Quora User Data Compromised

I use privacy.com and Lastpass to help with this problem. Any time there is a service I have to have a business relationship with that I don't trust to keep my info secure, I use a unique password and a unique credit card number with a tight limit. What's nice is that they tie the card to a single vendor too.

For example, the water company. I know the water bill is usually $50 or less, so I set the limit to $60/mo. As it turns out, they did get breached. I got an alert about someone who isn't the water company trying to hit the card for 80 cents. Most card runners use amounts under $1 because most credit card spending alerts have a $1 minimum. But privacy.com warned me, so I warned the water company, who was very thankful. Turns out their 3rd party provider had been breached and they were grateful for the alert too. Ended up saving a few thousand of my neighbors a lot of headache.

> This is why I hate companies that force you to sign up to gain access to content

I always found Quora's use of dark patterns and baiting you in from search engines then blocking the content particularly egregious. Always made me surprised anyone held that site to such a high standing and I can only imagine it's because the advocates never knew how awful the experience was without an account.

I feel Pintrest is very similar in that way.

This is exactly what has me excited about the new content model for the web Eich proposes. I just commented in another thread [1] but essentially:

1. enable donations / tips / subscriptions to sites using a browser-native crypto wallet

2. use ZKP anonymity

This enables a publisher / subscriber business model of 'dollars without data'. Which should really be the Minimum Viable Product for a publisher.

PII data for marketing is the icing on the cake for publishers, but the bar is high (and getting higher) around sharing that, and many of us want to support sites, but don't want to go through N+1 payment gateways and digital identity forms just to read some content.

From this perspective I see Brave and BAT as enabling a very old model: I give you a quarter, you give me your newspaper. End of story.

[1] https://news.ycombinator.com/item?id=18595792

Companies hate users who don't want to sign up. They do not want that relationship. So it's a win-win if you dont' sign up. Why would companies feel obligated to generate content for free?

If their systems get hacked and they have your snail mail address, they get your snail mail address as well. Email doesn't change that story.

If your main concern is the sheer number of username/unique password combos, pick a good password manager that works well across the devices you use. I’ve literally stopped caring about this aspect of my family’s online life thanks to 1Password. That iOS 12 added OS level integration for the service was the icing on the cake for me.

> This is why I hate companies that force you to sign up to gain access to content. I do not want that relationship.

I felt validated when I received the email from Quora about the hack to a fake email address and addressing me by a fake name.

Quora does not only want you to sign in, they want you to show your real identity instead of a handle or another pseudonym. For a simple online service, it should never be necessary to use your real identity, if only as a privacy-enhancing measure.

Suggestion: If you want to prevent the next leak from affecting your personal data then close your account (if you have one) and send them a GDPR Erasure Request: https://opt-out.eu/?company=quora.com#nav

Just last week I wanted to look up how much I bought some appliance for, five years ago. In the e-mail I see a link that is supposed to let me download the invoice... which of course no longer works because they have updated their ordering/billing system.

Also snail and email invoices automatically provide you with your own copy they cannnot delete. In contrast to “past 12 months viewable online”.

I got an email that included “personalization data” in the list of data types that were stolen. The help page also says that information on “actions” was stolen.

Does this mean that every question or answer I’ve viewed is now in the hands of the attacker?

That's because a few years ago a website that let you login meant it was a "real" website. Look at phone systems. Every one you have to deal with says please listen carefully as our menu options have changed. Then they lead you through an audio menu with the same bullshit that turns a 15 second interaction into one that could last hours over multiple phone calls.

My point is people do cargo cult everything. Could the service be BETTER without forcing the user to sign up? Inconceivable! Everyone knows you should force users to sign up.

Use a social login. If you for example use gmail for email, then it makes no sense to create a password as opposed to just logging in with your google account instead.

> One new development is that you used to be able to get your invoices mailed via snail mail. Then that disappeared and you got your invoices mailed via email. Then that disappeared and now you have to create an account on some portal so that you can download your invoice. So that's one userid/password combo per business relationship or service that you use privately.

It's annoying being on the other end of this: management deciding, for cost reasons, that snail mail is out and email is in.

Somebody else then worries about the risks of emailing documents that contain private information.

I think a case can be made that some kind of email token login is the simplest solution here: passwords only introduce another attack vector since you can usually reset them by email.

Are there more elegant solutions to this problem?

Some thoughts cross my mind:

- what doesn’t get hacked? Isn’t life a continuous trade-off between risks and chances

- If you’re afraid you’ll expose private information, then just don’t use a platform like that?

- these platforms use user generated content, true. But they provide the platform and the product. I think that is a fair deal.

This is an example where they decided their business model trumped user security. It’s hard to monetize an easy to access collection of free data. I hope we can find better ways to fund internet services than by consuming data from the users.

Annoying as it is, it’s better than sensitive data in cleartext email attachments.

They provide login with Google and Facebook too.

Would it be possible those logins are more secure?

physical mail is hardly more secured than email. 'literally anybody' could is in front of your house and fish all the mails straight from your mailbox while you are at work.

> I tried reasoning with them, that I just wanted to view content and did not attend to write answers or interact etc, plus, they had a valid email address and facebook profile (also fake name on facebook). They fought back "we actually want proof of your real name like a scan of ID". I danced around and did not end up giving them a scan of my id, but I changed it to my real name.

I don't understand why you bothered arguing with them instead, I dunno, creating a new fake account?

Can I ask why you wanted to view Quora's content so much? They flood Google search results but I've never seen a single substantial answer on there - it's like an off-brand Stack Overflow with an even worse "I know programming so I'm smart about every subject" problem.

How did they know? Was your name obviously fake? My favorite feature of DuckDuckGo is that if you search "random name", it will actually generate a random name (e.g. "Marlon Lonzo"). So I use these random unique names on all websites that require one.

1000x this. Nextdoor did this to my parents. It's fairly ridiculous.

The state of personal data regulation in the US is abysmal. Unfortunately, if Cambridge Analytica wasn't enough to spur new regulation, I fear nothing will.

The sad things is that even if you received and apology, it would mean nothing, empty words repeated over and over and over.

I got the same. And when I looked into it and found out the company was founded by former Facebook guys, I knew they couldn't be trusted and knew enough to jump ship.

It's so inconsistent. I was a Quora member for years and wrote a lot of answers as well as participating in a lot of discussions. Despite this I was never asked to confirm my identity!

I deleted my account last year (got cold feet as I was using my real name and picture and people I know IRL had started to stumble across some of my answers) but I'm sure my data is probably involved in this breach somewhow.

Well that is a bit of a disconnect then. My 'name' on Quora was 'Pappy Butthead'[0] since ~2015. In fact, until I got the email from them yesterday, I had no idea I was even a user still, I'd completely forgotten I had jokingly signed up. I'd never gotten any spam from their team that harassed me into providing anything.

[0]not my actual user name, but something similar.

This attitude of theirs is what made me stop using Quora. I deactivated the account almost one year ago.

Never went back to that site.

If you have all this documented you have a good standing in court! They failed to provide you reason why they want your ibfi and now its leaked and will cause you damage. File a small claim court this will add then some extra headache that they don’t need right now.

Haha I never give it to them as well. Never put your real name, no matter what. They are ridiculous with these requirements. I'm waiting until the day they'll make a credit check to open an account

Really? Are you sure this was actually Quora and not a scammer?

Edit: Sorry if stupid question, but that would be throwing major red flags if I got such an email.

Just don't read it.

Let me write an apology for them: "the security and privacy of your information is our utmost priority"

Feel better, don't you?

I feel like questions like "Why is <insert my opinion here> true?" have become increasingly common too. Thats like asking: "Please confirm my opinion, I don't want to learn anything new!"

There is one benefit of writing answers on quora: self promotion.

The last time I checked, both my Python & Go open source text books get decent views from Quora & reddit, daily.

That's why I just deactivated it and didn't delete.

A lot of the quora answers on topics outside of computer science and math are just plain wrong, especially in history, philosophy, and economics.

Their doc says:

> Is content posted anonymously still secure?

> Yes. Anonymous content cannot be connected to user accounts, so content posted anonymously is still secure.

https://help.quora.com/hc/en-us/articles/360020212652

> It's a valuable lesson in "don't keep data you don't need".

Unfortunately, though, most companies operate under the "keep data you might eventually need" principle.

Weren't there some cases where people had made anonymous answers but there was a way to find out that they had written such an answer?

"Don't keep data you don't need" is actually ~illegal (IANAL, obviously) in the UK.

No, the lesson is: "don't give companies data they don't need".

Retroactively, right?

I'm still amazed to this day that people give real names to their online accounts. I'd never put my real name anywhere online. It works quite well for me and if my data is leaked, I'm still ok. Probably I should use more email accounts to don't be linked, but it's fine anyway.

I think the success of Facebook and Google (being ad businesses) had a lot to do with this, i.e. "you are the product." If the trend to subscription businesses continues, do you think investors will approach how a company should scale differently?

This is a healthy mindset to have.

I feel that for every company that self-reports a leak, there are multiple other companies that have leaked your data and either haven't discovered the breach, refuse to disclose it, or flat out sold your data to the highest bidder.

Yeah, I tag every email address I give to a vendor, and I have for years. It has helped me discover a number of breaches.

The address I gave Quora isn't in the hands of spammers yet, which is a mildly good sign. But normally it takes a while for an address to get out to the bottom-feeders, so we'll see.

The only way to independently verify a leak is to have a third party create a couple of user accounts with unique passwords and setup a corresponding gmail / facebook honeypot account which would alert them to logins. If my quoraAcct2 password ever gets hacked and used to login to my fake gmail or facebook account, I know that quora was compromised. Works with any site.

Luckily your bank and your health provider probably have decent security, because those two industries face extra heavy fines for breaches.

Data is binary: it has either been already leaked, or not yet.

If they get your data from brokers they may be building comprehensive profiles about you without your explicit permission.

Brian Krebs recently posted about this:https://krebsonsecurity.com/2018/12/what-the-marriott-breach...

I have an email address that I've only ever used as my AWS account email since many years ago. Somehow I started getting spam on it last year. It is not an address anyone could guess or somehow generate based on other data points such as name or otherwise.

You wouldn't know where the data goes to anyway even without any unintentional leaks. No need to provide more than necessary.

That being said, I wonder if it's a good idea to extend KeePass to generate full credentials for given website.

This mindset reminds me of the following "laws":

Anything that can go wrong, will go wrong [0]. Anything that's isn't disallowed by quantum mechanics, will eventually happen [1].

So, if businesses made it cryptographically impossible to leak data, maybe it wouldn't happen, assuming it is even possible to make it impossible...

[0] https://en.wikiquote.org/wiki/Murphy%27s_law

[1] https://en.wikipedia.org/wiki/Totalitarian_principle

I’m going to guess that precisely nothing will happen to them under GDPR.

There can only be one digital forensics and security firm in the lead, right? All of the other firms are trailing...

This comment should be voted to the top of the conversation. "Hashed" means absolutely nothing these days.

It'd be useful in the sense that you'd be able to warn others, but for your own password you should be using a password manager with auto generated random passwords. That way the only thing you need to do is change one password on the leaked site.

As an example, consider an army attacking a defending army. The defending side is as good as the weakest member, because you can presume the attacking side to be looking for the weakest part and attacking that. On the other hand, the attacking side is as good as the strongest member, and having a few weaker members is ok. It is generally harder to make sure you have uniformly good defense, than getting a few really good people to spend dedicated time attacking.

Of course, this model assumes that as soon as you have penetrated the perimeter, the rest becomes easy. This is the more traditional model. People are increasingly adopting a you-are-already-hacked approach, which makes it harder to move laterally once someone gets in. However, the general challenge still applies.

It’s a whole lot of things, but first and foremost and probably the simplest explanation, security is hard. Incredibly hard.

Once you understand how difficult attack mitigation is, then you can pick and choose from a variety of factors:

- executives may not have a realistic understanding of how difficult attack mitigation is so they don’t allocate the resources for hiring

- incompetent admins overestimating their abilities

- competent admins who are underfunded

- incompetent admins who underestimate the value of the data they’re protecting

- competetent admins who may not have an accurate picture of what data they’re trying to protect so their threat model is flawed due to inaccurate information

- executives who are aware of how difficult mitigation is but don’t place customer data privacy as a priority.

- the current iteration of our growth obsessed corporate models unintentionally results in a race to the bottom in many ways.

- little incentive for companies to factor in social impacts as we don’t yet seem inclined to figure out a way to include impacts on society as one of the many metrics to measure a company’s success or failures.

It’s worth remembering though, even the most responsible, most well funded, most security conscious, and best staffed organizations have been compromised at one point or another—security is hard.

Information security is inherently asymmetric in offense vs defense:

Offense needs only one hole, whereas defense needs to plug all, including human behaviors. When the offensive side finds a new attack, they can often try and see which of the victim is vulnerable, thus the offense can pick and choose among many potential victims, whereas the defensive side needs to defend from all attackers. The information, once leaked, can't be recovered - i.e. once exploit is successful, there's no "recovery" available.

All of those factors combined make defense orders of magnitude more difficult - in terms of careful attention to detail, in terms of manpower, in terms of human training and vigilance, etc. For those reasons, the best defensive strategy is to minimize the information you need to protect.

No harm comes to the company after a breach so from their perspective there is no risk. Since there is no risk there is no need to improve security or reduce retained data.

It’s not really a security issue as much as an incentive issue.

Sadly, security is still hard in a lot of cases, and most everyone (product / developer / customer) is fixated on features and performance. Security is only important when it fails (very much like availability) - and by then it is really hard to retrofit.

In this particular case it doesn't seem too bad. Someone's name and address are not (or should not be) particularly sensitive information. Passwords are, and that's why best practices only keep a one-way function of the password ("encrypted" implies that it can be decrypted to plaintext, which should not be the case).

Luckily you can sign up for Quora with any name and email. You have to assume that no matter how hard a site tries to protect your info, it will get compromised sooner or later. The best they can do is what Quora does: demand as little info about you as they need.

It's not the companies, it's the internet itself. The internet is only composed of communication protocols, with security as an after-thought. The solution to this is incorporating security at the protocol layer, which is the end game of crypto platforms like Ethereum.

Effectively nobody is secure against an insider threat. Whereby I mean a sales agent who clicks offer.pdf.exe. Which allows an attacker to find your internal traffic stats billboard running last years unpatched drupal. Which has MySQL creds for your database sitting on it.

They aren't being incentiviced hard enough. Security costs money and can be inconvenient both for you and the users, which is not good for startups.

In addition to that, attackers only have to get lucky once, the defenders have to check every entryway.

In addition to what others mentioned, hackers usually got very high patience, it pays over time.

All of these appear filled out now.

Quora is good about responding quickly, which should be appreciated. That the FAQ wasn't fully filled out was just because it was being filled out. I know this can be an awkward experience for someone who immediately sees and responds to the tech news, but a bulk of their users won't be that profile. They got the framework for response laid out immediately, and are working on the responses. This seems pretty solid.

I'm half afraid that some sort of Cambridge Analytica type firm is buying these on the dark-net and merging all the data-sets together trying to put together even more accurate psychological profiles.

I wonder how easy it would be to piece together all these breaches with any degree of accuracy to build a "complete picture" of an individual.

Say your name, email address and social get leaked in one 500m user dump and your email passport number and actual address in another. I've never worked with datasets on this scale hence the ignorance.

Maybe its possible for one person of interest but how complicated would it be to match up everything?

From an email I got

---

What information was involved

The following information of yours may have been compromised:

Account and user information, e.g. name, email, IP, user ID, encrypted password, user account settings, personalization data

Public actions and content including drafts, e.g. questions, answers, comments, blog posts, upvotes

Data imported from linked networks when authorized by you, e.g. contacts, demographic information, interests, access tokens (now invalidated)

Non-public actions, e.g. answer requests, downvotes, thanks

Non-public content, e.g. direct messages, suggested edits

Questions and answers that were written anonymously are not affected by this breach as we do not store the identities of people who post anonymous content.

Well they probably sent a shit-ton of emails in a short timespan to notify most if not all users which could have triggered spam algorithms.

So you're under the impression Quota actually deletes all information related to your account when you click on delete? I'd be surprised.

> They are hiring people based on leet code questions and school prestige and not based on real technical knowledge about systems

Isn't that true for almost all companies based in the Sillicon Valley?

From the email that I received from Quora:

> the passwords were encrypted (hashed with a salt that varies for each user)

Looks like the article says the same thing.

Did a double take at this too, but they clarified that it means “hashed with a unique salt” later on. Not a good word choice for a summary though!

I hope they mean at least pbkdf2-hmac-sha256 with sufficient rounds.

Byond (2d tile/sprite based online gaming platform) does this. After a year of no activity they inactivate your account, and delete the hashed password. You have to reset your password to regain access.

Valid point. If you're aggressively farming data, so much so that you log them in automatically if they are logged into the google account then you better be careful with data too

> At this point the only solution is either SSO from a few point of trust (facebook, google, twitter, etc.)

No, that's what made OpenID awful. Your accounts all go down if one those "points of trust" get taken down for whatever (or no) reason.

They clarify that the passwords were indeed hashed and salted. "Encrypted" is just there to help the non-technical audience understand their passwords aren't exactly leaked in plaintext.

No details on the hashing scheme used though, so we don't really know how easy it'll be for the attacker to brute force the password hashes.

2FA when possible as well. Both Steam and Google offer this.

At least your password won’t be exposed in that case.

I see no lesson to be learned from the business perspective. If equifax can recover from their data loss, any company can.

Yes it is, when you have the surface area of a company like Quora, or even a much smaller company.

I worked at Quora, and totally unrelated, at my current company, had the opportunity to source and be point on multiple penetration tests. At my current company, I work with some people I consider extremely competent at SQL, and in particular PostgreSQL, but that didn't stop the pentesters from finding SQLi in our code. It sneaks in, and all it takes is one fuck up for a hacker to go to town.

I think that most startups don't understand the value of dropping 20-30k on an engagement with a competent pentest company, and this can propagate even longer into an org to the point that they never bother to get outside testing. Don't fall into that trap. Having a third-party with eyes on your org is worth every cent. If you run a startup or aspire to, I highly recommend you consider getting a pentest when you have ~5M ARR, and continue to do a yearly engagement to make sure your shit is covered until you can afford a full time security staff.

Rumors are that it was a disgruntled ex-employee.

I knew I had an account but it was via oauth and I had to create a "real" quora account in order to delete it. The notice that they were storing contacts from other social networks was the part that pushed me over the top towards deletion.

I also received an email, do not have an account, even a partially created one like you. Odd.

I too got one email and I'm not sure now if I'm affected (I got the same content as on the website in this email)

or a sage

I am angry at myself for signing up for this stupid quora. Nothing but advertising of offshore "web developers" explaining how their "product" can solve the "question" they asked with their fake accounts.

I would love to punch the CTO of this company in the nose with passion.

Yes, but they also allow organization accounts now, and they're rather slow at dealing with spam so around half the people you see are using fake names.

Seems like "encrypted" is in there for laymen and "hashed" being a clarification for more technical people. In the post they say: "... the passwords were encrypted (hashed with a salt that varies for each user) ..."

I believe you're being cynical, because this forced name policy allows for answers to be of higher quality, which is basically their entire selling point - being a better yahoo answers.

If you want anonymity there are other platforms for that, stackexchange for example.

It's not that hard to be as anonymous as you like on Quora. It's been a while since I contributed, because I got tired of their schizophrenic moderation, but I don't recall that mobile text authentication was necessary. Unlike say, Twitter. And even that isn't all that hard to get around, using hosted SIMs.

Are names validated?

I've got this meta schadenfreude seeing things succeed that HNers hate. The new MacBook Pro and any unicorn startup that posted a Show HN. It's cute how HNers actually think that they're relevant.

Just got my email from Quroa...Who writes this drivel:

Conclusion

It is our responsibility to make sure things like this don’t happen, and we failed to meet that responsibility. We recognize that in order to maintain user trust, we need to work very hard to make sure this does not happen again. There’s little hope of sharing and growing the world’s knowledge if those doing so cannot feel safe and secure, and cannot trust that their information will remain private. We are continuing to work very hard to remedy the situation, and we hope over time to prove that we are worthy of your trust.

Doesn't seem like every breach warrants someone to get fired. The Equifax breach makes sense, there was an obvious lack of due diligence to protect user's data. But we should wait to see the reason for the breach. Mistakes can happen even if the company was trying to protect user's data.

Zhihu (Chinese offshoot of Quora) does the exact same shit on mobile as a way to force users to download their app (which pushes a ton of ads plus other frills). Looks like they got their full playbook from Quora.

I don't think large companies have much interest in selling data. It's a long-term asset. The real money is in renting. E.g., Google and Facebook make a lot of money renting access to you based on the data they have. That's far more lucrative than selling the raw data once.

Also, it's implausible to me that selling the data wouldn't come out eventually. As we saw with Cambridge Analytica, even pretty obscure uses of data can eventually turn into giant media exposure for privacy breaches. The brand damage is is very expensive. Facebook's market cap is down something like $100 billion; there's no way they could have made that kind of money from trying to quietly sell copies of their data.

Selling the data outright is not worth anything. Public identities can be scrapped and bought very easily already. Most companies with personal and contextual data like this sell access to it, usually in the form of ads.

The long term cost / benefit for this sort of deal doesn't work in favour of the company selling their user's data

Well yeah because that is stupid.

The conspiracy is mostly in your head. No sane company would do this.