10 ms·

> Today, the Senate Commerce Committee questioned former Yahoo CEO Marissa Mayer, Verizon chief privacy officer Karen Zacharia and both the current and former C

by beager 9y ago

> Today, the Senate Commerce Committee questioned former Yahoo CEO Marissa Mayer, Verizon chief privacy officer Karen Zacharia and both the current and former CEOs of Equifax on how to protect consumers against major data breaches. So, ask the person who lost 3 billion accounts, the person who is stuck with the mess from losing 3 billion accounts, the person who lost 145 million SSNs, and the person who is stuck with the mess from losing 145 million SSNs how to protect against data breaches? I appreciate the relevance of those individuals to data security, but they're clearly not subject matter experts. If I wanted to secure my home against burglars, burglary victims probably wouldn't be my first consultation. That said, the mostly fixed nature of SSNs and their intrinsic potential for introspection is a huge liability and we should move away from them. [edit: Karen Zacharia may well be a subject matter expert here, it's a little unfair to group her in with my rant.]

ProAm 9y ago
Politicians need to look like they are doing something. It doesn't matter if they actually do anything. If they look busy, they are busy and are obviously working hard and should be kept in that position.
burkaman 9y ago
Burglary victims should be your first consultation, because most people who weren't burgled were probably just lucky, or were burgled but haven't realized it yet. If there are 10 houses, a burglar tries to get into all 10 but only succeeds on 2, then you should talk to the 8 owners who successfully protected their houses. If there are 1000 houses, a burglar tries to get into 10 but doesn't tell you which 10, and succeeds on 2, you should talk to those 2 owners because they know for a fact what can fail. 990 owners will just say "do what I do" without having any evidence that their strategy is actually safe.
- ReverseCold 9y ago
  Maybe a bad analogy, but I do think that it doesn't make sense to ask "burglary victims" for computer security at least.
  - goialoq 9y ago
    They know what parts of their system were compromised, at least partially.
    - rgbrenner 9y ago
      Yes, without Equifax, how could anyone know they should apply security patches to their systems? No one knew this until Equifax.
      - saurik 9y ago
        Technically, it is still only one data point: we should probably run some kind of controlled study to verify that this is actually a problem before we go overboard.
      - burkaman 9y ago
        Ok, so why didn't they? Should we ask TransUnion what went wrong at Equifax, and what laws and regulations are needed, if any? Or should we ask Equifax?
        phkahler 9y ago
        >> Ok, so why didn't they? The parent post was sarcasm. Equifax did not follow security practices that are common and widespread in the industry. And by industry I don't mean credit reporting companies, but companies that have systems connected to the internet.
        burkaman 9y ago
        I understand that. Why didn't they follow those practices? What can we do to force companies to follow them in the future?
        chii 9y ago
        Make the liability for data safe keeping in the company that holds the data. You don't see medical records have issues like this, because the laws surrounding it is quite fierce.
- jorgec 9y ago
  They aren't burglary victims but the guards that sleep (drunken) in their night shift.
- deleted 9y ago
  [deleted]
- curun1r 9y ago
  Or, you know, maybe stop talking to homeowners, victims or not, and start talking to people who make locks and safes. Actual subject matter experts rather than targets. CEOs, at best, will be proxies for whatever security personnel they have on staff and we have no way of evaluating the credentials of those security staff. At worst, they'll be advocating for policies that reduce their exposure/costs at the expense of greater overall fraud costs. The senate should use their own knowledgeable proxy in this case. NIST has already shown itself capable of creating security standards of a reasonable quality. Run another public competition for a national ID system capable of replacing SSN and let real security professionals propose (and then debate) a way out of the current mess. Senators can then codify the results of that process into law.
  - adventured 9y ago
    > Or, you know, maybe stop talking to homeowners, victims or not, and start talking to people who make locks and safes. Actual subject matter experts rather than targets. You want to talk to the burglars. They already know the locks and safes and likely know even better how to break them than the creators. In this case, you want to talk to hackers. The reason Congressional panels do things like this, is to put on a good show. They like to be seen dealing with higher level matters/people as a demonstration of stature.
    - djrogers 9y ago
      > In this case, you want to talk to hackers. No - the problem here isn’t hacking, it’s allowing a fixed, easily learned number be a sole proof of ‘identity’. SSNs were used in identity theft long before hackers.
miles 9y ago
> Karen Zacharia may well be a subject matter expert here, it's a little unfair to group her in with my rant. "Millions of Verizon customer records exposed in security lapse - Customer records for at least 14 million subscribers, including phone numbers and account PINs, were exposed." http://www.zdnet.com/article/millions-verizon-customer-records-israeli-data/ http://www.zdnet.com/article/millions-verizon-customer-recor... "1.5M customers of Verizon anti-hacker unit hacked" https://www.usatoday.com/story/tech/news/2016/03/25/15-million-customers-verizon-anti-hacker-unit-hacked/82251118/ https://www.usatoday.com/story/tech/news/2016/03/25/15-milli...
bagacrap 9y ago
I was burglarized by someone who kicked my front door down. Everyone who hasn't experienced that thinks it's important to fully gate off your back yard. My first-hand experience tells me that that advice wouldn't be sufficient to secure my home. Why would you prefer speculation over experience?
- dvtv75 9y ago
  One of the houses I lived in had a really strong lock on the front door. The lock wasn't really the problem, though: the door is made up of four float glass panels. Of course, even if it was a solid wood door, there's another problem: the bit the lock slides into is held onto the frame by two screws.
  - bhandziuk 9y ago
    It's crazy some door knob/dead bolt kits come with screws that just screw into the jamb. Little 3/4" screws. You really need those 3"+ screws that go into the studs. I'm sure you do this now given your experience but if you ever get a kit that doesn't come with screws like that they should definitely be purchased separately.
    - ajmurmann 9y ago
      It truly is crazy. Every door frame to the outside in my house used to have these tiny screws. It's so trivial that even I who massively struggles with the simplest home improvement tasks was easily able to replace the screws with much larger screws that go into the studs. Yet it seems to be standard practice to use these tiny screws. The other thing I recommend is getting security film for your windows and have it anchored to the window frame. It doesn't prevent anyone from breaking them but it makes the process take much longer and be much noisier.
    - xenadu02 9y ago
      Another pro tip: good deadbolt kits have a lock cup with one or two holes inside as well so you can secure it even further. Second pro tip: replace your door hinge screws (on the jamb and door) with larger 3-4” screws. Third tip: outside doors should be solid wood or metal, not hollow.
hedora 9y ago
I suppose Karen Zacharia is the token black hat? Verizon aggressively breaks people’s expectations of privacy by MITM rewriting HTTP connections. (Or, maybe she was at Yahoo! during the breaches...)
- Sephr 9y ago
  Verizon isn't breaking people's expectation of privacy implicitly by MitM-rewriting unencrypted HTTP. They are breaking this expectation by using the MitM-rewriting of unencrypted HTTP to inject tracking identifier headers for third parties. Comcast also MitM-rewrites requests and occasionally leaves extra fingerprinting entropy, but they don't intentionally kill your privacy like Verizon.
PakG1 9y ago
Is there a transcript of what kind of questions were asked? I can imagine useful information being gleaned by questions like, "what was the nature of the attack, how were people able to get in, what exactly happened here, how did you store the data, why were you confident it was secure, etc?" That gives you a starting point of what the facts are, what was really experienced. When you are working from a ground zero of zero knowledge (and I bet most of these committee members have zero knowledge, if not all of them), it's good to establish facts of what happened before figuring out solutions.
- daveevad 9y ago
  I haven't seen a transcript anywhere but presume it may end up in the Congressional Record. The archived webcast is available https://www.commerce.senate.gov/public/index.cfm/hearings?ID=A29EB61A-4372-41B5-897A-ED169BC331E5 https://www.commerce.senate.gov/public/index.cfm/hearings?ID... The prepared statements from the witnesses are available to view at the bottom of that link as well.
TheCoelacanth 9y ago
They aren't asking them for security advice. They are trying to find out the specific ways that they fucked up their security. There could be numerous other companies that are messing things up in exactly the same way, they just have had the misfortune of being breached yet.
djsumdog 9y ago
It's 2008 all over again. The US/International shit show we call a media tried to make Occupy seem like lost-goalless hippies. It was the ghost of Nixson. You know why people were mad? All those executives at the highest levels committed fraud, perpetuated fraud, created a culture from top to bottom of fraud where people who issued loans were encourage to forge documents, make up incomes and sell people on terrible mortgages. Then the media blamed those people instead of the people who put that system into place. None of those executives went to jail. None of them faced any real fines. None of them faced any real consequences. Many of them walked away with millions. PNC bought National City Bank for $5 billion and got a $5b tax credit (National City wasn't allowed any TARP funding). Big banks knew 2008 would happen, and when it did, they used it to buy all their competition at the expense of millions of Americans who lost their homes, retirement savings, etc. It doesn't matter if it was Bush or Obama or Hillary or Trump, because no matter which puppet is on stage, no one in the 1% who either allowed such terrible things to happen or made them intentionally happen or profited from things that happened to have fallen into their laps; none of them face any real consequences. The executives who sold off Equifax shares getting off without any wrongdoing is a perfect example. It's obvious they knew. They made money and they will never and can never be held accountable in today's world because they control, to various levels, all the world leaders and banks.
- platz 9y ago
  Um, what does any of that have to do with the Congressional hearing?
Joeri 9y ago
You can keep the SSN as primary key for identity, you just need a different mechanism for authenticating as that identity. This is a solved problem in most countries, the U.S. can just pick any from a long list of countries to copy the model of wholesale.
ams6110 9y ago
> So, ask [the people who lost billions of accounts and SSNs] how to protect against data breaches? It's worse than that. These are the very people who profit on trading in data linked to identity information. It's like asking the fox how to secure the henhouse, after he ate all the hens. Any new identity scheme has to be something that does not rely on security practices of any third parties. The public component of the identifier must be useless as an identifier without the private part held only by the individual.

by beager 9y ago

ProAm 9y ago

Politicians need to look like they are doing something. It doesn't matter if they actually do anything. If they look busy, they are busy and are obviously working hard and should be kept in that position.

burkaman 9y ago

Burglary victims should be your first consultation, because most people who weren't burgled were probably just lucky, or were burgled but haven't realized it yet. If there are 10 houses, a burglar tries to get into all 10 but only succeeds on 2, then you should talk to the 8 owners who successfully protected their houses. If there are 1000 houses, a burglar tries to get into 10 but doesn't tell you which 10, and succeeds on 2, you should talk to those 2 owners because they know for a fact what can fail. 990 owners will just say "do what I do" without having any evidence that their strategy is actually safe.

ReverseCold 9y ago
Maybe a bad analogy, but I do think that it doesn't make sense to ask "burglary victims" for computer security at least.
- goialoq 9y ago
  They know what parts of their system were compromised, at least partially.
  - rgbrenner 9y ago
    Yes, without Equifax, how could anyone know they should apply security patches to their systems? No one knew this until Equifax.
    - saurik 9y ago
      Technically, it is still only one data point: we should probably run some kind of controlled study to verify that this is actually a problem before we go overboard.
    - burkaman 9y ago
      Ok, so why didn't they? Should we ask TransUnion what went wrong at Equifax, and what laws and regulations are needed, if any? Or should we ask Equifax?
      - phkahler 9y ago
        >> Ok, so why didn't they? The parent post was sarcasm. Equifax did not follow security practices that are common and widespread in the industry. And by industry I don't mean credit reporting companies, but companies that have systems connected to the internet.
        burkaman 9y ago
        I understand that. Why didn't they follow those practices? What can we do to force companies to follow them in the future?
        chii 9y ago
        Make the liability for data safe keeping in the company that holds the data. You don't see medical records have issues like this, because the laws surrounding it is quite fierce.
jorgec 9y ago
They aren't burglary victims but the guards that sleep (drunken) in their night shift.
deleted 9y ago
[deleted]
curun1r 9y ago
Or, you know, maybe stop talking to homeowners, victims or not, and start talking to people who make locks and safes. Actual subject matter experts rather than targets. CEOs, at best, will be proxies for whatever security personnel they have on staff and we have no way of evaluating the credentials of those security staff. At worst, they'll be advocating for policies that reduce their exposure/costs at the expense of greater overall fraud costs. The senate should use their own knowledgeable proxy in this case. NIST has already shown itself capable of creating security standards of a reasonable quality. Run another public competition for a national ID system capable of replacing SSN and let real security professionals propose (and then debate) a way out of the current mess. Senators can then codify the results of that process into law.
- adventured 9y ago
  > Or, you know, maybe stop talking to homeowners, victims or not, and start talking to people who make locks and safes. Actual subject matter experts rather than targets. You want to talk to the burglars. They already know the locks and safes and likely know even better how to break them than the creators. In this case, you want to talk to hackers. The reason Congressional panels do things like this, is to put on a good show. They like to be seen dealing with higher level matters/people as a demonstration of stature.
  - djrogers 9y ago
    > In this case, you want to talk to hackers. No - the problem here isn’t hacking, it’s allowing a fixed, easily learned number be a sole proof of ‘identity’. SSNs were used in identity theft long before hackers.

miles 9y ago

> Karen Zacharia may well be a subject matter expert here, it's a little unfair to group her in with my rant. "Millions of Verizon customer records exposed in security lapse - Customer records for at least 14 million subscribers, including phone numbers and account PINs, were exposed." http://www.zdnet.com/article/millions-verizon-customer-records-israeli-data/ http://www.zdnet.com/article/millions-verizon-customer-recor... "1.5M customers of Verizon anti-hacker unit hacked" https://www.usatoday.com/story/tech/news/2016/03/25/15-million-customers-verizon-anti-hacker-unit-hacked/82251118/ https://www.usatoday.com/story/tech/news/2016/03/25/15-milli...

bagacrap 9y ago

I was burglarized by someone who kicked my front door down. Everyone who hasn't experienced that thinks it's important to fully gate off your back yard. My first-hand experience tells me that that advice wouldn't be sufficient to secure my home. Why would you prefer speculation over experience?

dvtv75 9y ago
One of the houses I lived in had a really strong lock on the front door. The lock wasn't really the problem, though: the door is made up of four float glass panels. Of course, even if it was a solid wood door, there's another problem: the bit the lock slides into is held onto the frame by two screws.
- bhandziuk 9y ago
  It's crazy some door knob/dead bolt kits come with screws that just screw into the jamb. Little 3/4" screws. You really need those 3"+ screws that go into the studs. I'm sure you do this now given your experience but if you ever get a kit that doesn't come with screws like that they should definitely be purchased separately.
  - ajmurmann 9y ago
    It truly is crazy. Every door frame to the outside in my house used to have these tiny screws. It's so trivial that even I who massively struggles with the simplest home improvement tasks was easily able to replace the screws with much larger screws that go into the studs. Yet it seems to be standard practice to use these tiny screws. The other thing I recommend is getting security film for your windows and have it anchored to the window frame. It doesn't prevent anyone from breaking them but it makes the process take much longer and be much noisier.
  - xenadu02 9y ago
    Another pro tip: good deadbolt kits have a lock cup with one or two holes inside as well so you can secure it even further. Second pro tip: replace your door hinge screws (on the jamb and door) with larger 3-4” screws. Third tip: outside doors should be solid wood or metal, not hollow.

hedora 9y ago

I suppose Karen Zacharia is the token black hat? Verizon aggressively breaks people’s expectations of privacy by MITM rewriting HTTP connections. (Or, maybe she was at Yahoo! during the breaches...)

Sephr 9y ago
Verizon isn't breaking people's expectation of privacy implicitly by MitM-rewriting unencrypted HTTP. They are breaking this expectation by using the MitM-rewriting of unencrypted HTTP to inject tracking identifier headers for third parties. Comcast also MitM-rewrites requests and occasionally leaves extra fingerprinting entropy, but they don't intentionally kill your privacy like Verizon.

PakG1 9y ago

Is there a transcript of what kind of questions were asked? I can imagine useful information being gleaned by questions like, "what was the nature of the attack, how were people able to get in, what exactly happened here, how did you store the data, why were you confident it was secure, etc?" That gives you a starting point of what the facts are, what was really experienced. When you are working from a ground zero of zero knowledge (and I bet most of these committee members have zero knowledge, if not all of them), it's good to establish facts of what happened before figuring out solutions.

daveevad 9y ago
I haven't seen a transcript anywhere but presume it may end up in the Congressional Record. The archived webcast is available https://www.commerce.senate.gov/public/index.cfm/hearings?ID=A29EB61A-4372-41B5-897A-ED169BC331E5 https://www.commerce.senate.gov/public/index.cfm/hearings?ID... The prepared statements from the witnesses are available to view at the bottom of that link as well.

TheCoelacanth 9y ago

They aren't asking them for security advice. They are trying to find out the specific ways that they fucked up their security. There could be numerous other companies that are messing things up in exactly the same way, they just have had the misfortune of being breached yet.

djsumdog 9y ago

It's 2008 all over again. The US/International shit show we call a media tried to make Occupy seem like lost-goalless hippies. It was the ghost of Nixson. You know why people were mad? All those executives at the highest levels committed fraud, perpetuated fraud, created a culture from top to bottom of fraud where people who issued loans were encourage to forge documents, make up incomes and sell people on terrible mortgages. Then the media blamed those people instead of the people who put that system into place. None of those executives went to jail. None of them faced any real fines. None of them faced any real consequences. Many of them walked away with millions. PNC bought National City Bank for $5 billion and got a $5b tax credit (National City wasn't allowed any TARP funding). Big banks knew 2008 would happen, and when it did, they used it to buy all their competition at the expense of millions of Americans who lost their homes, retirement savings, etc. It doesn't matter if it was Bush or Obama or Hillary or Trump, because no matter which puppet is on stage, no one in the 1% who either allowed such terrible things to happen or made them intentionally happen or profited from things that happened to have fallen into their laps; none of them face any real consequences. The executives who sold off Equifax shares getting off without any wrongdoing is a perfect example. It's obvious they knew. They made money and they will never and can never be held accountable in today's world because they control, to various levels, all the world leaders and banks.

platz 9y ago
Um, what does any of that have to do with the Congressional hearing?

Joeri 9y ago

You can keep the SSN as primary key for identity, you just need a different mechanism for authenticating as that identity. This is a solved problem in most countries, the U.S. can just pick any from a long list of countries to copy the model of wholesale.

ams6110 9y ago

> So, ask [the people who lost billions of accounts and SSNs] how to protect against data breaches? It's worse than that. These are the very people who profit on trading in data linked to identity information. It's like asking the fox how to secure the henhouse, after he ate all the hens. Any new identity scheme has to be something that does not rely on security practices of any third parties. The public component of the identifier must be useless as an identifier without the private part held only by the individual.