3 ms·
> If someone calls and says they work for a security firm, offers to confirm if you were involved in a hack and you do tell them your password, you are probably
by Joeboy 10y ago
> If someone calls and says they work for a security firm, offers to confirm if you were involved in a hack and you do tell them your password, you are probably falling for a scam. That's all GP is saying.
GP is suggesting that the people involved were clueless rubes who gave out their passwords to people of unknown identity, which I submit is almost certainly untrue.
- TallGuyShort 10y agoYou're possibly right, but that is pretty much what the article says. Perhaps there was more of a trust established between the parties. Perhaps they were shown a list of compromised passwords and asked if any of their passwords appeared on the list. But pointing out that what the article actually says happened makes you an easy target is hardly uncalled for. I'm taking issue with the "blaming the victim" card. Bad security practice is bad security practice and pointing it out doesn't make you Hitler.
- Joeboy 10y ago> I'm taking issue with the "blaming the victim" card. I also tend to gag slightly at the phrase "victim blaming", because I think it's a shibboleth that identifies your allegiances and shuts down critical thinking. But I don't actually think it's unwarranted here. Yes, the article says the people involved gave Bindmans their passwords. It also says those passwords were defunct, and that Bindmans had them anyway. It doesn't say that they didn't make reasonable efforts to verify that sharing the passwords was the right thing to do (which, as it turns out, it was). It's extremely ungenerous to respond to that by saying they deserved it for being so crap at security. > Bad security practice is bad security practice and pointing it out doesn't make you Hitler. I am willing to concede that it's unlikely anybody in this thread is Hitler.