5 ms·

That's not the biggest concern. The biggest concern is SSN AND CREDIT CARD INFO being compromised. Priorities, folks. With someone having this info, an authoriz

That's not the biggest concern. The biggest concern is SSN AND CREDIT CARD INFO being compromised. Priorities, folks. With someone having this info, an authorized two-step or two-factor authentication process is a joke in comparison. What advanced type of stupid makes articles like this seem completely fine to individuals in the tech sector?

mikelward 11y ago
Social security numbers should not be treated as private credentials. Most companies you deal with already have it, and revoking it is too slow and painful.
draw_down 11y ago
https://en.wikipedia.org/wiki/Defense_in_depth_(computing) https://en.wikipedia.org/wiki/Defense_in_depth_(computing)
stanleydrew 11y ago
I hesitate to respond since this seems like an obvious troll. Your solution is to somehow perfectly protect all CC and SSN info? How do you propose to do that?
- andrewmcwatters 11y ago
  Well in Krebs' position, by not sticking your hand in fire. This isn't an issue for an overwhelming majority of people. The sky is not falling.
  - stanleydrew 11y ago
    You haven't answered the question I posed at all. This problem isn't unique to Krebs and it doesn't just affect people deliberately sticking their hands in fire. Regular people have their CC and SSN posted online too.
    - andrewmcwatters 11y ago
      I wasn't aware this was a press conference and I was obligated to answer your question the way you wanted.
lambda 11y ago
SSN and credit card numbers should not be considered secret. Anything that must be shared with a third party in order to make some kind of transaction cannot be considered secret; compromises happen, and once compromised, there is no way to make them secret again. Brian Krebs, as a high-profile author on security who actively antagonizes black-market groups on the internet, is a common target. He has had all of his basic personal information posted on the internet publicly for some time. The credit cards that were used for this attack were all old, disabled ones, since he disabled them after the numbers were leaked; but apparently PayPal still has them listed on the account and so you can use knowledge of them to "prove" your identity to PayPal.
- andrewmcwatters 11y ago
  > actively antagonizes black-market groups on the internet Sounds to me like they're both at fault then. It's really nice and idealistic to have this mentality that you're doing it in the name of infosec, but it's a position held from an ivory tower. If he's in software, what did he expect? This isn't a wise approach. This is the advanced stupid I'm talking about. Someone who thinks it's wise to antagonize, but then cries and writes an article over it when they're attacked. It's a joke. Conventional wisdom here is nonexistent.
  - wstrange 11y ago
    How is Kreb's at fault? Talk about blaming the victim!
    - andrewmcwatters 11y ago
      Lets reduce this first to understand it. First, why would you antagonize black-market groups on the Internet? Why would you actively make yourself a possible target? Does that seem wise? To me, that's a far less complicated question than anything security related at a technical level. You can literally ask a child this question and they'll tell you it's not smart. This is advanced stupid.
      - 11y ago

mikelward 11y ago

Social security numbers should not be treated as private credentials. Most companies you deal with already have it, and revoking it is too slow and painful.

draw_down 11y ago

https://en.wikipedia.org/wiki/Defense_in_depth_(computing) https://en.wikipedia.org/wiki/Defense_in_depth_(computing)

stanleydrew 11y ago

I hesitate to respond since this seems like an obvious troll. Your solution is to somehow perfectly protect all CC and SSN info? How do you propose to do that?

andrewmcwatters 11y ago
Well in Krebs' position, by not sticking your hand in fire. This isn't an issue for an overwhelming majority of people. The sky is not falling.
- stanleydrew 11y ago
  You haven't answered the question I posed at all. This problem isn't unique to Krebs and it doesn't just affect people deliberately sticking their hands in fire. Regular people have their CC and SSN posted online too.
  - andrewmcwatters 11y ago
    I wasn't aware this was a press conference and I was obligated to answer your question the way you wanted.

lambda 11y ago

SSN and credit card numbers should not be considered secret. Anything that must be shared with a third party in order to make some kind of transaction cannot be considered secret; compromises happen, and once compromised, there is no way to make them secret again. Brian Krebs, as a high-profile author on security who actively antagonizes black-market groups on the internet, is a common target. He has had all of his basic personal information posted on the internet publicly for some time. The credit cards that were used for this attack were all old, disabled ones, since he disabled them after the numbers were leaked; but apparently PayPal still has them listed on the account and so you can use knowledge of them to "prove" your identity to PayPal.

andrewmcwatters 11y ago
> actively antagonizes black-market groups on the internet Sounds to me like they're both at fault then. It's really nice and idealistic to have this mentality that you're doing it in the name of infosec, but it's a position held from an ivory tower. If he's in software, what did he expect? This isn't a wise approach. This is the advanced stupid I'm talking about. Someone who thinks it's wise to antagonize, but then cries and writes an article over it when they're attacked. It's a joke. Conventional wisdom here is nonexistent.
- wstrange 11y ago
  How is Kreb's at fault? Talk about blaming the victim!
  - andrewmcwatters 11y ago
    Lets reduce this first to understand it. First, why would you antagonize black-market groups on the Internet? Why would you actively make yourself a possible target? Does that seem wise? To me, that's a far less complicated question than anything security related at a technical level. You can literally ask a child this question and they'll tell you it's not smart. This is advanced stupid.
    - 11y ago