4 ms·
When your front door isn't secure enough, you and/or your insurance company eat the loss. The point of this headline is that when Yahoo gets attack their custom
by petertodd 10y ago
When your front door isn't secure enough, you and/or your insurance company eat the loss. The point of this headline is that when Yahoo gets attack their customers are going to eat the loss, yet it's Yahoo who screwed up.
That's IMO a clear example of mis-aligned incentives.
- DominikR 10y agoHas Yahoo acted grossly negligent? (I don't know the specifics in this case) If so then they are liable for resulting damages, if not then they didn't screw up. See, no customer is entitled to a 100% guarantee that their private data will never leak. Why? Because it is not possible to guarantee such a thing. The only thing you are entitled to is that the corporation handles your data following industry standards which usually is at least identical but most often even better than what the law requires. If a 100% guarantee was somehow a legal requirement then the IT industry would cease to exist the following morning.
- mikeash 10y agoIt's not possible to 100% guarantee that data will never leak, but it's entirely possible to 100% guarantee that the company will cover the full costs of a leak. If that was somehow a legal requirement, everyone would go out and buy insurance for it and then life would go on, probably with additional emphasis on security.
- DominikR 10y agoI have a different position on that. My perspective is that if a company doesn't act negligent, follows all legal procedures and industry standards regarding data security then why should it be made to pay for damages caused by a third party. It didn't cause the damage, it's been the criminals who did that. They should be held accountable for this.
- mikeash 10y agoThat seems pretty reasonable too. I like the idea of making the business liable regardless because it more or less automatically optimizes the combined cost of security and losses. Companies will in theory spend money on security until each dollar spent mitigates less than a dollar in losses, then stop. The trick, of course, is making sure companies estimate their risk properly and don't just screw everyone over by underspending on security and then going bankrupt when hacked. Mandatory liability insurance could help with that, since insurance companies basically exist to assess risk in something like a realistic fashion.
- Godel_unicode 10y agoSo you think that startups with hockey-stick growth should have to design systems which are impervious to extremely sophisticated criminals? That seems unlikely. Edit: also, the main risk here is password reuse. How is Yahoo supposed to estimate that and why are they on the hook for user's bad security practices?
- mikeash 10y agoI'm not sure how "mandatory liability insurance" gets translated into "have to design systems which are impervious."
- cwillu 10y agoYou're forced to spend money to mitigate losses. If you can do something to decrease the losses, or the likelyhood of suffering one, then the insurance will cost less.
- mikeash 10y agoRight, so your spending will increase up to the point where your ROI is 1:1, then you'll stop. That point will be long before you reach imperviousness.
- 10y ago
- arcticfox 10y agoYes, we are lamenting the situation. There is no incentive for companies to go beyond the rather lame line of duty. So we're left with an industry full of holes.
- WalterBright 10y agoA guarantee does not say something will not happen. It says if it does happen, recompense will be provided.