Writing more about #LastPassBreach feels like beating a dead horse. But I had a look at the official statement again and it is highly misleading. I felt the need to provide some context that #LastPass is willingly omitting.
“Again, it seems that LastPass attempts to minimize the risk of litigation (hence alerting businesses) while also trying to prevent a public outcry (so not notifying the general public). Priorities…”
https://palant.info/2022/12/26/whats-in-a-pr-statement-lastpass-breach-explained/
Notified Experian on Dec. 23 that their site was allowing anyone to see the credit report for, well, basically anyone, completely bypassing their lame 4-5 multiple guess questions and other security.
Or even in cases (like mine) where trying to get your credit report generates an error saying you have 3 other options for getting your free report from them (calling, mailing, or chat w/ rep). The site said Experian didn't have enough info to validate my identity, but when I changed the url slightly, it showed me my entire report. Glad I checked, too, because the info in there is so completely wrong I don't even know where to start.
So it's Dec. 27, and I still haven't heard anything from Experian. All you needed was the person's name, address, SSN and DOB. This info has been exposed on pretty much most Americans for many years now.
BTW, I checked this with several friends who volunteered to check their own reports, and they were able to fully replicate what I did.
It's bad enough that we can't stop companies like Experian from making $2B a quarter collecting and selling our info, but there has to be some real accountability. And as we saw with the Equifax settlement, class-actions and more laughable "credit monitoring" services aren't going to cut it.
Experian has shown this year especially that it gives exactly zero fscks about securing access to the data that drives its entire business.
https://krebsonsecurity.com/2022/08/class-action-targets-experian-over-account-security/
https://krebsonsecurity.com/2022/07/experian-you-have-some-explaining-to-do/
https://krebsonsecurity.com/2021/04/experian-api-exposed-credit-scores-of-most-americans/
Science education in an age of twitter disinformation
tl;dr — Science education needs to adapt to a world of misinformation on social media and beyond. Today, prominent antivaxxer Robert F. Kennedy Jr. tweeted the ridiculous claim that as director of the NIAID, Dr. Fauci bought the silence of the entire worldwide virology community by handing out research grants. Elon Musk then affirmed and amplified his claim.