4 ms·

Blaming the victims? Really?

dTal 10y ago
Obviously the people hacking accounts are the baddies. But I don't think it's inappropriate to note that, seemingly, someone literally phoned them up, asked for, and received their passwords - and that's not even the main story!
- cmdrfred 10y ago
  I still can't believe the "humans are generally trusting and helpful to strangers" vulnerability has yet to be patched. http://www.smbc-comics.com/?id=2526 http://www.smbc-comics.com/?id=2526
  - BearGoesChirp 10y ago
    I've been installing cynicism for years. Its a huge patch and the devs seem to have added more bugs than they fixed. It causes some communication issues with those not running the patched version.
  - 6stringmerc 10y ago
    It is a wonderfully effective platform for compelling fiction, however! See: O. Henry.
hunter2_ 10y ago
When victims are overtaken by force, coercion, stealth, or a multitude of other reasons, you can't blame them. When a victim in their right mind offers up a secret to someone they didn't authenticate, "victim blaming" as a construct is a stretch.
- arximboldi 10y ago
  It is not a stretch. The government must not spy its citizens. Period. They are the only ones to get blame. If I get my bike stolen I am not be blamed if I use a shitty lock. If I get raped I am not to be blamed if I was too drunk to resist. If I get hacked I am not to be blamed if I was susceptible to social engineering. Yes, it is very useful for potential victims to learn how to best protect themselves. But the moral responsibility in such violations is on the attacker, and is proportional to the damage caused to the victim, not the efforts taken to cause it. Admittedly, this is part of why part of the crypto-activist community puts me off. Yes, cryptography is a great resistance tool, but my utopia is a society built on cooperation, equality and trust, not one of algebraic fences.
  - TallGuyShort 10y ago
    That doesn't mean it was a good idea to leave your bike unlocked, get blackout drunk and tell someone your password. I'm all for assigning blame to the police if these allegations are true, but this is a good time to remember: DON'T BE AN IDIOT WHEN YOU CAN EASILY PROTECT YOURSELF.
  - lerpa 10y ago
    Well then I guess now for you it's just a matter of going to live in the ideal world where all of that holds true, and you're golden to live without any care.
  - hunter2_ 10y ago
    You're right about government spying, but my argument isn't specific to government so let's set that aside and talk more generically. Bike theft: stealth, in my list above -- someone acted while you weren't attentive. You didn't hand over the bike, so you're not to be blamed. Even if you used no lock whatsoever, I wouldn't blame you. You could've done more, but you need to weigh the benefits against the burden of a massive lock so there's no perfect way out. Rape: force, in my list above. You had no ability to change the outcome. I wouldn't blame you. Hacked via social engineering: You spilled the beans. Spilling beans is avoidable with some practice, awareness, logic... this is not the same category as the others. I don't say "this is all you're fault," of course not. But unlike the bike thief and the rapist, all you had to do was ignore the attack.
- Joeboy 10y ago
  There is no reason to think, in this case, that it was a person they "didn't authenticate".
  - hunter2_ 10y ago
    It's easy to think that, IMHO. Pre-arranging a challenge, recognizing by voice, performing a call-back to a widely publicized/trusted phone number... I really doubt anything like that occurred. And even if there was authentication, now it's time for authorization. The only authorized recipient of a password is the exact same entity with which you established the password.
    - Joeboy 10y ago
      What do you think occurred?
TallGuyShort 10y ago
Why this stigma against acknowledging that potential victims can (and would be wise to) take steps to protect themselves. Yes, dressing a certain way, drinking a lot of alcohol, and attending a party doesn't begin to excuse rape. But that doesn't mean it was a good idea and is something you should do without considering the possible consequences. If someone calls and says they work for a security firm, offers to confirm if you were involved in a hack and you do tell them your password, you are probably falling for a scam. That's all GP is saying.
- lerpa 10y ago
  Because it's easier to exonerate ourselves from any responsibility for our own mistakes than having to deal with that.
- mostlyskeptical 10y ago
  Thank you. I've gotten particularly sick of the phrase 'blaming the victim'. If you insult someone's mother, you might get hit. If you leave valuables or cash on top of a car in a bad neighborhood it might be stolen. It's still the fault of whoever did the bad action, and everyone would be better off if you didn't need to take precautions line that, but you could have easily taken steps to lower the chance of it happening. If you say to buckle your seatbelt, get a fire extinguisher, or look both ways before crossing the road no one bats an eye. God forbid you acknowledge that there are bad people in the world and you should take steps to protect yourself from them.
- Joeboy 10y ago
  > If someone calls and says they work for a security firm, offers to confirm if you were involved in a hack and you do tell them your password, you are probably falling for a scam. That's all GP is saying. GP is suggesting that the people involved were clueless rubes who gave out their passwords to people of unknown identity, which I submit is almost certainly untrue.
  - TallGuyShort 10y ago
    You're possibly right, but that is pretty much what the article says. Perhaps there was more of a trust established between the parties. Perhaps they were shown a list of compromised passwords and asked if any of their passwords appeared on the list. But pointing out that what the article actually says happened makes you an easy target is hardly uncalled for. I'm taking issue with the "blaming the victim" card. Bad security practice is bad security practice and pointing it out doesn't make you Hitler.

dTal 10y ago

Obviously the people hacking accounts are the baddies. But I don't think it's inappropriate to note that, seemingly, someone literally phoned them up, asked for, and received their passwords - and that's not even the main story!

cmdrfred 10y ago
I still can't believe the "humans are generally trusting and helpful to strangers" vulnerability has yet to be patched. http://www.smbc-comics.com/?id=2526 http://www.smbc-comics.com/?id=2526
- BearGoesChirp 10y ago
  I've been installing cynicism for years. Its a huge patch and the devs seem to have added more bugs than they fixed. It causes some communication issues with those not running the patched version.
- 6stringmerc 10y ago
  It is a wonderfully effective platform for compelling fiction, however! See: O. Henry.

hunter2_ 10y ago

When victims are overtaken by force, coercion, stealth, or a multitude of other reasons, you can't blame them. When a victim in their right mind offers up a secret to someone they didn't authenticate, "victim blaming" as a construct is a stretch.

arximboldi 10y ago
It is not a stretch. The government must not spy its citizens. Period. They are the only ones to get blame. If I get my bike stolen I am not be blamed if I use a shitty lock. If I get raped I am not to be blamed if I was too drunk to resist. If I get hacked I am not to be blamed if I was susceptible to social engineering. Yes, it is very useful for potential victims to learn how to best protect themselves. But the moral responsibility in such violations is on the attacker, and is proportional to the damage caused to the victim, not the efforts taken to cause it. Admittedly, this is part of why part of the crypto-activist community puts me off. Yes, cryptography is a great resistance tool, but my utopia is a society built on cooperation, equality and trust, not one of algebraic fences.
- TallGuyShort 10y ago
  That doesn't mean it was a good idea to leave your bike unlocked, get blackout drunk and tell someone your password. I'm all for assigning blame to the police if these allegations are true, but this is a good time to remember: DON'T BE AN IDIOT WHEN YOU CAN EASILY PROTECT YOURSELF.
- lerpa 10y ago
  Well then I guess now for you it's just a matter of going to live in the ideal world where all of that holds true, and you're golden to live without any care.
- hunter2_ 10y ago
  You're right about government spying, but my argument isn't specific to government so let's set that aside and talk more generically. Bike theft: stealth, in my list above -- someone acted while you weren't attentive. You didn't hand over the bike, so you're not to be blamed. Even if you used no lock whatsoever, I wouldn't blame you. You could've done more, but you need to weigh the benefits against the burden of a massive lock so there's no perfect way out. Rape: force, in my list above. You had no ability to change the outcome. I wouldn't blame you. Hacked via social engineering: You spilled the beans. Spilling beans is avoidable with some practice, awareness, logic... this is not the same category as the others. I don't say "this is all you're fault," of course not. But unlike the bike thief and the rapist, all you had to do was ignore the attack.
Joeboy 10y ago
There is no reason to think, in this case, that it was a person they "didn't authenticate".
- hunter2_ 10y ago
  It's easy to think that, IMHO. Pre-arranging a challenge, recognizing by voice, performing a call-back to a widely publicized/trusted phone number... I really doubt anything like that occurred. And even if there was authentication, now it's time for authorization. The only authorized recipient of a password is the exact same entity with which you established the password.
  - Joeboy 10y ago
    What do you think occurred?

TallGuyShort 10y ago

Why this stigma against acknowledging that potential victims can (and would be wise to) take steps to protect themselves. Yes, dressing a certain way, drinking a lot of alcohol, and attending a party doesn't begin to excuse rape. But that doesn't mean it was a good idea and is something you should do without considering the possible consequences. If someone calls and says they work for a security firm, offers to confirm if you were involved in a hack and you do tell them your password, you are probably falling for a scam. That's all GP is saying.

lerpa 10y ago
Because it's easier to exonerate ourselves from any responsibility for our own mistakes than having to deal with that.
mostlyskeptical 10y ago
Thank you. I've gotten particularly sick of the phrase 'blaming the victim'. If you insult someone's mother, you might get hit. If you leave valuables or cash on top of a car in a bad neighborhood it might be stolen. It's still the fault of whoever did the bad action, and everyone would be better off if you didn't need to take precautions line that, but you could have easily taken steps to lower the chance of it happening. If you say to buckle your seatbelt, get a fire extinguisher, or look both ways before crossing the road no one bats an eye. God forbid you acknowledge that there are bad people in the world and you should take steps to protect yourself from them.
Joeboy 10y ago
> If someone calls and says they work for a security firm, offers to confirm if you were involved in a hack and you do tell them your password, you are probably falling for a scam. That's all GP is saying. GP is suggesting that the people involved were clueless rubes who gave out their passwords to people of unknown identity, which I submit is almost certainly untrue.
- TallGuyShort 10y ago
  You're possibly right, but that is pretty much what the article says. Perhaps there was more of a trust established between the parties. Perhaps they were shown a list of compromised passwords and asked if any of their passwords appeared on the list. But pointing out that what the article actually says happened makes you an easy target is hardly uncalled for. I'm taking issue with the "blaming the victim" card. Bad security practice is bad security practice and pointing it out doesn't make you Hitler.