6 ms·

"If you’re outraged by accidental breaches, you’d better sit down"

58 points by sweis 16y ago

Ben Adida on the recent privacy breach disclosures: "If you’re shocked, outraged, writing lengthy TechCrunch posts about these developments, you probably don’t understand computer security very well, and you’d better sit down with a stiff drink, because these issues are the tip of the iceberg."

sweis 16y ago
Ben Adida on the recent privacy breach disclosures: "If you’re shocked, outraged, writing lengthy TechCrunch posts about these developments, you probably don’t understand computer security very well, and you’d better sit down with a stiff drink, because these issues are the tip of the iceberg."
JacobAldridge 16y ago
I hope we're really close to a Responsibility tipping point in regards to online security, by which I mean a general acceptance by internet users that they, not the site they visit, must take primary responsibility for their online security. This doesn't remove any responsibility from my bank, paypal, Facebook etc. But until the average person hears about a potential breach of their privacy and thinks "What can I do differently to prevent this happening again?" then breaches are going to be fodder for sensational journalism and outraged users... neither of which helps solve the problem. I will make a division between some core security - like my credit card details on Amazon - and peripheral security - like my photos on Facebook. This latter type will tip over first, and I hope it's soon.
- boredguy8 16y ago
  "I hope we're really close to a Responsibility tipping point in regards to online security, by which I mean a general acceptance by internet users that they, not the site they visit, must take primary responsibility for their online security." What does that even mean? Should I be fuzzing any site I think about giving my e-mail address to? There's not even a feasible way of knowing if someone's administratively accessing my account. On the Internet, like in life, you have to end up trusting somebody.
- _delirium 16y ago
  But what could I do differently to prevent my bank, or employer, or sites I shop at, or anybody else, from leaking my data? Isn't it pretty much their responsibility to make their site work properly? It's my responsibility to not get taken in by phishing scams, sure, but what am I supposed to do about a bank accidentally losing a CD with accounts on it, or getting their database server compromised? If anything, I'd suggest it should tip over into the other direction, with much stricter liability and penalties for those sorts of information breaches. If somebody promised something and failed to deliver it, that's a pretty classic case of fault. Now if, on the other hand, they said up front that they might make my data public if they felt like it, then that's another story. In Facebook's case, it feels a bit like the flip-side of their recent proposal to make TOS legally enforceable. Perhaps make 'em legally enforceable in both directions, then, as a real contract with obligations on both parties?
  - motters 16y ago
    I agree. Other than trying to avoid phishing scams and using sensible passwords there's not much that the user can do to improve their digital security, especially in the era of cloud computing where much of what goes on from a software perspective is not within the user's realm of responsibility.
- RyanMcGreal 16y ago
  Bollocks. It's unreasonable, not to mention unrealistic, to shift the balance of responsibility for online security from the relatively small set of professional developers to the mass of individual, non-expert users. Imagine if banks had a policy that their individual customers were responsible for ensuring that their deposits were secure - banks would collapse regularly (and in fact did collapse regularly before the introduction of deposit insurance).
  - extension 16y ago
    It would help if users didn't give instant, unconditional, blind trust to cloud services, as the vast majority seem to now. Just taking a moment to consider security before dumping their data in a service they don't really need could make a big difference. But learned helplessness is a tough habit to break.
- khafra 16y ago
  This study by Microsoft Research might interest you. It argues that the individual user rationally ignores security precautions because zis expected loss is less than the cost of a strong security posture. http://research.microsoft.com/en-us/um/people/cormac/papers/2009/solongandnothanks.pdf http://research.microsoft.com/en-us/um/people/cormac/papers/...
bruceboughton 16y ago
This is right on the money.
ThomPete 16y ago
It seems to me that the major problem is that there is no gradients in security. With my online bank I am forced to go trough the same tedious process whether I want to check my balance or transfer money. I think that is part of the problem in getting users to care about these matters. My own thinking on this is "The Ghost Protocol" peer 2 peer negotiation where trust is build over time rather than defined by a login. This wont be happening anytime soon but the username/password approach isn't going to cut it moving forward IMHO.
jodiefoster39 16y ago
Thanks for the awesome information. It certainly does work and faster than my methods before. http://www.cheapautoparts.com/ http://www.cheapautoparts.com/
- RiderOfGiraffes 16y ago
  Don't just downmod it - click here and flag it: http://news.ycombinator.com/item?id=1353889 http://news.ycombinator.com/item?id=1353889
  - tome 16y ago
    What on earth was it?
Silhouette 16y ago
The world is not as black and white as this article suggests. "We do not know how to write secure software." 100% secure? No, perhaps not. But we know a few things that could be done much better than they are today. For one thing, you can't leak information that you don't have. Companies today tend to default to grabbing more information for their databases and keeping it around indefinitely. We need much stronger data protection laws than most countries have today to counteract this. For another thing, "pushing the envelope and releasing features as quickly as possible to outpace your competitors" is not an excuse for not running a decent software development process. Seriously, Google was collecting that data for three years and no-one had looked at any of it and thought something was wrong? The cost of phishing and identity theft even in purely economic terms are already significant, and those costs are rising and don't take into account the more important human suffering aspect. A statutory fine of, say, $10,000 per individual per negligent breach should focus the attention a little more on getting basic testing right and doing something about problems before they happen, and a little less on trying to infringe everyone's privacy faster than any competitor can. As I have noted before, such a level of fines would be an unacceptable risk for many businesses and they would probably have to stop collecting and retaining personal information at all. I have no problem with this, as long as the negligence criterion is applied sensibly. Most companies don't need to store a lot of data about us, and those for whom it is an important part of their business model can learn to take reasonable steps to prevent abuse.
- extension 16y ago
  As much as I would like to see this, without a stable industry consensus on best practices, there is insufficient foundation for a legal definition of negligence.
  - Silhouette 16y ago
    An alternative possibility is that evidence of "reasonable" behaviour would be heard on a case by case basis in court, and case law would start to show the minimum standards expected. Some practices may be more hype than substance, and anyone alleging a problem because something was not done would presumably have to justify why that action should have been taken. On the other hand, I think you would find a lot of consensus and evidence-based argument in some areas of security, and there is really no excuse for not following those practices if you're in the business of managing sensitive data.
simonw 16y ago
The thing about the Yelp/Facebook bug is that it demonstrates how some of these features have pretty fundamental problems. Facebook gave Yelp full access to their API in a way that meant that any XSS holes in Yelp would result in a breach for Facebook. Yelp had an XSS hole. Keeping a large site free of XSS is really, really hard (especially if you don't have an escape-by-default policy baked in to your template layer). Ensuring your partners are free of XSS is even harder.
dutchbrit 16y ago
The chat bug was pretty stupid, how on earth did they manage to create a bug like that (seriously, it amazes me)! Seems like they have an awful authentication system - these things should be checked over before going online.

58 points by sweis 16y ago

sweis 16y ago

JacobAldridge 16y ago

I hope we're really close to a Responsibility tipping point in regards to online security, by which I mean a general acceptance by internet users that they, not the site they visit, must take primary responsibility for their online security. This doesn't remove any responsibility from my bank, paypal, Facebook etc. But until the average person hears about a potential breach of their privacy and thinks "What can I do differently to prevent this happening again?" then breaches are going to be fodder for sensational journalism and outraged users... neither of which helps solve the problem. I will make a division between some core security - like my credit card details on Amazon - and peripheral security - like my photos on Facebook. This latter type will tip over first, and I hope it's soon.

boredguy8 16y ago
"I hope we're really close to a Responsibility tipping point in regards to online security, by which I mean a general acceptance by internet users that they, not the site they visit, must take primary responsibility for their online security." What does that even mean? Should I be fuzzing any site I think about giving my e-mail address to? There's not even a feasible way of knowing if someone's administratively accessing my account. On the Internet, like in life, you have to end up trusting somebody.
_delirium 16y ago
But what could I do differently to prevent my bank, or employer, or sites I shop at, or anybody else, from leaking my data? Isn't it pretty much their responsibility to make their site work properly? It's my responsibility to not get taken in by phishing scams, sure, but what am I supposed to do about a bank accidentally losing a CD with accounts on it, or getting their database server compromised? If anything, I'd suggest it should tip over into the other direction, with much stricter liability and penalties for those sorts of information breaches. If somebody promised something and failed to deliver it, that's a pretty classic case of fault. Now if, on the other hand, they said up front that they might make my data public if they felt like it, then that's another story. In Facebook's case, it feels a bit like the flip-side of their recent proposal to make TOS legally enforceable. Perhaps make 'em legally enforceable in both directions, then, as a real contract with obligations on both parties?
- motters 16y ago
  I agree. Other than trying to avoid phishing scams and using sensible passwords there's not much that the user can do to improve their digital security, especially in the era of cloud computing where much of what goes on from a software perspective is not within the user's realm of responsibility.
RyanMcGreal 16y ago
Bollocks. It's unreasonable, not to mention unrealistic, to shift the balance of responsibility for online security from the relatively small set of professional developers to the mass of individual, non-expert users. Imagine if banks had a policy that their individual customers were responsible for ensuring that their deposits were secure - banks would collapse regularly (and in fact did collapse regularly before the introduction of deposit insurance).
- extension 16y ago
  It would help if users didn't give instant, unconditional, blind trust to cloud services, as the vast majority seem to now. Just taking a moment to consider security before dumping their data in a service they don't really need could make a big difference. But learned helplessness is a tough habit to break.
khafra 16y ago
This study by Microsoft Research might interest you. It argues that the individual user rationally ignores security precautions because zis expected loss is less than the cost of a strong security posture. http://research.microsoft.com/en-us/um/people/cormac/papers/2009/solongandnothanks.pdf http://research.microsoft.com/en-us/um/people/cormac/papers/...

bruceboughton 16y ago

This is right on the money.

ThomPete 16y ago

It seems to me that the major problem is that there is no gradients in security. With my online bank I am forced to go trough the same tedious process whether I want to check my balance or transfer money. I think that is part of the problem in getting users to care about these matters. My own thinking on this is "The Ghost Protocol" peer 2 peer negotiation where trust is build over time rather than defined by a login. This wont be happening anytime soon but the username/password approach isn't going to cut it moving forward IMHO.

jodiefoster39 16y ago

Thanks for the awesome information. It certainly does work and faster than my methods before. http://www.cheapautoparts.com/ http://www.cheapautoparts.com/

RiderOfGiraffes 16y ago
Don't just downmod it - click here and flag it: http://news.ycombinator.com/item?id=1353889 http://news.ycombinator.com/item?id=1353889
- tome 16y ago
  What on earth was it?

Silhouette 16y ago

The world is not as black and white as this article suggests. "We do not know how to write secure software." 100% secure? No, perhaps not. But we know a few things that could be done much better than they are today. For one thing, you can't leak information that you don't have. Companies today tend to default to grabbing more information for their databases and keeping it around indefinitely. We need much stronger data protection laws than most countries have today to counteract this. For another thing, "pushing the envelope and releasing features as quickly as possible to outpace your competitors" is not an excuse for not running a decent software development process. Seriously, Google was collecting that data for three years and no-one had looked at any of it and thought something was wrong? The cost of phishing and identity theft even in purely economic terms are already significant, and those costs are rising and don't take into account the more important human suffering aspect. A statutory fine of, say, $10,000 per individual per negligent breach should focus the attention a little more on getting basic testing right and doing something about problems before they happen, and a little less on trying to infringe everyone's privacy faster than any competitor can. As I have noted before, such a level of fines would be an unacceptable risk for many businesses and they would probably have to stop collecting and retaining personal information at all. I have no problem with this, as long as the negligence criterion is applied sensibly. Most companies don't need to store a lot of data about us, and those for whom it is an important part of their business model can learn to take reasonable steps to prevent abuse.

extension 16y ago
As much as I would like to see this, without a stable industry consensus on best practices, there is insufficient foundation for a legal definition of negligence.
- Silhouette 16y ago
  An alternative possibility is that evidence of "reasonable" behaviour would be heard on a case by case basis in court, and case law would start to show the minimum standards expected. Some practices may be more hype than substance, and anyone alleging a problem because something was not done would presumably have to justify why that action should have been taken. On the other hand, I think you would find a lot of consensus and evidence-based argument in some areas of security, and there is really no excuse for not following those practices if you're in the business of managing sensitive data.

simonw 16y ago

The thing about the Yelp/Facebook bug is that it demonstrates how some of these features have pretty fundamental problems. Facebook gave Yelp full access to their API in a way that meant that any XSS holes in Yelp would result in a breach for Facebook. Yelp had an XSS hole. Keeping a large site free of XSS is really, really hard (especially if you don't have an escape-by-default policy baked in to your template layer). Ensuring your partners are free of XSS is even harder.

dutchbrit 16y ago

The chat bug was pretty stupid, how on earth did they manage to create a bug like that (seriously, it amazes me)! Seems like they have an awful authentication system - these things should be checked over before going online.