11 ms·

I don't condone this hack, but morals/ethics aside for a moment: The one positive thing this hack has done is really give serious ammo to the battle for online

by smtddr 11y ago

I don't condone this hack, but morals/ethics aside for a moment: The one positive thing this hack has done is really give serious ammo to the battle for online privacy, because the demographic hit by this hack is the most politically & economically powerful demographic in the world....

jgrahamc 11y ago
One positive thing this hack has done is really give serious ammo to the battle for online privacy How?
- kinghajj 11y ago
  It's literally the next phrase in the sentence: > because the demographic hit by this hack is the most politically & economically powerful demographic in the world.... They're saying that because those affected have the ability to actualize change, it's more likely that some action will be taken to further online privacy.
- ewzimm 11y ago
  It's basically the strategy John Oliver used to raise awareness about government surveillance. Most people don't care about privacy until it gets sexual. https://cantheyseemydick.com/ https://cantheyseemydick.com/
  - btilly 11y ago
    They missed a great straight line. "But if they realize that your dick is American, they do try to forget that they saw your dick."
ck2 11y ago
You'd think the 1986 law that allows any entity in the government can read anyone's email is bigger ammo It's the ultimate hack, because it's in plain sight and somehow no-one cares. But run your own private email server in your home to prevent warrantless abuse and everyone loses their damn minds.
- joelrunyon 11y ago
  Why can't both be bad and unacceptable? Playing the shades of grey game is a great wait to force dissent in an area that should incite cooperation.
  - ck2 11y ago
    Of course they are both "bad" - it is a matter of degrees. One is a lazy, immoral company started on a whim that took off and "surprise" they ran their business in a lazy immoral way. The other is government sanctioned, taxpayer funded, broadly used abuse of police powers without oversight, based on a law that is 30 years old.
cookiecaper 11y ago
This is going to have some long-lasting repercussions on the industry. I fully expect there to be a push in the legislature to require PCI-like compliance from anyone who takes "sensitive data". That would have very serious effects for the startup community.
- Scarbutt 11y ago
  I wish the push was more of a law that let users delete their data immediately and completely from a service with the click of a button.
  - FilterSweep 11y ago
    I second those wishes, but thats feasibly impossible without vast auditing resources. DB backups, logging, and the general "archive-first" nature of the modern web essentially prevents this from happening.....even if service providers wanted to give this opportunity to its users...and most do not.
    - Scarbutt 11y ago
      that's true, but if such law was implemented, services providers will now have to think about running things legally or illegally.
  - superuser2 11y ago
    Any architecture that facilitates this will lose massive amounts of customer data, full stop. Backups have to be in places where live systems can't touch them, or can append only. Backups have to be offline and immutable. If you can mutate a backup based on a user request, it's not a backup. Offline backups are, however, pretty hard to steal (unless you're stealing the physical tapes). So... immediately, maybe. Completely, no fucking way.
    - icebraining 11y ago
      That's what encryption is for - burn the key, and the backups are useless even if they're immutable.
vezzy-fnord 11y ago
I'd argue the opposite. The AM hack hasn't helped at all, since enough people view it as a just retribution due to it being about a pet moral value that is held dear, namely marital fidelity. And to others, it's all a big joke. The cheating cheaters (who likely never got the opportunity to cheat) have been named and shamed, and because of those asserting that it's acceptable to do this if it strokes their personal moral vendetta, then this type of chilling privacy violation is on its way to being normalized.
- nostrebored 11y ago
  Yeah, well if you engage in a promise with someone that you're going to be in a monogamous relationship -- let's be real, that's what marriage is for the vast majority -- you're a prick if you attempt to break that commitment, and again, that's what being on AM is about. Pretending otherwise is delusional, and having morals isn't a bad thing. Is doxxing always unethical?
  - sbarre 11y ago
    Yes, it absolutely is always unethical. Who are you, or anyone else, to question or evaluate "commitment" in a relationship that you have no part of, and know nothing about? Or to force someone's personal private life out in the open where it will be used to judge them without context? Nothing is as black and white as you are claiming it to be.
    - chrischen 11y ago
      Privacy isn't a natural right, just like lying to someone via marriage isn't universally considered unethical. Your right to privacy isn't naturally guaranteed, and is only granted by some mutually agreed upon rules in the form of privacy laws. But if I know some fact about you, what gives you any right to say I can't reveal that information? Wouldn't you be limiting my speech? If you argue that lying in marriage is a complex issue, then privacy rights is also a complex issue that's not black and white. A world with no secrets and a world where everyone has a right to secrecy are both potentially equally valid.
x0x0 11y ago
What I find weirdest about the whole thing is the data wasn't sold back to Ashley Madison. The hacker(s) could have leaked 10 or 20 juicy names then probably cleared $10 million dollars or better. It would have been a bargain to Ashley Madison at that price.
- eghri 11y ago
  The problem with digital data is that it can be replicated at no cost and with no trace, so there wouldn't be any way for Ashley Madison to ever be sure the leak was contained. They could pay $10MM for a copy of the data... and two months later it can anonymously show up on Tor. Not to mention the hackers would need to come forward to collect the $10MM, which might land them in a jail cell before they can collect.
  - gwern 11y ago
    There is no need for it to be a lump sum. A (much smaller) regular monthly payment to a Bitcoin address is perfectly adequate a mechanism.
    - bduerst 11y ago
      >"Perfectly Adequate" All bitcoin transactions are public record, and even if you tumble you are setting yourself for getting caught by repeatedly doing the same actions. Besides, the value of the information decreases over time, meaning you're going to be making the large payments up front.
      - gwern 11y ago
        > even if you tumble you are setting yourself for getting caught by repeatedly doing the same actions. By doing what? Making payments to an address? > Besides, the value of the information decreases over time, meaning you're going to be making the large payments up front. Any lumpsum can be structured as an equivalent series of regular payments. Whatever the present value of not having the data released is, it can be turned into a set of finite or indefinite payments, which last 1 year or 5 years or 10 years or however long the company feels the harm will be non-neglible. And by doing this, you still get the anti-defecting incentive of a stream rather than one-off payment.
serve_yay 11y ago
I hadn't considered that, but it's an interesting point. That said, all the standard moralizing accompanying this is so gross.
- nostrebored 11y ago
  What would you prefer, some amorphous undefinable moral relativism where everyone is somehow a good person, and we're all the same? Public shaming is a pretty decent prosocial incentive.
  - ori_b 11y ago
    How about people not sticking their noses into other people's relationships? We used to have the state jail, or even torture, adulterers. Society eventually agreed that it's not their job to do that. Let's hold off on forming lynch mobs.
    - nostrebored 11y ago
      Where are the lynch mobs? For the vast majority of these people, they're being called assholes because they were being assholes. I'm okay with that. The same "not sticking our noses into other people's relationships" was the root of the Family Values crowd in the 80's saying that domestic violence is a family issue, incest is a family issue, etc. Where do you draw the line at sticking your nose into other people's relationships? I find public shaming for deplorable behavior to be perfectly fine. And if a ton of these people are non-monogamous, then perhaps we as a society should have a discussion abuot how our values are shifting and what new families look like, but something tells me that there aren't suddenly millions of non-monogamous marriages.
      - vezzy-fnord 11y ago
        They're not just being called assholes, they're having all personal and financial details dumped in the process. There's a difference. We've generally determined that sexual practices, as long as they're consensual and do not involve harm to anyone outside the participants themselves, should not be subject to persecution. This includes incest, as much as it may disgust you. A lot of people are disgusted by coprophagia, that doesn't mean we should publicly shame people for having sexual tastes that aren't to our fancy. It is as arbitrary as shaming people for musical preferences. Domestic violence is a wholly separate problem altogether. There's nothing that doxing will do to solve it.
gyardley 11y ago
Politically and economically powerful people don't need some obviously-for-suckers website to have an affair.
- differentView 11y ago
  How would you have an affair if you're politically and economically powerful?
  - mahouse 11y ago
    Cucking has existed since forever, for both the poor and the wealthy.
  - tedunangst 11y ago
    Call up the local high end madam and ask for a "date".
    - differentView 11y ago
      Maybe some of them fear that using professional escort services make them bigger targets for blackmail or their information will be used to cut deals when the escort service is busted. Also, some may be looking for more than sex with professionals.
  - anigbrowl 11y ago
    You trade money/favors for discretion from the smallest number of people possible, with the unspoken implication that if they betray you'll spend at least as much on inconveniencing them afterward.
pascalmemories 11y ago
Unfortunately, that's not how the "politically & economically powerful demographic in the world" works. What you will see is lots of new laws to crack down on hackers, encryption and any type of computing not specifically 'approved' by some sort of security overlord department. Look at what the UK is proposing (way before AM became news) and you'll have a rough starting point. The laws will be the exact opposite of improved privacy.
- ryandrake 11y ago
  And, the laws that we really need, namely harsh criminal penalties for companies negligently handling people's private data, will be absent.
- patcon 11y ago
  Yes, but then someone creates a network for cheater spouses that gets in the news cycle because it's "impossible to hack due to futuristic maths" (ie. peer-to-peer). And now suddenly something decentralized and provably private seems very interesting and practical to those who were previously interested in legislative solutions. But I'm an optimist :)
jjtheblunt 11y ago
How do you figure? Seems that the demographic hit is just a bunch of people with dysfunctional people skills.
Nelson69 11y ago
What ammo? Some people of questionable ethic and questionable intelligence gave a third party incriminating information about themselves and also gave them money all while hoping for discretion. (I say questionable intelligence because the real rich and powerful use different services provided by different people..) Any privacy agreement was a private one between 2 parties, at best covered by civil law, maybe Canadian civil law. Certainly nothing binding in any substantial way was signed. It's certainly making light of online privacy but I'm not sure there is a battle here, it's just demonstrating that it's still very much the wild west out there. What should happen here? Should AM pay a fine to some government? Class action law suit? (I think that idea is particularly hilarious..) Riddle me this, so suppose AM goes bankrupt. Can their creditors just take that data and sell it? It's an asset, right? Is it possible for a EULA or some sort of agreement to prevent that? Hackers or not, all that information could be in someone else' hands, that the users have no agreement with. AM is sort of the poster child for these problems but you may have given a lot of information to companies that you wouldn't want other companies to have.
Eric_WVGG 11y ago
If anyone here is a science fiction fan (seems unlikely right?), there's a great comic called The Private Eye which takes place in a society which experienced a fallout from an event not unlike this (though on an even larger scale). https://en.wikipedia.org/wiki/The_Private_Eye https://en.wikipedia.org/wiki/The_Private_Eye http://panelsyndicate.com http://panelsyndicate.com, "pay what you like"
walshemj 11y ago
I could defiantly see some stricter privacy laws being passed - also might I'mpact google etc if they have to start vetting staff in the same way big telcos do. Back in my BT days I knew team leaders who had to get PV'd (aka TS) clearance.
jsn117 11y ago
One day Tinder will be hacked like this as well, imagine the fallout.
- CamperBob2 11y ago
  I've never used Tinder -- do you have to give your real name and/or billing info to sign up with it?
  - mahmud 11y ago
    You login with your Facebook credentials.
s73v3r 11y ago
Not really. If anything, it's done the opposite, because people were all happy that "a bunch of cheaters got what they deserved."
CyberDildonics 11y ago
It shows the solution really. Turn the focus on the people making decisions. Put them under surveillance and see if they still think everyone needs to have all their communication public for their own safety.

by smtddr 11y ago

jgrahamc 11y ago

One positive thing this hack has done is really give serious ammo to the battle for online privacy How?

kinghajj 11y ago
It's literally the next phrase in the sentence: > because the demographic hit by this hack is the most politically & economically powerful demographic in the world.... They're saying that because those affected have the ability to actualize change, it's more likely that some action will be taken to further online privacy.
ewzimm 11y ago
It's basically the strategy John Oliver used to raise awareness about government surveillance. Most people don't care about privacy until it gets sexual. https://cantheyseemydick.com/ https://cantheyseemydick.com/
- btilly 11y ago
  They missed a great straight line. "But if they realize that your dick is American, they do try to forget that they saw your dick."

ck2 11y ago

You'd think the 1986 law that allows any entity in the government can read anyone's email is bigger ammo It's the ultimate hack, because it's in plain sight and somehow no-one cares. But run your own private email server in your home to prevent warrantless abuse and everyone loses their damn minds.

joelrunyon 11y ago
Why can't both be bad and unacceptable? Playing the shades of grey game is a great wait to force dissent in an area that should incite cooperation.
- ck2 11y ago
  Of course they are both "bad" - it is a matter of degrees. One is a lazy, immoral company started on a whim that took off and "surprise" they ran their business in a lazy immoral way. The other is government sanctioned, taxpayer funded, broadly used abuse of police powers without oversight, based on a law that is 30 years old.

cookiecaper 11y ago

This is going to have some long-lasting repercussions on the industry. I fully expect there to be a push in the legislature to require PCI-like compliance from anyone who takes "sensitive data". That would have very serious effects for the startup community.

Scarbutt 11y ago
I wish the push was more of a law that let users delete their data immediately and completely from a service with the click of a button.
- FilterSweep 11y ago
  I second those wishes, but thats feasibly impossible without vast auditing resources. DB backups, logging, and the general "archive-first" nature of the modern web essentially prevents this from happening.....even if service providers wanted to give this opportunity to its users...and most do not.
  - Scarbutt 11y ago
    that's true, but if such law was implemented, services providers will now have to think about running things legally or illegally.
- superuser2 11y ago
  Any architecture that facilitates this will lose massive amounts of customer data, full stop. Backups have to be in places where live systems can't touch them, or can append only. Backups have to be offline and immutable. If you can mutate a backup based on a user request, it's not a backup. Offline backups are, however, pretty hard to steal (unless you're stealing the physical tapes). So... immediately, maybe. Completely, no fucking way.
  - icebraining 11y ago
    That's what encryption is for - burn the key, and the backups are useless even if they're immutable.

vezzy-fnord 11y ago

I'd argue the opposite. The AM hack hasn't helped at all, since enough people view it as a just retribution due to it being about a pet moral value that is held dear, namely marital fidelity. And to others, it's all a big joke. The cheating cheaters (who likely never got the opportunity to cheat) have been named and shamed, and because of those asserting that it's acceptable to do this if it strokes their personal moral vendetta, then this type of chilling privacy violation is on its way to being normalized.

nostrebored 11y ago
Yeah, well if you engage in a promise with someone that you're going to be in a monogamous relationship -- let's be real, that's what marriage is for the vast majority -- you're a prick if you attempt to break that commitment, and again, that's what being on AM is about. Pretending otherwise is delusional, and having morals isn't a bad thing. Is doxxing always unethical?
- sbarre 11y ago
  Yes, it absolutely is always unethical. Who are you, or anyone else, to question or evaluate "commitment" in a relationship that you have no part of, and know nothing about? Or to force someone's personal private life out in the open where it will be used to judge them without context? Nothing is as black and white as you are claiming it to be.
  - chrischen 11y ago
    Privacy isn't a natural right, just like lying to someone via marriage isn't universally considered unethical. Your right to privacy isn't naturally guaranteed, and is only granted by some mutually agreed upon rules in the form of privacy laws. But if I know some fact about you, what gives you any right to say I can't reveal that information? Wouldn't you be limiting my speech? If you argue that lying in marriage is a complex issue, then privacy rights is also a complex issue that's not black and white. A world with no secrets and a world where everyone has a right to secrecy are both potentially equally valid.

x0x0 11y ago

What I find weirdest about the whole thing is the data wasn't sold back to Ashley Madison. The hacker(s) could have leaked 10 or 20 juicy names then probably cleared $10 million dollars or better. It would have been a bargain to Ashley Madison at that price.

eghri 11y ago
The problem with digital data is that it can be replicated at no cost and with no trace, so there wouldn't be any way for Ashley Madison to ever be sure the leak was contained. They could pay $10MM for a copy of the data... and two months later it can anonymously show up on Tor. Not to mention the hackers would need to come forward to collect the $10MM, which might land them in a jail cell before they can collect.
- gwern 11y ago
  There is no need for it to be a lump sum. A (much smaller) regular monthly payment to a Bitcoin address is perfectly adequate a mechanism.
  - bduerst 11y ago
    >"Perfectly Adequate" All bitcoin transactions are public record, and even if you tumble you are setting yourself for getting caught by repeatedly doing the same actions. Besides, the value of the information decreases over time, meaning you're going to be making the large payments up front.
    - gwern 11y ago
      > even if you tumble you are setting yourself for getting caught by repeatedly doing the same actions. By doing what? Making payments to an address? > Besides, the value of the information decreases over time, meaning you're going to be making the large payments up front. Any lumpsum can be structured as an equivalent series of regular payments. Whatever the present value of not having the data released is, it can be turned into a set of finite or indefinite payments, which last 1 year or 5 years or 10 years or however long the company feels the harm will be non-neglible. And by doing this, you still get the anti-defecting incentive of a stream rather than one-off payment.

serve_yay 11y ago

I hadn't considered that, but it's an interesting point. That said, all the standard moralizing accompanying this is so gross.

nostrebored 11y ago
What would you prefer, some amorphous undefinable moral relativism where everyone is somehow a good person, and we're all the same? Public shaming is a pretty decent prosocial incentive.
- ori_b 11y ago
  How about people not sticking their noses into other people's relationships? We used to have the state jail, or even torture, adulterers. Society eventually agreed that it's not their job to do that. Let's hold off on forming lynch mobs.
  - nostrebored 11y ago
    Where are the lynch mobs? For the vast majority of these people, they're being called assholes because they were being assholes. I'm okay with that. The same "not sticking our noses into other people's relationships" was the root of the Family Values crowd in the 80's saying that domestic violence is a family issue, incest is a family issue, etc. Where do you draw the line at sticking your nose into other people's relationships? I find public shaming for deplorable behavior to be perfectly fine. And if a ton of these people are non-monogamous, then perhaps we as a society should have a discussion abuot how our values are shifting and what new families look like, but something tells me that there aren't suddenly millions of non-monogamous marriages.
    - vezzy-fnord 11y ago
      They're not just being called assholes, they're having all personal and financial details dumped in the process. There's a difference. We've generally determined that sexual practices, as long as they're consensual and do not involve harm to anyone outside the participants themselves, should not be subject to persecution. This includes incest, as much as it may disgust you. A lot of people are disgusted by coprophagia, that doesn't mean we should publicly shame people for having sexual tastes that aren't to our fancy. It is as arbitrary as shaming people for musical preferences. Domestic violence is a wholly separate problem altogether. There's nothing that doxing will do to solve it.

gyardley 11y ago

Politically and economically powerful people don't need some obviously-for-suckers website to have an affair.

differentView 11y ago
How would you have an affair if you're politically and economically powerful?
- mahouse 11y ago
  Cucking has existed since forever, for both the poor and the wealthy.
- tedunangst 11y ago
  Call up the local high end madam and ask for a "date".
  - differentView 11y ago
    Maybe some of them fear that using professional escort services make them bigger targets for blackmail or their information will be used to cut deals when the escort service is busted. Also, some may be looking for more than sex with professionals.
- anigbrowl 11y ago
  You trade money/favors for discretion from the smallest number of people possible, with the unspoken implication that if they betray you'll spend at least as much on inconveniencing them afterward.

pascalmemories 11y ago

Unfortunately, that's not how the "politically & economically powerful demographic in the world" works. What you will see is lots of new laws to crack down on hackers, encryption and any type of computing not specifically 'approved' by some sort of security overlord department. Look at what the UK is proposing (way before AM became news) and you'll have a rough starting point. The laws will be the exact opposite of improved privacy.

ryandrake 11y ago
And, the laws that we really need, namely harsh criminal penalties for companies negligently handling people's private data, will be absent.
patcon 11y ago
Yes, but then someone creates a network for cheater spouses that gets in the news cycle because it's "impossible to hack due to futuristic maths" (ie. peer-to-peer). And now suddenly something decentralized and provably private seems very interesting and practical to those who were previously interested in legislative solutions. But I'm an optimist :)

jjtheblunt 11y ago

How do you figure? Seems that the demographic hit is just a bunch of people with dysfunctional people skills.

Nelson69 11y ago

What ammo? Some people of questionable ethic and questionable intelligence gave a third party incriminating information about themselves and also gave them money all while hoping for discretion. (I say questionable intelligence because the real rich and powerful use different services provided by different people..) Any privacy agreement was a private one between 2 parties, at best covered by civil law, maybe Canadian civil law. Certainly nothing binding in any substantial way was signed. It's certainly making light of online privacy but I'm not sure there is a battle here, it's just demonstrating that it's still very much the wild west out there. What should happen here? Should AM pay a fine to some government? Class action law suit? (I think that idea is particularly hilarious..) Riddle me this, so suppose AM goes bankrupt. Can their creditors just take that data and sell it? It's an asset, right? Is it possible for a EULA or some sort of agreement to prevent that? Hackers or not, all that information could be in someone else' hands, that the users have no agreement with. AM is sort of the poster child for these problems but you may have given a lot of information to companies that you wouldn't want other companies to have.

Eric_WVGG 11y ago

If anyone here is a science fiction fan (seems unlikely right?), there's a great comic called The Private Eye which takes place in a society which experienced a fallout from an event not unlike this (though on an even larger scale). https://en.wikipedia.org/wiki/The_Private_Eye https://en.wikipedia.org/wiki/The_Private_Eye http://panelsyndicate.com http://panelsyndicate.com, "pay what you like"

walshemj 11y ago

I could defiantly see some stricter privacy laws being passed - also might I'mpact google etc if they have to start vetting staff in the same way big telcos do. Back in my BT days I knew team leaders who had to get PV'd (aka TS) clearance.

jsn117 11y ago

One day Tinder will be hacked like this as well, imagine the fallout.

CamperBob2 11y ago
I've never used Tinder -- do you have to give your real name and/or billing info to sign up with it?
- mahmud 11y ago
  You login with your Facebook credentials.

s73v3r 11y ago

Not really. If anything, it's done the opposite, because people were all happy that "a bunch of cheaters got what they deserved."

CyberDildonics 11y ago

It shows the solution really. Turn the focus on the people making decisions. Put them under surveillance and see if they still think everyone needs to have all their communication public for their own safety.