly not good that random baddies know a lot more about me - and thousands of other people and their families - than they really should.
Thoughts? Should there be a strong directive introduced on companies to collect and store only the utter bare minimum required?
Paul.
Just checked my vtech account. The kids are now 7 and 9 so it's been dormant a while. Pleased to see I'd used a low security password I don't use on online-shopping sites and I'd never entered address details.
Would completely agree that the email was very blaze - I don't even remember an apology in it...
Would completely agree that the email was very blaze - I don't even remember an apology in it...
The level at which the security has been breached at VTEC is shown here, unbelievable how much data is being held in one simple spreadsheet.
http://www.troyhunt.com/2015/11/when-children-are-...
The password field, VTEC suggest 'might' have been hacked. It looks pretty clear to me from this that it HAS been hacked.
And no, I don't remember an apoligy either for this royal of all f
k ups - although they have expressed their apology for the "inconvenience". Well, thats OK then, isn't it VTEC. 
Edit: Looks like they could have pictures of children too, if you personalised your tablet:
http://motherboard.vice.com/read/vtech-hacker-expl...
So, they have your name, address, your childs name and address, their date of birth and potentially photos of you all too.
http://www.troyhunt.com/2015/11/when-children-are-...
The password field, VTEC suggest 'might' have been hacked. It looks pretty clear to me from this that it HAS been hacked.
And no, I don't remember an apoligy either for this royal of all f
k ups - although they have expressed their apology for the "inconvenience". Well, thats OK then, isn't it VTEC. Edit: Looks like they could have pictures of children too, if you personalised your tablet:
http://motherboard.vice.com/read/vtech-hacker-expl...
So, they have your name, address, your childs name and address, their date of birth and potentially photos of you all too.
Edited by Paul O on Monday 7th December 12:20
The problem with security is in two fold:
The Client: 99% of people don't give a sh*t about security. Most people will usual the same password for everything and that password will normally be defeated by a dictionary attack in about two seconds or can happily be socially engineered in about four seconds.
The Server: 99% of people taking your data and/or asking you for registration are not going to hold it in a way I'd consider secure. Clear text passwords stored in tables within databases presented in way susceptible to injection attacks that a 6-year old could do, sub-optimal patching and all strung together with clumsy, undocumented infrastructure.
Seriously, don't trust anyone.
The Client: 99% of people don't give a sh*t about security. Most people will usual the same password for everything and that password will normally be defeated by a dictionary attack in about two seconds or can happily be socially engineered in about four seconds.
The Server: 99% of people taking your data and/or asking you for registration are not going to hold it in a way I'd consider secure. Clear text passwords stored in tables within databases presented in way susceptible to injection attacks that a 6-year old could do, sub-optimal patching and all strung together with clumsy, undocumented infrastructure.
Seriously, don't trust anyone.
Doesn't the data protection act already state that only the minimum required personal information can be stored?
The thing is if certain information wasn't stored, complaints would be equal. Most people don't want to enter their address every time they order something, they'd rather it was already stored.
I'd much rather companies managed and protected their data properly than have my level of service lowered.
The thing is if certain information wasn't stored, complaints would be equal. Most people don't want to enter their address every time they order something, they'd rather it was already stored.
I'd much rather companies managed and protected their data properly than have my level of service lowered.
Calza said:
The thing is if certain information wasn't stored, complaints would be equal. Most people don't want to enter their address every time they order something, they'd rather it was already stored.
Most webshops give you the option of just buying without an account, or setting up an account. I suspect most of us choose to let them have far more information than we need to.Based on my experience I operate on the assumption that the vast majority of websites are poorly coded, run on obsolete environments with known vulnerabilities (PHP etc) and probably run by a small number of techies all of whom have full access to your data.
Outside of certain regulated areas, like PCI-DSS for credit cards or FCA/The Fed for banking, and very possibly larger software platforms like Gov sites, Facebook etc, you have no way of guaranteeing that your data is secure once you've entered it on a site. There are no 'web security police'!
You have to assume worst case and not trust ANY site with data you consider sensitive. Don't share passwords across sites and preferably use throwaway email addresses too!
Outside of certain regulated areas, like PCI-DSS for credit cards or FCA/The Fed for banking, and very possibly larger software platforms like Gov sites, Facebook etc, you have no way of guaranteeing that your data is secure once you've entered it on a site. There are no 'web security police'!
You have to assume worst case and not trust ANY site with data you consider sensitive. Don't share passwords across sites and preferably use throwaway email addresses too!
Edited by essayer on Monday 7th December 13:49
It's clear that personal data is never going to be 100% secure, and has and will continue to be compromised/stolen as long as it has a value.
It's main value is in impersonation i.e. someone pretends to be you in order to steal your own money, or use your identity to obtain something fraudulently. It can also be used for 'social engineering', where they use the data to convince you that they are a legitimate, and then con you e.g. 'Dear Mrs Blogs, its Joe from TalkTalk, as we lost your data recently, you are due compensation, please just confirm your bank details before we can refund you...'.
There will always be genuine vulnerable persons, and plain idiots for that matter, who will be susceptible to being conned, nothing we can do about that.
But 'normal' people also need to take responsibility too, think about what you're sharing/signing up for, do I really need to give my children's names and DOB's to a toy firm?
Of course firms should get better at protecting your data, but they should also get better at verifying their customers identities too, so personal data becomes worthless to them. If the bad guys cannot use the personal data, then its value decreases.
This is the key for me, I couldn't give a toss if my personal data is stolen (it has been FYI), what I care about is how a firm confirms that are actually transacting with the real me, this is the area firms/people need to focus on.
It's main value is in impersonation i.e. someone pretends to be you in order to steal your own money, or use your identity to obtain something fraudulently. It can also be used for 'social engineering', where they use the data to convince you that they are a legitimate, and then con you e.g. 'Dear Mrs Blogs, its Joe from TalkTalk, as we lost your data recently, you are due compensation, please just confirm your bank details before we can refund you...'.
There will always be genuine vulnerable persons, and plain idiots for that matter, who will be susceptible to being conned, nothing we can do about that.
But 'normal' people also need to take responsibility too, think about what you're sharing/signing up for, do I really need to give my children's names and DOB's to a toy firm?
Of course firms should get better at protecting your data, but they should also get better at verifying their customers identities too, so personal data becomes worthless to them. If the bad guys cannot use the personal data, then its value decreases.
This is the key for me, I couldn't give a toss if my personal data is stolen (it has been FYI), what I care about is how a firm confirms that are actually transacting with the real me, this is the area firms/people need to focus on.
Unfortunately companies get hacked every day. This goes either unnoticed, or unreported by most. It is very common place. It was reported last week that Netflix was hacked earlier in the year (they only found out 6 months after the event!), but it seems most people are oblivious to this!
As for them storing less of our personal data, that would be nearly impossible. even if you are a 'guest', if your are purchasing goods to be delivered, your basic info is stored. Some sites ask information that may seem questionable, but it may be due to money laundering regs if financial, or ensuring that they market the correct goods and services etc. so it is nearly impossible to avoid.
As for them storing less of our personal data, that would be nearly impossible. even if you are a 'guest', if your are purchasing goods to be delivered, your basic info is stored. Some sites ask information that may seem questionable, but it may be due to money laundering regs if financial, or ensuring that they market the correct goods and services etc. so it is nearly impossible to avoid.
Rawwr said:
The problem with security is in two fold:
The Client: 99% of people don't give a sh*t about security. Most people will usual the same password for everything and that password will normally be defeated by a dictionary attack in about two seconds or can happily be socially engineered in about four seconds.
The Server: 99% of people taking your data and/or asking you for registration are not going to hold it in a way I'd consider secure. Clear text passwords stored in tables within databases presented in way susceptible to injection attacks that a 6-year old could do, sub-optimal patching and all strung together with clumsy, undocumented infrastructure.
Seriously, don't trust anyone.
I agree with all of the above.The Client: 99% of people don't give a sh*t about security. Most people will usual the same password for everything and that password will normally be defeated by a dictionary attack in about two seconds or can happily be socially engineered in about four seconds.
The Server: 99% of people taking your data and/or asking you for registration are not going to hold it in a way I'd consider secure. Clear text passwords stored in tables within databases presented in way susceptible to injection attacks that a 6-year old could do, sub-optimal patching and all strung together with clumsy, undocumented infrastructure.
Seriously, don't trust anyone.
Most companies (even some quite large ones), simply will not pay for a quality, secure system, and in my experience; most companies do not have the in-house technical experience to even properly interview the system developer/supplier/consultancy, or if they implement as an in-house project; the contract or permanent consultants.
There is a huge trend to 'data harvesting' in the last few years.
That is; companies asking for considerably more data than is required, because data has value.
Look at the data agreements you are tacitly agreeing to. Nearly all will give the company permission to share your data with 'partner and associate' companies, often located off shore.
Rest assured, while they claim to ensure your safety and privacy via strict contracts with these companies, once the breach has occurred your data is gone. Even if they do bother to sue the responsible partner company, your data will still be out there for sale.
With that, keep in mind that many countries do not have the same legal protection in place as the UK.
Once your data goes off shore it is immediately at risk.
Forget the high profile UK cases, your information is being harvested and sold on a daily basis via countries that have very low protection standards, in systems even worse than ours, and with workforces that have a considerably differing view about right and wrong vs personal profit.
Read this article; A third of employees will sell company data if the price is right., and note this is in the UK, Germany, US and Australia, and some employees can be bought for as little £100.
Given the amount of outright scamming that originates from eastern Europe, Asia and Africa, these results should be terrifying enough to make anyone pause for thought.
The government suggestions that they will bring in hefty fines for companies that don't meet 'standards' will be (if it happens) almost totally ineffectual. The simple truth is that the expertise does not exists in sufficient quantities to design, build, test, and confirm compliancy with any regulations.
In any case, the focus would be on compliance (at lowest cost), rather than actual security.
Importing 'expertise' from other countries won't do it.
The quality of 'imported expertise' from abroad, has been in my experience, nothing short of shocking. The level of 'home grown' expertise is pretty dire as well.
Very timely thread.
I've just emailed an organisation that needs a DBS check for me.
But they have outsourced their DBS checking to a third party who seem to be based in India and include a clause in their privacy policy that they will collect info and pass it to 3rd party marketing agents.
I've just emailed an organisation that needs a DBS check for me.
But they have outsourced their DBS checking to a third party who seem to be based in India and include a clause in their privacy policy that they will collect info and pass it to 3rd party marketing agents.
Paul O said:
The level at which the security has been breached at VTEC is shown here, unbelievable how much data is being held in one simple spreadsheet.
http://www.troyhunt.com/2015/11/when-children-are-...
The password field, VTEC suggest 'might' have been hacked. It looks pretty clear to me from this that it HAS been hacked.
And no, I don't remember an apoligy either for this royal of all fk ups - although they have expressed their apology for the "inconvenience". Well, thats OK then, isn't it VTEC.
Edit: Looks like they could have pictures of children too, if you personalised your tablet:
http://motherboard.vice.com/read/vtech-hacker-expl...
So, they have your name, address, your childs name and address, their date of birth and potentially photos of you all too.
Unfortunately this kind of thing is a near-daily occurrence if you read the specialist press. Almost all down to not following established good practice.http://www.troyhunt.com/2015/11/when-children-are-...
The password field, VTEC suggest 'might' have been hacked. It looks pretty clear to me from this that it HAS been hacked.
And no, I don't remember an apoligy either for this royal of all f
k ups - although they have expressed their apology for the "inconvenience". Well, thats OK then, isn't it VTEC. Edit: Looks like they could have pictures of children too, if you personalised your tablet:
http://motherboard.vice.com/read/vtech-hacker-expl...
So, they have your name, address, your childs name and address, their date of birth and potentially photos of you all too.
Edited by Paul O on Monday 7th December 12:20
The example above is astonishingly bad...I love the bit where they are returning the sql statement in the error message.
The one that gets me is where I'm not forgotten. I have an account at Zoho that I'm trying to close down, but they keep my details after I've closed my account. It's the same with Facebook and 'd imagine quite a few. The basis of it is that I can log back in and reactivate my account. I don't want to do that, I want to have all my info deleted and forgotten about
The actual storing of financial data is fairly stringent in most places. There's some that stick to the basics of the rules, and the rules quite frankly are wrong. The Information Commissioner has his head up his arse when it comes to password security and encryption. For most sites that I use, they seem to have a pretty good grasp of what they've got to do to make it more secure than what's in the book. TalkTalk as an example did the bare basics of password security, and it wasn't good enough.MOs security guys I know would either have quit or pushed through encryption methods because they wouldn't want their name associated with how it was/is in their peer group
The actual storing of financial data is fairly stringent in most places. There's some that stick to the basics of the rules, and the rules quite frankly are wrong. The Information Commissioner has his head up his arse when it comes to password security and encryption. For most sites that I use, they seem to have a pretty good grasp of what they've got to do to make it more secure than what's in the book. TalkTalk as an example did the bare basics of password security, and it wasn't good enough.MOs security guys I know would either have quit or pushed through encryption methods because they wouldn't want their name associated with how it was/is in their peer group
andy-xr said:
The one that gets me is where I'm not forgotten. I have an account at Zoho that I'm trying to close down, but they keep my details after I've closed my account. It's the same with Facebook and 'd imagine quite a few. The basis of it is that I can log back in and reactivate my account. I don't want to do that, I want to have all my info deleted and forgotten about
Totally agree with you but... dream on 
andy-xr said:
The actual storing of financial data is fairly stringent in most places. There's some that stick to the basics of the rules, and the rules quite frankly are wrong. The Information Commissioner has his head up his arse when it comes to password security and encryption. For most sites that I use, they seem to have a pretty good grasp of what they've got to do to make it more secure than what's in the book. TalkTalk as an example did the bare basics of password security, and it wasn't good enough.MOs security guys I know would either have quit or pushed through encryption methods because they wouldn't want their name associated with how it was/is in their peer group
What kills me with password encryption and the like is;Why is it even stored in such a way that any SQL that must access the basic account data can access the 'secure' data tables via SQL?
This is so easy to avoid, only a complete idiot would allow it to be possible.
In a system designed correctly, the only people you should need to be encrypting data to prevent viewing is the developers and support staff.
And even then, there will almost always be someone who 'could' access the data. What is encrypted, must also be decrypted, so the utility that does that must be available somewhere in the system.
And if the back end database somehow isn't capable of that level of data hiding and encapsulation, then why in Hell was it selected?
That level of ignorance, incompetence and laziness on the part of people and companies claiming to be experts should be a criminal offence.
I know exactly what you mean in that last sentence. I have had to make the 'offer to depart' on a couple of occasions for similar reasons.
Edited by Goaty Bill 2 on Friday 11th December 16:38
Paul O said:
Thoughts? Should there be a strong directive introduced on companies to collect and store only the utter bare minimum required?
The short answer is yes. I bought some socks online recently and couldn't complete the purchase without providing my DOB.DOB to buy some socks.
Edited by bhstewie on Friday 11th December 18:26
hstewie on Friday 11th December 18:26Selfishly I hope they don't store less of our data. I make my living flogging security solutions to enterprise customers. 
What I will say though, is I sell absolution that helps identify and fix major security vulnerabilities in applications. We engage with some huge companies, many of whom are household names.
It's staggering how many of them don't have even the most basic of policies or system in place to deploy security fixes to apps. I hardly ever see high levels of compliance and it's very common to find highly critical vulnerabilities in key systems that have been there, unpatched, for months and sometimes years.
What I will say though, is I sell absolution that helps identify and fix major security vulnerabilities in applications. We engage with some huge companies, many of whom are household names.
It's staggering how many of them don't have even the most basic of policies or system in place to deploy security fixes to apps. I hardly ever see high levels of compliance and it's very common to find highly critical vulnerabilities in key systems that have been there, unpatched, for months and sometimes years.
Gassing Station | The Lounge | Top of Page | What's New | My Stuff