These include scans of documents that prove the model's age, things like ID cards, birth certificates, and passport scans. Also included were performer release forms and profile information. This is particularly bad given the sensitive nature of the work and the need to maintain the personal privacy and safety of the X-rated web stars. There is also the risk that, as the records from virtually every occupied part of the world, that LGBTQ+ performers in some areas could be at risk of persecution.
back
2 comments
Persecution is putting it mildly. It could put people at physical risk of harm.
s/could/just did
Even discarding things like prejudice, cammers have stalker problems fairly regularly as I understand it.
When you can get doxxed by a traffic sign reflected in your eyes ... https://www.bbc.com/news/world-asia-50000234
jesus h, that's insane.
I can't remember which community this was, but I remember some forum that had a category dedicated to something similar (with consent).
People would post pictures of the view from their hotel window when travelling and the other members would compete in being the first to find the exact location.
When I say exact, I mean exact. They had to find from which window the picture was taken.
It amazed me how some people could figure it out in a few hours and sometimes even less. Only post pictures online if you are alright with being doxxed from them.
I remember 4chan doing something similar with a project Shia Labeouf was doing: https://www.vice.com/en_us/article/d7eddj/4chan-does-first-g...
https://old.reddit.com/r/FridgeDetective/ is the benign-ish version of this.
Wow. Bellingcat, but for stalking and sexual assault.
I think some commenters might be missing that in many countries like China (where the article shows a passport photo) engaging in pornography is illegal. This leak has the opportunity to ruin lives in many ways.
Another reason to never send IDs "required" by many companies today .. using email or their app
That's easy for you to say as someone that I'm assuming isn't trying to become a cam model. These people wouldn't have been able to get the job without sending the verifying information, and you don't know their circumstances. Saying "just don't do the thing," without nuance or context is just ignorant.
I disagree.
People are going to do it, but it needs to be understood that there are major risks with doing it.
This last point of 'understanding' is what makes this issue so hard to address for any non-technical userbase. Most people don't even really think about the fact that the "Cloud" is really just someone else's computer. Deloitte did a study recently where they concluded that although privacy is users' #1 concern, most people don't change their behavior. When you combine that with people who don't understand how technology works--but need to get paid--I don't see a good solution where they have any incentive not to take risks. The companies creating these sites don't have an incentive to put up a banner saying "You might not want to sign up for this, we might leak your data." Perhaps some legal disclosure of the risks when providing different levels of PII, just like we have Surgeon General warnings?
I'm going to use an analogy to explain why I responded in the first place.
We tell kids "just don't do drugs" for lots of reasons. No one would ever suggest with a straight face that we shouldn't tell children this because some of them will end up doing the drugs anyway due to all manner of reason, including their circumstances.
What? I absolutely would suggest with a straight face that we shouldn't tell are kids that. It's more complicated than that, and lumping all drugs together seems to do more harm than good, judging by the failure of the DARE program.
is it really more complicated than that?
I bet your argument is going to be "but alcohol is technically a drug", at which point I'm going to roll my eyes so hard they roll out the door.
US law requires that the cam site have valid 18+ IDs on file for everyone naked on screen.
Would a redacted document with just the number be enough? The government can still figure it out if there's an investigation, but at least leaks are somewhat contained; you can't do much with a passport number alone unless you have another leaked DB that maps these numbers to other details, and even then it slightly increases the effort required for someone to identify you (they can't just Ctrl+F your name in the data dump).
As a cam site operator, you have a legal obligation to keep a record of their ID as proof of age. Keeping just the ID’s number isn’t sufficient.
Could they have firewalled the data better? Hell yeah, there’s a long list of ways this could have been done more responsibly.
I’m in the industry and we take the security of this data very seriously. Very few folks have access to IDs once age verification has happened.
The problem is that anyone can claim they take security seriously (and I'm sure this site did as well), but as a user there's no way to tell whether it's actually true. There's also the risk that the data being secure now becomes less secure later on when the company decides to cut costs.
Totally agree with you. I wish folks used better technical solutions that made a breach like this impossible. It’s the ethical thing to do - this breach will directly cause people to come to physical harm.
What about fintech KYC APIs? Are those sufficiently compliant?
From reading the other comments my understanding is that you need to keep the document itself, where as most KYC companies will verify the document (and potentially other factors such as credit history) but then discard it and only give you a pass/fail status code.
This is correct. Fintech (and gambling, which I am intimately familiar with) companies are required to keep the submitted KYC documents on file for several years from the last customer interaction/activity.
You can't even delete dud uploads. If a customer is involved in fraud or money laundering investigation, every document they have ever uploaded is evidence. So is the type, time and timing of different uploads: in fact, the uploading of a bad document is itself a valid and potentially valuable data point. Multiple uploads in tight sequence with duds in the mix? Hello...
The submitted KYC documentation is TOXIC. It is essentially an archive to impersonate customers. Hell, I consider the material so dangerous that we built a dedicated protection system to guarantee the fraud potential of our archive would be seriously limited even if the whole archive leaked[0].
0: https://smarketshq.com/shields-up-on-user-information-b7093f...
> Would a redacted document with just the number be enough?
Nope, in US law. Full copies are required of primary producers; redistributors are allowed to have copies with some redactions.
i always redact the PII part. so for example i cannot sign up at all of the verification required proof of age. because birthdate will be redacted.
so far, if the tiny number of places i’ve needed to send a DL or something, no one has complained that it’s pretty much just my name and picture. i imagine the staff checking isn’t paid enough to care.
So you don't use AirBnB?
I stayed in one AirBnB where there was a book on a shelf in the living room. I opened it, and it was the name, passport number, date, and some other information I can't recall for every past guest.
It's a risk vs reward scenario. The data leaking from Airbnb is bad, but nowhere near as bad as the data leaking from a porn site. You might be willing to take the risk with the former but not the latter.
The main damage here isn't the data leaking (it's already out there thanks to countless other breaches anyway), it's the data leaking and the association with the porn site.