How the Identity Portions of CCPA Regs Put Consumers and Businesses at Risk
summary
California regs let an account holder get data with password-only access, and non‑account requests pass if the business matches two-item KBA for categories or three-item KBA for specific records. A 2019 study shows ~40% of firms handed data with weak KBA, so compromised passwords become far more valuable. Regulations never require MFA, encourage security analytics but also allow consumers (or fraudsters) to opt out of data sharing for those signals, and CPRA’s 2023 tweaks leave that opt‑out gap intact. NIST standards exist but aren’t referenced.
AI-written summary · about
chapters (11)
- 0:00Start
- 0:36Is this a great way to do remote identity verification?
- 1:16The CCPA
- 2:25Setting the stage
- 4:56Armed with this study, what did California do?
- 5:50Let's first dig into passwords
- 10:37CCPA Authentication (In Summary)
- 11:25$999.325. Verification for Non-Accountholders
- 13:24Maybe it won't be a total disaster
- 14:47CPRA-they're trying
- 15:42CPRA and Verifiable Consumer Requests
related talks
01h 07mStrategic Goals and Mechanisms of the GDPR and CCPA
46mHow to Design and Execute Superior Employee Privacy Practices
25mWhen GDPR and CCPA strike
22mGDPArrrrr: Using Privacy Laws to Steal Identities
55mBattle for online privacy
26mPrivacy Issues in Big Data Processing in light of Data Breaches
05mHow to defend your data security policies to the privacy regulators in the United States
22mPersonal Information Leakage by Abusing the GDPR 'Right of Access'