Adult cam site StripChat exposes the data of millions of users and cam models | Hacker News Reader

Adult cam site StripChat exposes the data of millions of users and cam models

therecord.media

28 pointsilamont5 comments

Mastercard and Visa are forcing thousands of websites to verify their users with their government IDs in order to post their adult pics online now. They are basically facilitating these, and much worse leaks. Those christian fundamentalists who started all this may soon find out that their own pics are leaking on the net next to their passport pic.

Why blame Christians for the poor security practices of these adult sites? If government IDs are being used to verify the legitimate use of adult sites then the data should be kept in a secure fashion. In this case, ElasticSearch should not have been left wide open and all PII should be encrypted at rest. Further it's hardly just a Christian Fundamentalist issue. It's not as if the average person wants minors to be able to post or get access to pornography without any kind of hurdle or verification of identity. As for Mastercard and Visa — being associated with fraud/trafficking can be incredibly damaging to a brand and network fees. They are trying to protect their financial interest which is one their duties to their investors. I'm not saying Christians weren't involved or that they don't have a stake, but based on your comments it seems more like you have a bone to pick than an interest in effective policy or security practice.

Because even when they (say that they) uphold those practices, leaks still occur. There are a number of intermediary companies which do the ID verification on behalf of adult sites, who are thus becoming aggregators of huge amounts of personal IDs. This is a privacy bomb waiting to happen, it's not a matter of if but when.

Time and again it has been proven that the bigger problem is not the security, it's the collection.

> like you have a bone to pick than an interest in effective policy or security

I have a bone to pick with privacy (if you re referring to my comment history, thanks for snooping, but that action itself shows a certain preconception on your part)

I didn't snoop your comment history. I don't have any preconceptions about you other than what you've stated so far - which is that you have a deep concern for personal privacy and that you place the majority of the blame for this data leak and others like it on political and corporate meddling by Christian fundamentalists.

While I agree that the best way to secure against leaking sensitive data is to not have it in the first place, I can't see how the internet would be as useful as it is today if no one stored any sensitive data. There have been many data leaks where the information was properly encrypted and therefore of no use to malicious actors. In the case of uploading and accessing pornography I think the tradeoff between privacy concerns and the protection of the public from obscenity is an acceptable risk when good security practice is used. I also think that a large amount of the population in the US would agree with my position. My point being that my position is not just a Christian fundamentalist position and I still don't understand why you want to place the blame at the feet of Christiana.

> Mastercard and Visa are forcing thousands of websites to verify their users with their government IDs in order to post their adult pics online now.

Any reputable site where adult content creators can make money can reasonably be expected to follow rules according to places where they market, in the case of the US that would include following 2257 which requires some level of bookkeeping as they may fall under the 'producer' guidelines. The US is a big enough market that it's 'easier' to just require all performers regardless of where they live to follow guidelines that keep them able to operate there.

Speaking from unfortunate various-hand experiences, I can say the old rules weren't enough to stop some people from being able to post non-consensual content of others with a verified account. You can say 'just issue a takedown' but the internet is forever, right? Maybe it's better now with the payment processors being more strict but I'm not sure.

In either case I don't think most of the industry is against age verification (at least from the people I've known IRL that have performed in such endeavors) so IMO the bigger problem is how the compliance data is retained.

Reply on news.ycombinator.com