Hacker News Reader

Comment by hedora | Hacker News Reader

I'm tired of this crap. Can we just say all businesses have to pay $10,000 direct to each customer for each data breach?

Furthermore, to prevent government scope creep, can we say the $10,000 comes from the dynastic wealth of whatever congress critters backed whatever bills required the companies to collect the stolen data in the first place?

There is no reason for the cell company to even know who its customers are, beyond dealing with sim card replacements. That could be handled without requiring PII.

View on HN

The other necessary fix here is making lenders liable for not verifying the identity of a borrower.

Individuals should not have to spend time proving they did not borrow money, lenders should be liable for any losses if they want to save money and extend credit with just a SSN/name/address verification.

Can we stop using social security numbers as national IDs? Even the social security office says not to use it for that.

Or start using them as identifiers - not sensitive, not privileged, necessary but insufficient for ex. financial access; no more special than a name.

No, that's impossible. No one would want to start a business, ever if you could just be wiped out because some vendor's vendor fucked up. If you want that, then we need like a free tax funded federal MSP.

Good, the whole point is that if you aren't willing to take responsibility for the information you are storing, you shouldn't be storing it. So businesses without the will to do that will shut down, the rest will be more hardened, or less willing to stored data they don't actually need.

That’s a massive cooling factor in the biz env, it starts to have huge negative impact. Over time, the regulatory environment causes US to lose edge, declining salaries, quality of life.

Nope. You’ve clearly never worked in IT. There is no perfect solution. And the closer to perfect you get, the system becomes harder and harder to use, maintain, and modify.

If it's a vendor mistake then either the fine goes directly to them, or you sue them for it.

So who gets sued in log4j?

The companies using it didn't (generally) have a commercial relationship with the authors, so I'm comfortable leaving the users holding the responsibility. Fair question, though... I might even prefer to make liability only follow services, not code. So if you make a SaaS that takes PII, that's you're problem. If you publish code that can hold PII, that's still the problem of whoever uses it on PII.

Even if just a $10/customer fine it’d still be massive. That’s 370M.

It needs to be company ending, and it needs to be owed to the customers so that the courts cannot negotiate it down (preferably, it would be first priority when apportioning company assets in any bankruptcy proceedings). That would force them to price out insurance policies, and then decide if paying $2500/yr per customer (since TMO has a breach like this every few years…) is greater than or less than the value the get from the data in the first place.

Sounds like a good incentive for better protection of user data in the future.

> Even if just a $10/customer fine it’d still be massive.

Yes, exactly. It's indeed a massive value that's been stolen from the customers.

Reply on news.ycombinator.com