Image courtesy of Richard Elzey used under Creative Commons
If you’re making a list of high profile data breaches, you now have a new name to add to that list; eBay. In a posting in the “in the news” section of their web site eBay clarified to some extent the scale of the breach, although even the headline seems incapable of telling it like it is.
“The database, which was compromised between late February and early March, included eBay customers’ name, encrypted password, email address, physical address, phone number and date of birth“
Although investigations are of course still ongoing, the current posting indicates that eBay are relatively sure that unauthorised access was only to one database, or certainly the wording of the article presents that view. For now, if you’re an eBay user, you need to change your password there and if you used that password on any other web site, you’re going to need to change it there too (yes, again). Unfortunately changing your name or address is not so easy, that’ll have to stay compromised I’m afraid.
Enshrining the right to be forgotten is a further step towards allowing individuals to take control of their own data, or even monetise it themselves, as we proposed in the 2020 white paper (Scenarios for the Future of Cybercrime).
The way the law stands in the EU currently, we have legal definitions for a data controller, a data processor and a data subject, an oddity which lands each of us in the bizarre situation where we are subjects of our own data rather being able to assert any notion of ownership over it. With data ownership comes the right to grant or deny access to that data and to be responsible for its accuracy and integrity.
Heartbleed, the vulnerability which is the result of a coding error in the widely used OpenSSL encryption library has been hogging all the headline over the past few days, and rightly so, it represents a a huge risk to information security for consumers and businesses alike.
You could be forgiven though given the majority of the coverage, for believing that as long as you waited for affected websites to update and subsequently changed your passwords that you would be covered. Wrong, Heartbleed is more death by a thousand cuts than major cardio-vascular event. It’s certainly true that by far the most widespread immediate risk, certainly in terms of numbers of potentially impacted individuals, is in the exposure of sensitive information by vulnerable web servers, information that could include passwords and session cookies, but even once this initial wave of patching is done the residual risk will be enormous.