5 ms·

I'm not convinced by your argument. People freely give away this information and more to facebook, etc.

VLM 10y ago
But not in one giant queryable SQL table. I'd worry about parallelized spearfishing attacks across multiple stores, "Good Morning DEF, have I reached store number 12345 cash handling office? OK good to hear, this ABC at walmart corporate IT calling back about that trouble ticket your coworker XYZ entered about your store in Springfield, is XYZ at work now? Oh OK, well, anyway the ticket says XYZ is having trouble accessing the credit card portal, the ticket says you're trying to log in using the password of "password2", and back at HQ I can't log in using that password either so I'm planning on resetting her password, which will completely lock her out of the system for at least a week, unfortunately, but that's how ... Oh wait, you say there's a post it note on the monitor that her password is actually "ilovejustinbeiber", hold on a moment let me try that. How about that, it does work. Hey thanks for helping out, gonna save a lot of trouble for everyone. I'm not going to reset XYZ's password since it does work, I'll just close out the ticket with "can't reproduce problem", whoever took the ticket here couldn't enter the data right and obviously whatever problem there was is fixed now. Have a nice day out there in Springfield, Make Walmart Great Again (or whatever it is they say) Bye!" Or some team calls like twenty electronics departments and tells all of them to toss all their ipad stock into a large shipment box because they were shipped with faulty batteries while reading back all the info they gathered to build trust, then let them know a courier from UPS (fake brown uniform) will present a (fake) ID and pick up that box of ipads in an hour and they can expect replacements air shipped later that day. Remind the employee to make sure they sign and save the (fake) return receipt. Imagine what a large team could do with a phone that takes pictures, snapping serial numbers of boxes on the shelf and a half hour later reading the serial number list back to the clerk over the phone. This is all old stuff, but the advantage is you can parallelize it. If "they" hit one store every night there would be emergency emails printed out and taped up and handed out by the next week, but if you run this right you could do maybe 200, 300 stores. Even better if a competitor paid you to pull this off on Black Friday when half the IT staff took the day off anyway and all you need is to sow chaos to make money. Or do this the day before earnings are announced to really mess with them financially.
- empath75 10y ago
  I don't think labor unions are goi to run a scam like that. This is ridiculous. Walmart has all this information in dbs right now and they're way more likely to get hacked.
  - VLM 10y ago
    You make a good point, however the real threat isn't "Our Walmart" but "R Walmart" "Are Walmart" "Our Target" and so forth. I have faith that the app market is so hypersaturated that any scheme that doesn't epic fail immediately spawns hundreds of clones. "Our Walmart" is probably legit, although probably a smaller harder to defend target and the problem is going to be inevitable clones and scams. There is also the meta-threat of normalizing sharing employer information. Sure maybe 99% of people who ask for my IP address or a list of ciphers my sshd permits are really not up to anything bad, but it would be bad to get in the habit of telling rando requesters anything they ask. So, among others, I allow aes256-gcm in my corporate sshd config... and what possible good could come from people answering questions like that ?
- cryptarch 10y ago
  Uhhh... "facebook can't query user data"? Facebook even has the current occupation and location data of users, so of course they can find out at what specific store you work! Facebook has a larger user base with richer data on them, than the app in the story. None of that data is E2E encrypted, and all of it is available to (some) FB employees. I think your FUD is unjustified here.
  - jimmywanger 10y ago
    Nowhere did he say that "facebook couldn't query user data". He's saying that it's probably not in a form that's easily queryable. With that information in an ill-secured data store that's highly categorized you can do all sorts of mischief. And how is it FUD? Once you cleanse and normalize data, fraud opportunities become very apparent.
    - 10y ago

VLM 10y ago

But not in one giant queryable SQL table. I'd worry about parallelized spearfishing attacks across multiple stores, "Good Morning DEF, have I reached store number 12345 cash handling office? OK good to hear, this ABC at walmart corporate IT calling back about that trouble ticket your coworker XYZ entered about your store in Springfield, is XYZ at work now? Oh OK, well, anyway the ticket says XYZ is having trouble accessing the credit card portal, the ticket says you're trying to log in using the password of "password2", and back at HQ I can't log in using that password either so I'm planning on resetting her password, which will completely lock her out of the system for at least a week, unfortunately, but that's how ... Oh wait, you say there's a post it note on the monitor that her password is actually "ilovejustinbeiber", hold on a moment let me try that. How about that, it does work. Hey thanks for helping out, gonna save a lot of trouble for everyone. I'm not going to reset XYZ's password since it does work, I'll just close out the ticket with "can't reproduce problem", whoever took the ticket here couldn't enter the data right and obviously whatever problem there was is fixed now. Have a nice day out there in Springfield, Make Walmart Great Again (or whatever it is they say) Bye!" Or some team calls like twenty electronics departments and tells all of them to toss all their ipad stock into a large shipment box because they were shipped with faulty batteries while reading back all the info they gathered to build trust, then let them know a courier from UPS (fake brown uniform) will present a (fake) ID and pick up that box of ipads in an hour and they can expect replacements air shipped later that day. Remind the employee to make sure they sign and save the (fake) return receipt. Imagine what a large team could do with a phone that takes pictures, snapping serial numbers of boxes on the shelf and a half hour later reading the serial number list back to the clerk over the phone. This is all old stuff, but the advantage is you can parallelize it. If "they" hit one store every night there would be emergency emails printed out and taped up and handed out by the next week, but if you run this right you could do maybe 200, 300 stores. Even better if a competitor paid you to pull this off on Black Friday when half the IT staff took the day off anyway and all you need is to sow chaos to make money. Or do this the day before earnings are announced to really mess with them financially.

empath75 10y ago
I don't think labor unions are goi to run a scam like that. This is ridiculous. Walmart has all this information in dbs right now and they're way more likely to get hacked.
- VLM 10y ago
  You make a good point, however the real threat isn't "Our Walmart" but "R Walmart" "Are Walmart" "Our Target" and so forth. I have faith that the app market is so hypersaturated that any scheme that doesn't epic fail immediately spawns hundreds of clones. "Our Walmart" is probably legit, although probably a smaller harder to defend target and the problem is going to be inevitable clones and scams. There is also the meta-threat of normalizing sharing employer information. Sure maybe 99% of people who ask for my IP address or a list of ciphers my sshd permits are really not up to anything bad, but it would be bad to get in the habit of telling rando requesters anything they ask. So, among others, I allow aes256-gcm in my corporate sshd config... and what possible good could come from people answering questions like that ?
cryptarch 10y ago
Uhhh... "facebook can't query user data"? Facebook even has the current occupation and location data of users, so of course they can find out at what specific store you work! Facebook has a larger user base with richer data on them, than the app in the story. None of that data is E2E encrypted, and all of it is available to (some) FB employees. I think your FUD is unjustified here.
- jimmywanger 10y ago
  Nowhere did he say that "facebook couldn't query user data". He's saying that it's probably not in a form that's easily queryable. With that information in an ill-secured data store that's highly categorized you can do all sorts of mischief. And how is it FUD? Once you cleanse and normalize data, fraud opportunities become very apparent.
  - 10y ago