<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><br class=""><div><blockquote type="cite" class=""><div class="">On Feb 28, 2017, at 11:52 AM, Morgan Reed <<a href="mailto:morgan@darkglade.com" class="">morgan@darkglade.com</a>> wrote:</div><div class=""><div dir="ltr" class=""><div class="gmail_extra"><div class="gmail_quote"><div class=""><br class=""></div><div class="">PCI and the like helps, but that only applies to specific parts of the market, there are still plenty of players out there who have enough PII about people to allow their ID to be stolen.<br class=""></div></div></div></div></div></blockquote><div><br class=""></div>Target was PCI compliant. </div><div><br class=""></div><div>Catchoftheday was PCI compliant, nobody found out about their data breaches until three years later.</div><div><br class=""></div><div>PCI compliance doesn’t help at all. It’s orthogonal to this problem space, it protects credit card issuers, not users. The only thing it tries to protect is transaction records, and even then it only protects them to the extent necessary to avoid <i class="">en masse </i>disclosure of (name, credit card, expiry, CVV) tuples.</div><div><br class=""><blockquote type="cite" class=""><div class=""><div dir="ltr" class=""><div class="gmail_extra"><div class="gmail_quote"><div class="">Mandatory breach notification will at least mean that you KNOW your info was stolen, so you can do something about it, versus finding out three to six months down the line when you start getting calls from debt collectors chasing you for payments on the half-dozen or more credit cards that have been signed up in your name and then maxed out.<br class=""></div></div></div></div>
</div></blockquote></div><br class=""><div class="">Yep, this.</div><div class=""><br class=""></div><div class="">If you’re a small or large org, and I’m your customer, and you don’t secure MY data, you can go and die in a goddamn fire. I don’t care how much it affects your profitability, if I’ve disclosed valuable personal information to you, you have a responsibility to do whatever it takes to deserve my trust.</div><div class=""><br class=""></div><div class="">If you’re upset because your products or business practices are so hopelessly insecure that adequately discharging that responsibility makes you unprofitable, then cry me a river. You shouldn’t be in business.</div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""> - mark</div><div class=""><br class=""></div><div class=""><br class=""></div></body></html>