This is always the answer. "How do we solve x in y industry?" Make the fucking corpos responsible for their own asses and it will get fixed. If it costs them more money to be breached they will do everything they can to not allow that.

They're too busy proposing legislation to create back doors that completely circumvent security in the first place.

Nah, throw the board members in prison. If the punishment for crime is a fine then it's legal for rich people/corps. Put 'em in solitary and feed them nutraloaf for one day for each person's data they allowed to be leaked.

If they get all the money because they're ultimately responsible, we should make them ultimately responsible.

As much as I agree that something needs to be done to these companies, and that they deserve punishment, I think this approach would only result in leaks (even more) underreported, which makes it even worse.

Article 82, paragraph 1 of the GDPR:

Any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered.

Paragraph 2:

Any controller involved in processing shall be liable for the damage caused by processing which infringes this Regulation

Article 24, paragraph 1:

**[T]he controller shall **implement appropriate technical and organisational measures to ensure and to be able to demonstrate that processing is performed in accordance with this Regulation.

Article 5, paragraph 1f:

Personal data shall be: […] processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss,

Article 83, paragraphs 2 and 5:

Each supervisory authority shall ensure that the imposition of administrative fines pursuant to this Article in respect of infringements of this Regulation referred to in paragraphs 4, 5 and 6 shall in each individual case be effective, proportionate and dissuasive.

Infringements of the following provisions shall, in accordance with paragraph 2, be subject to administrative fines up to 20 000 000 EUR, or in the case of an undertaking, up to 4 % of the total worldwide annual turnover of the preceding financial year, whichever is higher:

(a) the basic principles for processing, including conditions for consent, pursuant to Articles 5, 6, 7 and 9;

Article 4, paragraph 7:

‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data

(All quotes are excepts, emphasis mine

https://gdpr-info.eu/

They won't because fines are just a fee to allow them to run unethically. That way businesses get more profit than they would otherwise and government gets their cut to allow it. It's broken by design.

We should make a new internet in the dark web, but only invite cool people. No billionaires, narcs nor finks allowed !

Oh proton gives mobile too... Ya know I didn't feel like paying for the mail thing as I can have my domain and relay easily but the mobile thing I didn't know.

But I will be honest I didn't see it mentioned on the web, it's already a thing?

They’ll get justice, you’ll get a check in the mail for 3 dollars, after some lawyers win a class action lawsuit.

I don't think so.

Trump himself was victim of credential stuffing. And he's not the only politician or billionaire who has suffered stolen accounts of something.

I had an identity theft a few years back, still cleaning up from it. At the time I had the typical set of standard passwords that I would use. I thought they were ok since they were pretty random but I had one for Financial, one for Web Services, etc. so of course when the creds leaked, I suddenly had a bunch of credit card bills I never signed up for..

Since then, every password is unique, my default is 31 characters, and 2-factor for everything possible. Unfortunately I initially settled on LastPass, figured that they had hopefully learned their lesson from their breach years ago. Then it happened again recently and I moved to Bitwarden so that I can eventually migrate to a self-hosted solution.

I've been trying to get my family on board for years but it's still too complex. Non-technical folk still will take the path of least resistance, even when the dangers are right in front of their face. We need something better.

And everyone should just assume that every account they have will be hacked. Because it already is, they just haven’t found out yet (assume breach).

Work History ok... But entire life... I guess people that used like it's Facebook maybe? 🤔