4 ms·

Regulations would be impossible to enforce. You can write up as many laws as you want but trying to enforce security constraints on new websites alone is an imp

Regulations would be impossible to enforce. You can write up as many laws as you want but trying to enforce security constraints on new websites alone is an impossible task.

lets-tryagain 10y ago
But this is how most regulation enforcement works...notorious and high-profile cases scare most into compliance...like tax audits.
bkjsbkjdnf 10y ago
> trying to enforce security constraints on new websites alone is an impossible task. Why 'new websites alone'? Enforcing security standards on new/small websites would be harder than on large ones, and the large ones are more important. There are already many cyber-security related laws that are in place and more-or-less enforced. Having these laws makes large companies invest money into at least attempting to follow them for fear of legal repercussions.
- OedipusRex 10y ago
  Who would enforce it on any website? The US government, or W3C, or IANA? Everyone talks about a free and open web and no one wants someone poking around behind the scenes. I don't trust anyone to enforce password rules for fear of exploitation. The user is responsible for their password security and it should stop there. That being said, Yahoo should have force reset passwords.
  - bkjsbkjdnf 10y ago
    > The user is responsible for their password security and it should stop there. That would be true if the user created, stored, authenticated the password himself.
- jsmthrowaway 10y ago
  > Enforcing security standards on new/small websites would be harder than on large ones Wait, you think the larger a property gets, the easier it gets to secure it?
  - Naritai 10y ago
    I'm guessing s/he means that there are fewer total such sites, so any regulatory body wouldn't have as many individual properties to monitor. That is to say, it's a reference to the effort of the regulatory body, not of the property managers themselves.
  - deleted 10y ago
    [deleted]
  - bkjsbkjdnf 10y ago
    No, but the larger the company the more incentive it has to meet regulatory demands. There are also much fewer such companies so they are easier to identify and check.
corecoder 10y ago
Good regulations do not need enforcement. Example: * if your company lets someone steal your users' data, your users can sue you and get lots of $$$; * if you are the CEO of a company and you let someone steal your users' data, when your users sue your company, you have to pay X%. Edit: formatting
- walshemj 10y ago
  or the CEO and the broad members concerned are flagged as a not a "fit and proper person" to a be a director - oops you have just fired your self kiss your share options goodbye
aioprisan 10y ago
They could just go under a whistleblower equivalent program for security concerns, but I feat that we don't have such a program in place in the US
Karunamon 10y ago
Impossible? No, but hard and requiring the willingness to do so. Besides, it's not that difficult if the requirements are minimal best practices - the regulatory body need not even get involved until a breach has been traced back to someone who didn't follow the rules. We're not trying to make security perfect, just deal with blatant disregard of user safety. I suggest 3 to start: 1: No storing passwords in plaintext. 2: Hashed passwords must not be calculated with fast algorithms like MD5. 3: Hashed passwords must be salted. These three things would have solved most of the major breaches everyone has heard of, don't take meaningful development time to implement, and so there is zero excuse for not doing them.

Regulations would be impossible to enforce. You can write up as many laws as you want but trying to enforce security constraints on new websites alone is an impossible task.

lets-tryagain 10y ago

But this is how most regulation enforcement works...notorious and high-profile cases scare most into compliance...like tax audits.

bkjsbkjdnf 10y ago

> trying to enforce security constraints on new websites alone is an impossible task. Why 'new websites alone'? Enforcing security standards on new/small websites would be harder than on large ones, and the large ones are more important. There are already many cyber-security related laws that are in place and more-or-less enforced. Having these laws makes large companies invest money into at least attempting to follow them for fear of legal repercussions.

OedipusRex 10y ago
Who would enforce it on any website? The US government, or W3C, or IANA? Everyone talks about a free and open web and no one wants someone poking around behind the scenes. I don't trust anyone to enforce password rules for fear of exploitation. The user is responsible for their password security and it should stop there. That being said, Yahoo should have force reset passwords.
- bkjsbkjdnf 10y ago
  > The user is responsible for their password security and it should stop there. That would be true if the user created, stored, authenticated the password himself.
jsmthrowaway 10y ago
> Enforcing security standards on new/small websites would be harder than on large ones Wait, you think the larger a property gets, the easier it gets to secure it?
- Naritai 10y ago
  I'm guessing s/he means that there are fewer total such sites, so any regulatory body wouldn't have as many individual properties to monitor. That is to say, it's a reference to the effort of the regulatory body, not of the property managers themselves.
- deleted 10y ago
  [deleted]
- bkjsbkjdnf 10y ago
  No, but the larger the company the more incentive it has to meet regulatory demands. There are also much fewer such companies so they are easier to identify and check.

corecoder 10y ago

Good regulations do not need enforcement. Example: * if your company lets someone steal your users' data, your users can sue you and get lots of $$$; * if you are the CEO of a company and you let someone steal your users' data, when your users sue your company, you have to pay X%. Edit: formatting

walshemj 10y ago
or the CEO and the broad members concerned are flagged as a not a "fit and proper person" to a be a director - oops you have just fired your self kiss your share options goodbye

aioprisan 10y ago

They could just go under a whistleblower equivalent program for security concerns, but I feat that we don't have such a program in place in the US

Karunamon 10y ago

Impossible? No, but hard and requiring the willingness to do so. Besides, it's not that difficult if the requirements are minimal best practices - the regulatory body need not even get involved until a breach has been traced back to someone who didn't follow the rules. We're not trying to make security perfect, just deal with blatant disregard of user safety. I suggest 3 to start: 1: No storing passwords in plaintext. 2: Hashed passwords must not be calculated with fast algorithms like MD5. 3: Hashed passwords must be salted. These three things would have solved most of the major breaches everyone has heard of, don't take meaningful development time to implement, and so there is zero excuse for not doing them.