https://news.asu.edu/20160126-creativity-lawrence-krauss-erd...
> Do they know about every breach out there without fail?
They know about a lot of them. I'd hazard a guess that at least three quarters of the affected accounts would have been in HIBP, probably far more.
As for myself, I liked reading about some bits of Chinese history that I was not very familiar with, and it also provides a really good foundation for the reason behind the lead character's far-reaching actions. I also do think the best parts of the story do come later in books 2 and 3 - I like the larger-than-life ideas and the imperfect characters.
* I'll always bring up The Three-body problem because I re-read it every year
* Piranesi because of it's fantastical story-telling
* The Covenant of Water - because it's a fantastic medical drama and a sweeping story spanning generations
* Victory City - Salamn Rushdie's latest novel which is surprisingly readable
* The Enchanted Forest/Kaikeyi/Palace of Illusions - because they cover the major Indian epics from the lens of the women characters (think Circe with an Indian background)
* Trust - The same story told from different viewpoints with a setting in the early NY financial world, which makes it extra interesting
I notice that I do tend to favour books with an Indian background because of my nostalgia for it as I live in a foreign land. Maybe I'll branch out more next year!
How come all online VISA transactions don't have to completed through a redirect to visa.com or master.com (or may bank website), but instead we're typing card numbers into sketchy websites? (I guess EU 2FA requirements are pushing the boundary, but very slowly and often in ways that still appear remarkably sketchy).
Trust scores of IPs and phones numbers is a tool, but when physically hardened security tokens aren't widely supported, I'd argue the essential tools simply aren't available to users.
I support your argument about Yubikeys - I myself use them for any financial site that allows it. A lot of companies do use them to check for fraudulent logins. But the friction of it is high enough that companies would much rather take the loss than force their customers to authenticate every time a transaction has to be made. Also, I think until it is normalized in the industry, there is a consumer perception of physical keys being too technically difficult to obtain, set up and manage. Not to mention, all the Yubikeys in the world still don't help if one goes and gets phished/socially engineered :)
The question here isn't (primarily at least) whether this is a good or bad thing, the important question is if this arrangement is legal under EU law. It can be the most beneficial thing in the world and still be illegal.
1. The former is likely using a throwaway phone number, the latter is using an established phone number. You can tell the difference with the number of completed calls over time, call duration etc. Burner phones will have bursts of high intensity activity to several different phone numbers whereas legitimate phones will have lots of successfully completed phone calls over a long period of time to repeating phone numbers.
2. The former will likely place calls all over the country or world as they attempt to raid several bank accounts digitally. The latter will probably have more local calls since they're calling their doctors, schools, etc. This is probably where range activity plays a role.
I'm not defending Telesign or how they collect data - I'm merely saying this data has value in account protection.