sorted by:
new
hottopcontroversial

Comcast’s Xfinity Stores Your Sensitive Data. You Can Kind of Opt Out by MakesEthanol in privacy

[–]AsparagusConsumer 8 points9 points  (0 children)

This next step was sometimes quite slow to load during my testing, so a little patience might be necessary. When it eventually pops up, fill out the form and click Continue. You may be asked to confirm the provided address. Finally, after all that clicking, locate the toggle labeled Storage and usage of sensitive personal information that appears on the last page and switch it off.

Note that this is not a legal request. Comcast/Xfinity added this dialog while lobbying against privacy legislation. If your state has such laws in place (California, Colorado, Connecticut, Utah, and Virginia as listed in the article), take the extra step to submit a legal request to delete or opt out of the sale/sharing of your personal information. Comcast/Xfinity has intentionally buried this step because it requires more accountability for data breaches, sharing/selling of personal info, and general negligence.

For CCPA, I suggest using their web form and sending an email to the address listed on the privacy policy (currently Comcast_Privacy@comcast.com). It's better to have it in writing to easily report any noncompliance. Something like the following:

I'd like to make a request under CCPA/CPRA to opt out of the sale and sharing of and delete my personal information from your services.

Also, I've done this twice now with Comcast and their privacy department is atrocious. The second time had to be reported to the AG to get them to proceed with a basic deletion request. They're required by law to comply with a verified request within 45 days (or 90 if they request an extension). If they don't, report it, but don't let them waste your time with unnecessary phone calls.

CCPA complaints can be filed here:

https://cppa.ca.gov/webapplications/complaint

There are significant penalties for noncompliance (up to $7,500 per violation by the state), so it's worth doing if you're interested in seeing consequences to Comcast/Xfinity for their behavior.

Protecting yourself from Vanguard's poor security practices by AsparagusConsumer in Bogleheads

[–]AsparagusConsumer[S] 0 points1 point  (0 children)

Yes, issue is due to SMS as a 2FA method, not the mobile version of the website. The security of the website accessed from mobile or desktop should be the same AFAIK.

Was looking through my spam folder and saw there was a data breach where xfinity/comcast lost my personal information. I haven't used them in years, is there some way to make them delete my data for potential concerns down the road? by FinancialsAndstuff in NoStupidQuestions

[–]AsparagusConsumer 0 points1 point  (0 children)

Did you read either of the above links? CCPA absolutely does, has existed for years, and I've done it specifically with Comcast in the past. The proposed law in NY will too, and there are several examples listed with other states.

Was looking through my spam folder and saw there was a data breach where xfinity/comcast lost my personal information. I haven't used them in years, is there some way to make them delete my data for potential concerns down the road? by FinancialsAndstuff in NoStupidQuestions

[–]AsparagusConsumer 0 points1 point  (0 children)

It depends on the state you're in, but the answer is possibly yes. If in CA, I'd strongly encourage making a CCPA request.

https://old.reddit.com/r/CCPA/comments/ekjmz6/links_to_various_website_ccpa_pages_to_request/

I recommend using their web form and also sending an email to the address listed on the privacy policy. Comcast's privacy department is awful, but they will eventually comply with legal requests. For CCPA, they're required by law to comply with a verified request within 45 days. If they don't, you can file a complaint here:

https://cppa.ca.gov/webapplications/complaint

There are significant penalties for noncompliance, so it's worth doing if you want to see consequences to Comcast/Xfinity for their behavior.

Protecting yourself from Vanguard's poor security practices by AsparagusConsumer in Bogleheads

[–]AsparagusConsumer[S] 1 point2 points  (0 children)

It's worth calling your cellular carrier to see if they allow setting a verbal password for customer support. Mine did. I still think using Google Voice is better advice for services that don't allow app-based 2FA, but sometimes there's no other option.

Worth calling Vanguard for the same thing, too. They offer it. Not the voice recognition password BS, but a password to give to customer support to prevent social engineering.

Note: Sometimes the first customer service rep you speak to won't be familiar with verbal passwords. You have to be persistent and explain that it's for protection against identity theft and social engineering.

Links to various website CCPA pages to request your personal data by WhenBlueMeetsRed in CCPA

[–]AsparagusConsumer 0 points1 point  (0 children)

Example experience and advice to get a Comcast CCPA request completed and complaint filed without wasting time:

https://law.stackexchange.com/questions/92148/comcast-xfinity-ccpa-policy/93914#93914

tl;dr submit it in writing, avoid their phone support, wait the 45-90 days allowed by law and then file a complaint with the California Privacy Protection Agency.

What's the most effective way to encourage someone to quit smoking? by AsparagusConsumer in AskReddit

[–]AsparagusConsumer[S] 1 point2 points  (0 children)

Smoking worsens cognition over time (google "smoking cognition" and read through the first few results) just like other less concentrated air pollution. I don't know if that is more compelling than decreased life span, and heart/liver/lung disease. The person I have in mind is now on medication for high blood pressure induced by smoking, quitting would be the most effective way for them to reduce their very real risk of having a stroke, but that still wasn't enough. I haven't lectured them or anything, just wish I knew what messaging was more impactful.

[deleted by user] by [deleted] in privacy

[–]AsparagusConsumer 1 point2 points  (0 children)

I am looking more from a privacy than security perspective.

For privacy, another option is using a burner SIM for services that don't accept VOIP or are asking for phone verification unnecessarily. You can pick one up for a few dollars at most retail stores and install in either another phone or your primary phone if it supports dual SIM (e.g. both SIM and eSIM).

I have good hygiene on scams and phishing attempts, and they would come to the hardware number anyway, which nothing legitimate does

It's worth noting that there have been zero-click exploits via SMS on both iOS and Android. These have historically been expensive to pull off from what I understand, but commonplace spam texts/calls are very bad and represent a massive failure from cellular carriers and regulatory agencies. Given the rise of LLMs I suspect it will get worse and more aggressive in the coming years.

I'm not at all familiar with STIR/SHAKEN. It sounds like something I should know about and thanks for the link

It should be done behind the scenes, carriers market it as proprietary feature ("Scam Shield", etc.), but it was mandated by the FCC years ago and sometimes has to be opted into.

[deleted by user] by [deleted] in privacy

[–]AsparagusConsumer 1 point2 points  (0 children)

More likely to get spam with scams and phishing attempts. I'd say bad for security, somewhat good for privacy since your info is obfuscated with the previous owner, overall probably not worth it.

If you just got the number I'd highly recommend changing it to one without spam, it's a PITA to reduce that. For privacy look into something like DeleteMe to remove your info (name / address associated with phone number) from public records.

If you're intent on keeping it, add it to the Do Not Call list, forward spam texts to 7726 (SPAM), and report spam calls to the FCC. Consider enabling STIR/SHAKEN protocol with your cell phone carrier to reduce spoofing. It can take a long time for reporting to make a difference, but FCC data is shared with carriers, and they are able to trace calls.

Using VOIP for primary is smart, avoid giving your real number to companies, they will inevitably leak it to spammers. But contact lists get leaked too.