4 ms·

I don't think this is a moral question. Whether or not this information should be collected at all may be a moral question, but how it's secured is about techn

by trgv 9y ago

I don't think this is a moral question. Whether or not this information should be collected at all may be a moral question, but how it's secured is about technical competence. I also think we should keep in mind that, even if it was well-secured, there could have still been a breach. Would that have been less bad? The result would be the same.

ska 9y ago
Would that have been less bad? Quite plausible yes, with better systems design.
garrettdc 9y ago
The moral issue isn't one of technical competence, but rather of having the integrity to perform the appropriate due diligence required of a company handling such sensitive information. No security professional is going to argue that you can or will prevent every vulnerability from being exploited. However, when you leave a critical vulnerability open for months on end, you knowingly and unnecessarily expose yourself, and any parties associated with you (by choice or otherwise), to a level of risk that is unacceptable. If this were a 0-day exploit, then the conversation would be different. If their exec's hadn't sold off so much stock a such a suspect moment, then the conversation would be different. If the IT department had appropriately began remediating the vulnerability within a respectable timeframe but had already been exploited, then the conversation would be different.
vec 9y ago
To my view, collecting and storing that much information is presumptively immoral. It creates a public hazard, in the same vein as stockpiling explosives or toxic chemicals. There is, however, a degree of respect for that hazard, demonstrated in concrete safety practices, that can override that presumption. I don't think Equifax has demonstrated that respect. To a layman's view, not many companies do. It's possible that the amount of respect necessary for a hazard as large as the one Equifax created is too onerous for a for-profit entity to realistically implement, but I don't know that there's a fundamental reason that sufficiently paranoid engineering practices couldn't make this moral.

by trgv 9y ago

ska 9y ago

Would that have been less bad? Quite plausible yes, with better systems design.

garrettdc 9y ago

The moral issue isn't one of technical competence, but rather of having the integrity to perform the appropriate due diligence required of a company handling such sensitive information. No security professional is going to argue that you can or will prevent every vulnerability from being exploited. However, when you leave a critical vulnerability open for months on end, you knowingly and unnecessarily expose yourself, and any parties associated with you (by choice or otherwise), to a level of risk that is unacceptable. If this were a 0-day exploit, then the conversation would be different. If their exec's hadn't sold off so much stock a such a suspect moment, then the conversation would be different. If the IT department had appropriately began remediating the vulnerability within a respectable timeframe but had already been exploited, then the conversation would be different.

vec 9y ago

To my view, collecting and storing that much information is presumptively immoral. It creates a public hazard, in the same vein as stockpiling explosives or toxic chemicals. There is, however, a degree of respect for that hazard, demonstrated in concrete safety practices, that can override that presumption. I don't think Equifax has demonstrated that respect. To a layman's view, not many companies do. It's possible that the amount of respect necessary for a hazard as large as the one Equifax created is too onerous for a for-profit entity to realistically implement, but I don't know that there's a fundamental reason that sufficiently paranoid engineering practices couldn't make this moral.