4 ms·

What sucks is how hard it is to do anything when you're on the inside and know just how dangerous the systems are, and management has no interest in fixing thin

What sucks is how hard it is to do anything when you're on the inside and know just how dangerous the systems are, and management has no interest in fixing things. A former employer of mine is a government agency with millions of accounts, with SSN and every kind of PII imaginable, they have actually been breached (millions of SSNs lost) ... and they still don't hash passwords. Would love to out them, but the management is vindictive as hell so I can't come up with a good way to out the place without great risk to myself. I'm sure many have been in this situation - we need a safe way for people like us to speak up before breaches happen.

jlgaddis 9y ago
An anonymous e-mail to someone like Brian Krebs, perhaps?
AnIdiotOnTheNet 9y ago
>A former employer of mine is a government agency with millions of accounts, with SSN and every kind of PII imaginable, they have actually been breached (millions of SSNs lost) ... and they still don't hash passwords. So the costs of the breach haven't been high enough to provoke action, which means they're probably making the right decision if one assumes that hashing the passwords would require a significant modification of their software, infrastructure, or processes.
- throwaway92782 9y ago
  Guessing you'd feel differently if it was you, or a family member, who had their identity breached along with information about every bad situation in your life. And no, the costs aren't high to change it. The code to do it has been done for a long time. It got mired in political grandstanding, and that's it.
  - throwaway92782 9y ago
    Also to pile on - running that way is a clear violation of that government's policies, and they have blatantly lied about other security issues to other (customer) government agencies that are trying to do the right thing. It's not just a matter of choosing cost savings over security, it's also about breaking the law.
  - AnIdiotOnTheNet 9y ago
    Of course I'd probably feel more strongly if I were affected, but that's true of any policy isn't it? That has nothing to do with the correctness of the decision. I think we should end mortgage tax deductions. Most homeowners would disagree. The fact that they are personally negatively affected is irrelevant to whether or not ending mortgage tax deductions should be done.

jlgaddis 9y ago

An anonymous e-mail to someone like Brian Krebs, perhaps?

AnIdiotOnTheNet 9y ago

>A former employer of mine is a government agency with millions of accounts, with SSN and every kind of PII imaginable, they have actually been breached (millions of SSNs lost) ... and they still don't hash passwords. So the costs of the breach haven't been high enough to provoke action, which means they're probably making the right decision if one assumes that hashing the passwords would require a significant modification of their software, infrastructure, or processes.

throwaway92782 9y ago
Guessing you'd feel differently if it was you, or a family member, who had their identity breached along with information about every bad situation in your life. And no, the costs aren't high to change it. The code to do it has been done for a long time. It got mired in political grandstanding, and that's it.
- throwaway92782 9y ago
  Also to pile on - running that way is a clear violation of that government's policies, and they have blatantly lied about other security issues to other (customer) government agencies that are trying to do the right thing. It's not just a matter of choosing cost savings over security, it's also about breaking the law.
- AnIdiotOnTheNet 9y ago
  Of course I'd probably feel more strongly if I were affected, but that's true of any policy isn't it? That has nothing to do with the correctness of the decision. I think we should end mortgage tax deductions. Most homeowners would disagree. The fact that they are personally negatively affected is irrelevant to whether or not ending mortgage tax deductions should be done.